Application of the HIPAA privacy rule to employer benefit plans and a compliance theory of statutory interpretation

The application of the federal privacy regulations promulgated pursuantto the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to employer benefit plans is arguably the most conceptually difficult area of a complex law. A purely textual reading of the Rule, when applied to employer plans, results in varying interpretations on some significant issues and puzzling results on others. This Article offers a practical approach for interpreting the rule when clear-cut answers are not provided by the text and DHHS guidance is nonexistent or unclear. In addition, this approach can be applied to the interpretation of other statutes and regulations.