164.314(b) Group health plan requirements and evidence

What 164.314(b) requires of a group health plan's sponsor

If your organization sponsors a group health plan, the plan documents must be amended so that the sponsor, usually the employer, reasonably and appropriately safeguards the electronic protected health information it handles for plan administration. Under 45 CFR 164.314(b), this document obligation applies only to group health plans, not to other covered entities. The risk is concrete: claims questions, enrollment disputes and eligibility files routinely move ePHI into HR and benefits workflows that sit outside the security program run for clinical systems, so the sponsor becomes the place where plan data is most exposed.

The requirement is easy to miss for two reasons. First, HR and benefits staff often treat plan data as an employee administration matter and never see the covered entity's Security Rule program. Second, the obligation is written into plan documents, so it can sit untouched in a legal file while the sponsor's systems keep receiving data. Start by confirming with counsel and the plan administrator whether the sponsor actually receives ePHI, and which disclosures fall outside the exceptions in 164.314(b)(1). Then check that the amended plan documents contain the four required provisions: safeguards, security measures supporting adequate separation, agents agreeing to the same measures, and incident reporting to the plan.

Treat the amendment as the start of a working control, not the end of the task. Ask who in the sponsor is accountable for safeguards, which HR systems hold plan ePHI, whether agents such as payroll or benefits vendors have signed on to the measures, and how an incident would reach the plan. NIST SP 800-66 Rev. 2 maps each of the four provisions to a key activity that can guide the review. Confirm the current text of the provisions directly in the eCFR text of 164.314) before relying on a summary, including the exceptions that remove some disclosures from scope.

Which plans, sponsors and disclosures bring 164.314(b) into scope

The 164.314(b) requirement applies only when a group health plan discloses ePHI to its sponsor, so the first work is deciding whether the plan qualifies and what data actually moves. The cards below cover the decisions that change the scope: plan status, sponsor access, the systems that touch the data, and whether an insurer or administrator carries the obligation instead.

Confirm the plan is a group health plan

The provision applies to group health plans, which generally means employer-sponsored medical, dental, vision or prescription coverage. Wellness programs, disability plans and other benefits may fall outside the definition, so check the plan's legal classification before drafting amendments. A plan that is not a group health plan does not need these plan document provisions, but the employer may still have other Security Rule duties for PHI it receives. Ask counsel or the benefits team to document the classification and keep it with the plan file.

Map what the sponsor actually receives

The provisions attach to ePHI the sponsor handles for the plan, so the question is what the sponsor receives beyond the exceptions in 164.504(f)(1)(ii) and (iii) and what is covered by a valid authorization under 164.508. Summary health information and enrollment data may fall under those exceptions, but claims detail, appeals files or case notes usually do not. Build an inventory of each disclosure and its legal basis, because the scope of safeguards follows the data the sponsor holds.

Trace HR and benefits systems

Plan data often reaches the sponsor through HR information systems, benefits portals, payroll platforms, email and shared drives used by staff who administer enrollment or handle claims questions. Each system that stores or displays ePHI is part of the sponsor's safeguard scope, including backups and exports. Ask HR for a list of every application, spreadsheet and mailbox that receives plan data, and note which ones are separated from employment decisions, because the separation requirement depends on it.

Identify third parties that touch the data

Sponsors often rely on brokers, benefits consultants, payroll processors, wellness vendors or cloud email and HR platforms that handle plan information. The provisions require the sponsor's agents to agree to the same security measures, so every vendor acting on the sponsor's behalf needs a documented obligation. Confirm which vendors act as agents, which are independent parties with their own HIPAA duties, and which only receive de-identified or summary data. Contracts should reflect that split.

Check whether an insurer or TPA holds the ePHI

When a health insurer or third-party administrator handles claims, eligibility and appeals, the plan may disclose little or no ePHI to the sponsor. In that arrangement the Security Rule duties for most ePHI sit with the carrier or administrator, and the sponsor's amendment may be narrow or unnecessary. Ask for written confirmation of which records the sponsor receives and whether any employer-side portal or reporting feed brings ePHI back into the sponsor's environment. Scope should be reassessed whenever the administrator or data flow changes.

How an assessor tests the plan document amendments

This table sets out how an assessor tests each of the four provisions a group health plan must place in its plan documents, the evidence they ask for and the findings that usually come up. Read each row as a test: the left column names the provision, and the other columns show what to produce and where plans fail. The main takeaway is that an executed amendment alone rarely passes; the assessor will also check that the sponsor's practices match the language.

Provision	Evidence requested	Common findings
Safeguards: sponsor implements administrative, physical and technical safeguards for plan ePHI	Executed plan document amendment with its date, the sponsor's written security policies, risk analysis scope covering plan ePHI, and named security responsibility	Plan document unamended or amended only in name, no policies covering plan ePHI, safeguards described in the document but not in operation
Separation: security measures supporting the adequate separation required by 164.504(f)(2)(iii)	Written separation procedures, list of employees or classes with plan ePHI access, access approvals and removal records, and system access settings for HR and benefits systems	Separation described only in the plan document, shared mailboxes or spreadsheets holding claims data, access lists not reviewed after role changes
Agents: sponsor ensures agents and subcontractors agree to the same security measures	Agent contracts or written agreements with security terms, a list of agents receiving plan ePHI, and evidence the terms were accepted before data transfer	No inventory of agents, verbal or informal arrangements with payroll or benefits administrators, agreements that predate the amendment and never refreshed
Incident reporting: sponsor reports security incidents to the plan	Written incident reporting procedure with a named contact, incident log showing reports made to the plan, and the plan's acknowledgment or notification records	No reporting path defined, incidents handled internally without notice to the plan, reporting duty missing from the plan document
Overall document test: the amendment is in force and matches practice	Executed amendment history, dated version of the plan document in effect, and a walkthrough showing staff follow the written procedures	Amendment never executed, language copied without operational follow-through, no record linking the amendment to the sponsor's actual data flows

How to amend plan documents and make the sponsor's controls real

This sequence turns the four required plan document provisions into named sponsor controls, owners and evidence, so the group health plan can show that the sponsor safeguards the ePHI it receives. Each step ends with an artifact that an auditor or OCR investigator can review.

Inventory the ePHI the sponsor receives
Start by listing every flow of ePHI from the group health plan to the plan sponsor, including enrollment files, claims status inquiries, appeals and vendor reports that pass through sponsor systems. Name the business owner, the system or mailbox, the data elements and how often each flow occurs. The output is a written inventory signed off by the plan administrator and the sponsor's HR and IT leads. You know it is complete when a sample of sponsor systems can be traced back to an inventory line.
Confirm which exception applies
For each flow in the inventory, determine whether it falls under the exceptions in 164.504(f)(1)(ii) or (iii), or is authorized under 164.508, which would take it outside the amendment requirement. Privacy counsel or the privacy official should review each determination and record the reasoning. The output is a short exception memo that lists each flow, the exception relied on or the decision that the amendment applies, and the reviewer's name. Flows that match no exception move forward to the drafting step.
Draft the plan document amendment
Draft amendment language that covers the four provisions in 164.314(b)(2): the sponsor implements administrative, physical and technical safeguards for ePHI; the sponsor supports adequate separation with security measures; the sponsor's agents agree to the same measures; and the sponsor reports security incidents to the plan. Use the plan's own defined terms and avoid copying regulatory text verbatim. The output is a redline of the plan document with each provision in its own clause. Legal counsel should confirm the wording before approval.
Map each provision to sponsor controls and owners
For each of the four provisions, list the specific sponsor controls that satisfy it, such as role-based access to the benefits mailbox, encryption of ePHI at rest and in transit, and a documented separation between benefits and employment decisions. Assign a named owner and a review frequency to each control. NIST SP 800-66 Rev. 2 describes these four provisions as key activities, which can help frame the mapping. The output is a control matrix that links each provision to controls, owners and the evidence each control produces.
Obtain agent agreements
Identify every agent that receives ePHI from the sponsor, such as a payroll processor, benefits consultant or managed IT provider, and confirm each agent's access to the plan's ePHI. Have each agent sign an agreement that binds it to the same security measures the sponsor applies. Store the signed agreements with the amended plan documents. The output is a register of agents, what each one receives, and a signed agreement on file for each. Agents that refuse to agree should be removed from the flow or handled through a separate arrangement reviewed by counsel.
Set the incident reporting path
Define how a security incident affecting plan ePHI at the sponsor moves from discovery to report to the plan, including who detects it, who decides it is an incident, who notifies the plan administrator and the timing the plan document sets. Test the path with a tabletop exercise that uses an illustrative scenario, such as a misdirected benefits email. The output is a written reporting procedure with named contacts and a record of the exercise. Confirm any notification timing with counsel rather than assuming a value.
Approve and file the amended documents
Obtain formal approval of the amended plan document, the control matrix, the agent register and the reporting procedure from the plan sponsor's authorized officer and the plan administrator. Distribute the amendment to the people who administer the plan and retain the signed versions with the Security Rule documentation. The output is an approved, dated amendment on file with its supporting records. Revisit the package when the plan, sponsor systems or agents change, and track any changes to the rule through the pending revision and its status.

Why the four required provisions need separate proof

A signed plan document amendment proves that the sponsor agreed to four commitments. It does not prove the sponsor keeps them. Section 164.314(b)(2) requires the amendment to provide that the sponsor implements administrative, physical and technical safeguards for the ePHI it handles for the plan, supports the adequate separation required by 164.504(f)(2)(iii) with security measures, ensures its agents agree to those measures, and reports security incidents to the plan. NIST SP 800-66 Rev. 2 treats each of these as its own key activity, and each one needs its own evidence. A group health plan that files four signed clauses and nothing more has documented intent, not compliance.

Start with safeguards and separation, because they describe systems you can inspect. For safeguards, ask the sponsor for its written security program, its access list for any system holding plan ePHI, its authentication settings and its logs showing who opened claims or eligibility files. For separation, the test is whether employees who handle plan data in human resources or benefits roles are walled off from other employment decisions. Pull the access grants for those roles and the technical controls that enforce them, such as role-based permissions, separate mailboxes or restricted shared drives. A policy stating that separation exists is not the same as an access report showing it does.

Agents and incident reporting need records that show the process ran. For agents, collect the signed agreements with each vendor or consultant that receives plan ePHI and confirm each one contains the security commitments. For incident reporting, test the path: ask the sponsor to show the last security event it logged, when it was escalated, and when and how the plan was told. If the sponsor has had no incidents, a tabletop exercise with a dated record is a reasonable substitute. Confirm with your counsel and the sponsor which of these checks belong in the plan's own audit file, and how often they are repeated.

Evidence that passes a 164.314(b) review

A reviewer checking 164.314(b) will ask whether the plan document says what the rule requires and whether the sponsor behaves that way in practice. The six artifacts below answer both questions, and each one needs a named owner and a review date so it stays current between audits.

Amended plan document and effective dates

The signed plan document amendment is the starting point for any review, because it is the instrument that obligates the sponsor to safeguard ePHI. Confirm that the amendment contains the four required provisions, that it names the sponsor and the plan, and that it carries an effective date and a record of who approved it. Keep prior versions so a reviewer can see which terms applied during any past period. Confirm the current wording with your counsel, since the plan document is a legal record.

Sponsor safeguard control records

The sponsor must implement administrative, physical and technical safeguards for the ePHI it receives from the plan. Keep a control register that maps each safeguard to an owner, a configuration or procedure, and the most recent test result. Typical records include access approvals, encryption settings for systems holding plan data, and facility controls for paper or devices. Ask the sponsor's security lead to sign the register each review cycle so the record reflects current practice, not the design from the date of the amendment.

Separation and access reviews

Section 164.504(f)(2)(iii) requires adequate separation between plan and corporate functions, and 164.314(b) requires security measures to support it. Keep a current list of employees and roles that may access plan ePHI, the justification for each, and the date of the last review. Reviews should remove access that no longer fits the role, including access granted to shared mailboxes, shared drives and HR systems that hold claims or enrollment data. Record every removal so the review shows a working control, not just a list.

Executed agent agreements

The sponsor must ensure that any agent receiving plan ePHI agrees to the same security measures. Keep a signed agreement for each agent, such as a third-party administrator, broker, or IT or payroll provider, along with the date signed and the scope of ePHI covered. Compare the list of agents against the systems and vendors that actually receive plan data, because agents added through IT changes are a common gap. Check that each agreement names the security obligations and the incident reporting duty.

Security incident reporting logs

The sponsor must report security incidents affecting plan ePHI to the plan. Maintain a log that records each incident's date, what happened, what ePHI was involved, who was notified at the plan, and when. Include incidents that turned out to involve no ePHI, since the log shows that the intake process works. Ask whether the log is tied to the sponsor's general incident process so that reports to the plan are not missed when a ticket is filed under another category.

Tabletop exercise records

Logs show what happened, while tabletop records show whether the sponsor can respond when it matters. Run at least one scenario per review cycle in which plan ePHI is exposed, for example a misdirected benefits file or a compromised HR account, and record the attendees, the decisions made, the time to notify the plan, and the gaps identified. Assign an owner to each gap and track it to closure. Keep the scenario, the notes and the follow-up actions together so a reviewer can trace the lesson from exercise to fix.

What meeting 164.314(b) costs in money and effort

This table breaks down the cost components of amending a group health plan document under 164.314(b), who is paid for each, and whether the cost is one-time or recurring. Use it to scope a quote with counsel and the plan sponsor, since no fee or duration for these items has been published in the supplied facts.

Cost component	Who carries the work	One-time or recurring	What drives it up or down
Legal drafting of the plan document amendment	Outside counsel or the plan's in-house counsel, with plan sponsor review	One-time, revisited when the plan or the Security Rule changes	Number of plan documents, whether an existing amendment can be adapted, and how many sponsor functions are in scope
Sponsor safeguard inventory and gap review	Sponsor security and privacy staff, sometimes with an outside assessor	One-time, then repeated during periodic risk analysis	How many systems touch plan ePHI and whether they are already documented
Separation controls under 164.504(f)(2)(iii)	Sponsor HR, IT and engineering teams, possibly a platform implementation partner	Mostly one-time build, with recurring access reviews	Size of the workforce with plan access, how many shared systems exist, and whether access is role-based today
Agent contract review and security terms	Sponsor counsel and procurement, with each agent such as a TPA or broker	One-time per agent, then at each contract renewal	Number of agents, whether terms already include security obligations, and negotiating leverage with each vendor
Incident reporting setup to the plan	Sponsor security operations, plan privacy official, and counsel for the reporting terms	One-time for procedures and contacts, recurring for tabletop testing	How incidents are detected and escalated today, and how quickly the sponsor must notify the plan under the agreed terms
Ongoing upkeep and evidence retention	Sponsor compliance staff, with tooling or retainer support if chosen	Recurring, usually annual or at material change	Frequency of plan changes, staff turnover, and how well evidence is collected as work happens
Independent review of the amendment and controls	Independent auditor or assessor, selected and paid by the sponsor	Recurring if the sponsor commissions it	Scope of the review and whether the assessor is asked to test controls or only read documents

Who drafts, implements and tests the sponsor's obligations

Plan counsel and the benefits and HR team own the legal text. They decide which plan document amendments are needed, confirm that the sponsor has agreed to them, and check that the amendments match how the sponsor actually receives and uses electronic protected health information for plan administration. Because the required provisions cover safeguards, separation, agents and incident reporting, counsel usually needs input from the security owner before drafting, so the language describes controls that exist.

Amendment drafting: Counsel writes the provisions so the plan document requires the sponsor to safeguard ePHI it handles for the plan, with the exceptions in 164.314(b)(1) stated precisely.
Sponsor certification: The sponsor's authorized officer signs or accepts the amended document, and the record of that acceptance is kept with the plan's compliance files.
Separation language: Benefits staff confirm which employees may access plan ePHI and how that matches the adequate separation required by 164.504(f)(2)(iii).
Agent flow-down: Counsel reviews the agreements with service providers acting for the sponsor to confirm they accept the same security measures.
Change control: Any new plan administration process triggers a review of the amendment.

Confirm with counsel whether the plan's disclosures fall under the exceptions in 164.504(f)(1)(ii) or (iii) or are authorized under 164.508, because that decides whether the amendment is needed at all.

Where sponsors usually fall short on plan document amendments

Group health plans rely on the plan sponsor to safeguard ePHI, but the plan document amendments that make that duty enforceable are often missing or generic. The gaps below cluster around four required provisions: safeguards, separation, agents and incident reporting. Each card names a gap and the check that closes it.

Plan document never amended

Many sponsors have a plan document that predates the Security Rule, or one that was reviewed for benefits language only. Under 164.314(b)(1), the plan must provide that the sponsor will reasonably and appropriately safeguard ePHI it handles for the plan. Pull the current plan document and confirm it contains that language, with a dated amendment record. Confirm the amendment exists before anything else. Ask counsel to review the wording against the exceptions in 164.504(f)(1)(ii) and (iii) and 164.508.

Amendments not matched to sponsor controls

Some plan documents include the four required provisions in general terms that no one has tested against how the sponsor actually operates. A sponsor may promise administrative, physical and technical safeguards without a named owner, policy or system behind each one. NIST SP 800-66 Rev. 2 treats each provision as an amendment to be backed by controls. Map each promised safeguard to a written control, an owner and a piece of evidence, and remove any promise you cannot evidence.

Agents not bound to security measures

The plan sponsor often uses outside administrators, benefits platforms, payroll processors and consultants who receive ePHI. Under 164.314(b)(2), the sponsor must ensure those agents agree to implement security measures. Gaps appear when agent contracts were signed before the amendment or never mention safeguards. Inventory every agent that receives plan ePHI, check each contract for a security clause, and add an amendment or addendum where the clause is missing.

Separation rules not enforced in HR systems

The plan document must require adequate separation between the plan and the sponsor's employment functions, and the security measures must support that separation. The gap is usually technical: claims data sits in shared mailboxes, HR spreadsheets or a general HRIS where managers can see it. Review who can access plan ePHI in HR, payroll and email, and restrict access by role and system. Keep a record of the access list and its review dates.

No defined incident path to the plan

The amendment requires the sponsor to report security incidents to the plan, yet many sponsors have no written route from a security event to the plan administrator. The report can be lost between HR, IT and legal, or delayed while teams decide whether an event counts. Define what counts as a security incident for plan ePHI, who reports it, how fast, and to which plan contact. Test the path with a tabletop exercise and keep the results.

Sponsor training and records not connected

Plan amendments describe what the sponsor will do, but staff who handle plan ePHI often never receive instruction on those duties. When an access request or incident arrives, the people involved may not know the amendment applies to them. Identify the staff who touch plan ePHI, train them on the amended duties, and retain attendance records alongside the amendment. Ask your auditor which records they would expect to see for this standard.

Questions buyers ask about 164.314(b)

Can we draft the group health plan amendments ourselves?

Yes, the plan can be drafted in-house, but the amendment must contain the four required provisions and it must match how the sponsor actually handles ePHI. Section 164.314(b)(2) requires the plan documents to provide that the sponsor implements administrative, physical and technical safeguards, supports the adequate separation required by 164.504(f)(2)(iii) with security measures, ensures its agents agree to those measures, and reports security incidents to the plan. Generic template language often omits the step that matters most: confirming that the sponsor's systems, staff and vendors really do what the amendment promises. Your legal counsel should review the wording, and your security team should verify each promise against current controls before the amendment is signed. Self-drafting works best when the sponsor has a small, well-documented benefits function. It is harder when ePHI flows through several HR, payroll and IT systems.

How long does implementing 164.314(b) take, and what drives the timeline?

No researched timeline applies to this requirement, so confirm durations with your own environment and any written scope before committing. The main drivers are the number of systems that receive ePHI from the plan, whether the sponsor already has documented safeguards, how many agents or vendors must sign security terms, and how many plan documents need amendment. Each of these adds review cycles. Sponsors with existing written policies usually move faster than those building safeguards from scratch. Ask any implementation partner for a written scope that lists the systems, vendors and documents in play, because timeline estimates without that list are not reliable.

What must the plan sponsor provide to the group health plan?

The sponsor must accept the amended plan document terms and then operate under them. In practice, that means providing a written description of the safeguards it applies to plan ePHI, confirming which employees may access plan information, and documenting how that access is separated from employment-related decisions. It also means naming the agents and vendors who touch ePHI and getting their agreement to the same security measures, and setting a route for reporting security incidents to the plan. Expect the plan to ask for evidence, such as access lists, policy documents and incident procedures. Gather these before the amendment is finalized, since the plan cannot rely on promises the sponsor cannot show.

Can a consultant attest that our group health plan meets 164.314(b)?

No. A consultant can prepare documents, test controls and gather evidence, but only an independent assessor or auditor issues reports or opinions on compliance. HHS states that no Security Rule standard requires certification, and that HHS does not recognize private certifications, which do not prevent later enforcement findings. The organization owns its controls and its amendment. A good consultant will show you the evidence behind each provision and tell you what remains your responsibility. Be cautious of any firm that promises a HIPAA certificate for this requirement, since none exists.

Which parts of 164.314(b) are worth outsourcing?

Outsource the work that needs specialist hands and leave decisions that define accountability in-house. Good candidates include technical safeguard reviews, access configuration checks, logging and incident reporting workflows, and preparing evidence packages. Keep ownership of the sponsor's own policy decisions, the choice of which employees may see plan ePHI, and the final signature on the amendment. Name an internal owner for each provision so that the sponsor can answer questions from the plan without waiting on an outside party. Ask any provider to split its proposal by provision, so you can see exactly what you are paying for.

How does 164.314(b) relate to a business associate contract under 164.314(a)?

They apply to different relationships and do not replace each other. Section 164.314(a) governs the contract between a covered entity or business associate and its business associates or subcontractors. Section 164.314(b) governs the plan document between a group health plan and its sponsor, which is an internal arrangement rather than a vendor contract. A sponsor that hires an outside administrator to handle plan ePHI will usually need a business associate contract with that administrator under 164.314(a), in addition to the plan amendment. Check each arrangement separately, and confirm with counsel which document covers which party.

What does NIST SP 800-66 Rev. 2 add for this requirement?

NIST SP 800-66 Rev. 2, published in February 2024, lists four key activities for this standard, each matching one of the four required provisions. It is an informational resource guide, not a binding rule, and HHS lists it as such. Its value is practical: it gives descriptions and sample questions that help the sponsor check whether its safeguards match each provision. Use it as a worksheet to find gaps before counsel finalizes the amendment, and record which questions you answered and what evidence supports each answer.

How DeployOpen prepares sponsor controls and evidence for 164.314(b)

DeployOpen works on 164.314(b) by preparing the systems, controls and evidence a group health plan sponsor needs to show it safeguards ePHI received for plan administration. The plan and its sponsor own the plan document amendments and the controls behind them, while DeployOpen plans, implements and documents the technical and operational work inside the client's own environment.

How we scope

Scope starts with a written agreement covering which plan sponsor systems receive ePHI for plan administration.
We confirm with counsel which plan document provisions the sponsor must adopt, and which are outside our scope.
Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any work begins.

How we build

We implement administrative, physical and technical safeguards on the sponsor systems named in the written scope.
We configure separation between plan administration data and employment functions using access controls and logging.
We put agent and vendor agreements that commit to security measures into the implementation checklist for review.

How we hand over

We deliver a written record mapping each required plan document provision to the control and the system that supports it.
Evidence packages include configuration records, access reviews, and security incident reporting procedures to the plan.
Independent assessors or counsel review the materials, since DeployOpen does not issue audit reports or attestations.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can cover updates to safeguards when the sponsor changes systems or service providers.
Ask any provider to confirm in writing who owns each control and which evidence the sponsor must keep.