While CFOs await news on immigration reform (and the HR and employment implications of those potential changes) coming out of Washington, let’s take a look at some of the legal and regulatory changes that are already underway.

Delayed notice of exchanges. Under health care reform, more formally known as the Patient Protection and Affordable Care Act (PPACA), employers were expected to provide new and existing employees with notice explaining the state health care exchanges by March 1. Now, however, this notice requirement has been postponed and is not likely to take effect until the late summer or autumn, according to a list of Frequently Asked Questions issued by the U.S. Department of Labor.

When the notice does go into effect, employers will have to (1) let employees know about the existence of the exchanges, what they do and how to contact the exchanges; (2) explain that employees could be eligible for a premium tax credit if employer-provided health plans cover less than 60% of health costs; and (3) notify employees that they could lose their employer-provided contribution to their health coverage if they choose to purchase coverage through a state insurance exchange.

Health information privacy. Protecting health information privacy and security is only becoming more important. The final rules governing breaches of “protected health information” (PHI) under the Heath Insurance Portability and Accountability Act (HIPAA) have lowered the bar on situations where vendors and health plans must report a breach of PHI under the law. Rather than requiring a “risk of harm” standard for reporting a breach, the final rules make the presumption that any impermissible use or disclosure should be considered a breach of privacy and should be reported to the appropriate parties. The net result of this lower standard for reporting breaches is that employers are likely to be notified more often of breaches. Therefore, employers should be prepared to ask questions about the risks and severity of those breaches.

Health reimbursement arrangements. Employers that provide standalone health reimbursement arrangements (HRAs) could find themselves running afoul of the PPACA. HRAs allow employers to deposit a certain amount of money into each employee’s account that the employee can then use to pay for health care expenses. Unlike their cousin, health savings accounts (HSAs), HRAs do not allow employees to keep the money in the account when they leave the company. That money goes back to the employer.

Under health care reform, HRAs are only permissible if they are integrated into health care plans. A standalone HRA—for example, one that an employer might use to provide funds for employees to purchase health coverage on a state health insurance exchange—would violate the PPACA’s prohibition against limits on health coverage. If the HRA is integrated into a group health plan that does not limit coverage (i.e., the employee is eligible for both group health coverage and the HRA together but neither separately), the employer can continue to offer the HRA.