Everyone Talks About Title II. Title I Is the Reason HIPAA Exists.

In 1996, a woman named Nancy Daschle — wife of then-Senator Tom Daschle — couldn't get health insurance because of a pre-existing condition. That story, and millions like it, drove Congress to pass the Health Insurance Portability and Accountability Act. The keyword here is portability. Title I HIPAA is the section that guarantees Americans won't lose their health insurance simply because they switch jobs or get laid off.

Most people in healthcare compliance spend their entire careers focused on Title II — the privacy and security rules, the breach notifications, the OCR enforcement actions. That makes sense. Title II is where the teeth are. But if you don't understand Title I HIPAA, you're missing the foundation the entire law was built on.

This post breaks down what Title I actually does, who it affects, and why your organization needs to understand it — even if your day-to-day work revolves around PHI protections and ePHI safeguards.

What Does Title I HIPAA Actually Do?

Title I HIPAA limits the ability of group health plans and health insurance issuers to deny coverage based on pre-existing conditions. It also prohibits discrimination against employees and their dependents based on health status. And it guarantees that workers who lose or change jobs can maintain continuous health coverage.

Here's the short version: Title I is the portability promise. It says your health insurance follows you, not your employer.

The Three Core Protections

  • Pre-existing condition limitations: Group health plans cannot impose exclusion periods longer than 12 months (18 months for late enrollees) for pre-existing conditions. Creditable prior coverage reduces that window day for day.
  • Discrimination prohibition: Insurers and group plans cannot charge higher premiums or deny enrollment to individuals based on health status, medical history, genetic information, or disability.
  • Special enrollment rights: Employees who experience qualifying life events — marriage, birth of a child, loss of other coverage — get guaranteed access to enroll in their employer's group health plan outside of open enrollment.

The Affordable Care Act later expanded many of these protections, particularly around pre-existing conditions in the individual market. But Title I remains the statutory backbone for employer-sponsored group health plans.

Title I vs. Title II: Where Compliance Officers Get Confused

I've seen compliance officers at mid-size clinics conflate the two titles constantly. They assume "HIPAA" means "protect patient data." It does — but that's Title II. Title I is about insurance access and portability. Different rules, different enforcement mechanisms, different consequences.

Title II created the Privacy Rule, the Security Rule, and the Breach Notification Rule. It's enforced by the Office for Civil Rights (OCR) at HHS. When you read about a hospital paying $2.3 million because unencrypted laptops went missing, that's Title II enforcement.

Title I, on the other hand, is enforced primarily by the Department of Labor (for employer-sponsored plans), the Centers for Medicare & Medicaid Services (CMS), and state insurance departments. The penalties look different. The audiences overlap but aren't identical.

Why Your HR Team Needs to Understand Title I

If your organization offers group health insurance — and most covered entities do — Title I applies to you as a plan sponsor. Your HR department handles enrollment, COBRA administration, and creditable coverage certificates. They need to know the rules.

I've consulted with healthcare organizations where the compliance team owned Title II training and the HR team had zero structured education on Title I. That gap creates real risk. A wrongly denied enrollment during a special enrollment period can trigger complaints to the Department of Labor and state regulators.

Creditable Coverage: The Mechanism That Makes Portability Work

Title I HIPAA introduced the concept of "creditable coverage." When an employee moves from one group health plan to another, the prior plan must issue a certificate documenting the length of continuous coverage. The new plan then credits that time against any pre-existing condition exclusion period.

For example: if someone had 10 months of continuous coverage under their previous employer's plan and their new employer's plan has a 12-month pre-existing condition exclusion, the employee only faces a 2-month gap. This mechanism was revolutionary in 1996. It kept people from being locked into jobs just to maintain insurance.

The CMS portability guidance page provides additional background on how these protections interact with current marketplace rules.

Does Title I HIPAA Still Matter After the ACA?

This is the question I get asked most often. The Affordable Care Act eliminated pre-existing condition exclusions in the individual and small group markets entirely. So doesn't that make Title I obsolete?

No. Here's why.

Title I still governs the rules for large employer group health plans, which cover the majority of insured Americans. The ACA reinforced and expanded Title I's protections, but it didn't replace them. If the ACA's pre-existing condition provisions were ever weakened or repealed, Title I's framework would become the primary safeguard again.

Additionally, Title I's special enrollment rights and nondiscrimination provisions remain actively enforced. The Department of Labor's EBSA page on HIPAA still lists these requirements as current compliance obligations for plan sponsors.

The Training Gap Most Organizations Don't Know They Have

Here's what I see in practice: organizations train their workforce on the Privacy Rule and Security Rule — the Title II requirements — and call it a day. PHI handling, minimum necessary standard, breach notification procedures. All essential. All Title II.

But nobody trains HR staff on Title I obligations. Nobody reviews whether creditable coverage certificates are being issued correctly. Nobody audits special enrollment procedures for compliance.

If you're building a compliance program from scratch — or refreshing one in 2026 — start with a comprehensive foundation. Our HIPAA Introduction Training 2026 covers the full scope of the law, including Title I's portability provisions and how they interact with Title II's privacy and security requirements.

For clinical staff who need targeted training on PHI handling in care settings, our HIPAA Training for Nurses provides workflow-specific education that connects regulatory requirements to daily practice.

Real-World Consequences of Ignoring Title I

Title I violations don't generate the same headlines as Title II breaches. You won't see a press release from OCR about a $4.3 million settlement over a botched enrollment form. But the consequences are real.

An employee denied special enrollment rights can file a complaint with the Department of Labor. An ERISA lawsuit can follow. State attorneys general can investigate discriminatory plan practices. And in the aggregate, these actions cost organizations real money — plus the reputational damage that comes with an employee publicly fighting for insurance coverage they were legally entitled to.

A Compliance Checklist for Title I

  • Verify your group health plan documents reflect current HIPAA portability requirements.
  • Confirm your HR team issues certificates of creditable coverage when employees leave the plan.
  • Audit special enrollment procedures to ensure qualifying events trigger timely enrollment opportunities.
  • Review plan language for any health-status-based discrimination in premiums or eligibility.
  • Include Title I education in your annual compliance training — not just Title II.

Title I HIPAA Deserves a Seat at the Compliance Table

Your organization probably has a detailed incident response plan for data breaches. You probably train staff on PHI disclosures and ePHI security controls every year. That's good — HHS requires it.

But Title I HIPAA isn't optional background reading. It's active law with active enforcement. It affects every covered entity that sponsors a group health plan. And it protects the people who work for you.

If you haven't reviewed your Title I compliance posture recently, now is the time. Browse our full HIPAA training catalog to find courses that cover the complete regulatory landscape — not just the parts that make the news.

The law is called the Health Insurance Portability and Accountability Act. Portability comes first for a reason.