What Is a TPA in Insurance? ERISA, HIPAA, and Denied Claims

A TPA in insurance, short for third-party administrator, is an outside company hired by an insurer or a self-funded employer to handle the day-to-day work of a plan: verifying coverage, processing claims, coordinating with providers, and paying out benefits. The key point is what a TPA does not do. It never pays claims from its own money. The financial risk stays with the insurer or employer that hired it; the TPA just runs the machinery.¹ Roughly 63 percent of workers with employer-sponsored health coverage are now in self-funded plans, so millions of people deal with a TPA without knowing that’s what they’re doing.

Where You’ll Run Into a TPA

TPAs show up most often behind self-funded employer health plans. In a self-funded arrangement, the employer sets aside its own money to pay employee medical claims instead of buying an insurance policy. Since most employers don’t have the staff to review medical claims, negotiate provider rates, or handle appeals, they hire a TPA to do it.¹ If your health card carries the logo of a big insurance company but your employer is self-funded, that insurer is likely acting as a TPA rather than as your actual insurer.

TPAs also work for traditional insurers that outsource administrative work. A workers’ compensation carrier might use a TPA to coordinate medical evaluations and track return-to-work timelines. A liability insurer might use one to run investigations. The insurer keeps the risk; the TPA handles the file.

You may also see the term ASO, or Administrative Services Only. That’s a specific kind of contract in which a large insurance carrier provides administrative services to a self-funded employer without insuring the plan. ASOs tend to bundle standardized services tied to the carrier’s network, while independent TPAs can mix vendors and pharmacy managers to build something more customized. For you as a plan member, both function the same way on the front end.

What a TPA Actually Handles

The TPA’s contract with its client spells out which tasks it takes on. In most arrangements those include:

Eligibility verification: confirming you’re covered and that the service falls within the plan.
Claims adjudication: reviewing submitted claims, comparing them to plan language, and deciding whether to pay.
Provider coordination: negotiating reimbursement rates and managing pre-authorization for certain procedures.
Payment processing: paying providers or reimbursing members from funds the employer or insurer has set aside.
Member communications: sending explanations of benefits, answering questions, and running the appeals process when a claim is denied.

Some TPAs can approve or deny claims on their own within preset guidelines. Others must send high-dollar or complicated files back to the insurer for the final call. The line between the two is set by contract, and it matters when something goes wrong, because it decides who actually made the decision you’re fighting.

Reading What the TPA Sends You

Claim adjudication is the TPA’s core function, and it’s the piece that affects you most directly. When you see a doctor, the provider submits a claim to the TPA. The TPA checks your eligibility, whether the service is covered, and how your deductible, copay, and coinsurance apply. For health claims it also evaluates medical necessity. In workers’ comp it decides whether the injury is work-related and what benefits are owed.

After the claim is processed, the TPA sends you an explanation of benefits. An EOB is not a bill. It shows what the provider billed, what the plan paid, and what you owe. Read it. Adjudication errors show up here first: a deductible applied wrong, a procedure miscoded, a covered service denied. If something looks off, the EOB is the paper trail you’ll need for an appeal.

Your Rights When a TPA Denies a Claim

This is where most people’s frustration with TPAs starts, and the rules that apply depend on the type of plan you’re in.

Self-Funded Employer Plans

If your coverage comes through a self-funded employer plan, federal law under ERISA controls your appeal rights. You have at least 180 days after the denial notice to file an internal appeal.² During that appeal you can submit medical records, letters from your doctor, and written arguments. The plan has to give you free access to all documents and information relevant to your claim.

The person reviewing your appeal cannot be the same person who denied your claim originally, and cannot report to that person. If the denial rested on a medical judgment, the reviewer has to consult a qualified health care professional who wasn’t involved in the first decision.² For urgent care, an expedited process is required.

If the internal appeal fails, the Affordable Care Act added external review for non-grandfathered self-funded plans. The plan has to contract with at least three independent review organizations and rotate assignments among them. External review, though, is generally limited to denials based on medical necessity or clinical judgment. If your claim was denied for another reason, external review may not be available, and your remaining option is a lawsuit in federal court under ERISA’s civil enforcement provisions.³

Fully Insured Plans

If your employer buys a policy from an insurance company instead of self-funding, state insurance law applies. Most states have their own appeal and external review processes, and those often go further than ERISA’s federal floor. Deadlines and procedures vary, so check with your state’s insurance department to see what’s available in your state.

Why the Type of Plan Matters So Much

Self-funded plans are largely exempt from state insurance regulation. ERISA preempts state laws that “relate to” employee benefit plans, and the Supreme Court has held that states cannot treat self-funded plans as insurance for regulatory purposes. In practice, state consumer protection laws, state-mandated benefits, and state external review procedures usually don’t apply if your plan is self-funded. Your remedies are what ERISA provides: the right to sue in federal court to recover denied benefits, without the punitive damages or bad-faith claims some states allow.³ Most people don’t discover this gap until they’re already fighting a denial.

One useful thing to know when you sue: federal courts have jurisdiction over ERISA benefit claims regardless of the dollar amount in dispute, and the court has discretion to award attorney’s fees to the prevailing party.³

Who Watches the TPA

TPAs are not unregulated. A few layers of oversight sit behind the scenes even when you don’t see them.

State Licensing

Every state requires TPAs to hold a license, though the specifics vary. The National Association of Insurance Commissioners publishes a model act that most states have adopted in some form. Applicants have to show financial stability, disclose owners and directors, and post a surety bond. Under the NAIC model, the bond is at least $100,000 or 10 percent of the self-funded plan assets the TPA handles, whichever is greater.⁴ Actual amounts differ by state.

Licensed TPAs file annual reports with the state insurance department that include audited financials and information about the plans they administer.⁴ State regulators can audit TPAs, investigate consumer complaints, and revoke licenses. If a TPA has mishandled your claim, filing a complaint with your state insurance department is often the fastest path to attention, at least for fully insured coverage.

Separate Handling of Plan Money

Under the NAIC model, premiums, insurance charges, and claim funds a TPA collects must be held in a fiduciary capacity, deposited promptly at a federally insured institution, and kept separate from the TPA’s own operating funds.⁴ A TPA can’t pay claims out of the same account premiums flow into. This segregation protects plan participants if the TPA runs into financial trouble.

Fiduciary Duties Under ERISA

When a TPA administers a self-funded employer health plan, ERISA’s fiduciary rules can attach. Whether it counts as a fiduciary turns on what it actually does, not what the contract calls it. A TPA doing purely routine work, like data entry or applying clear-cut plan formulas, is not a fiduciary. Once it starts exercising discretion over who qualifies for benefits, it becomes a fiduciary to that extent.⁵ A fiduciary that breaches its duties has to make the plan whole for losses caused by the breach, and the Department of Labor can pursue civil penalties on top.⁶

HIPAA and Your Health Data

A TPA that handles health information is a “business associate” under HIPAA and is directly subject to federal privacy and security rules. Before it can touch protected health information, the plan or insurer has to sign a Business Associate Agreement setting out what the TPA can do with the data, requiring administrative, physical, and technical safeguards, and requiring the TPA to report unauthorized uses and data breaches.⁷ Any subcontractors that see health data have to agree to the same restrictions. If the TPA materially breaches the agreement and the plan can’t fix it, the plan must terminate the contract, and if that isn’t feasible, report the violation to HHS.⁸

Breaches affecting 500 or more people have to be reported within 60 days to HHS, to every affected person, and to the media. Smaller breaches are reported to HHS by the end of the calendar year and to affected individuals within 60 days. If you get a breach notice from a TPA, that’s the rule it’s operating under.

What This Means for You

If a TPA is handling your coverage, two things are worth remembering. First, find out whether your plan is self-funded or fully insured, because that single fact controls what appeal rights, external review options, and legal remedies you actually have. Your HR department can tell you, and your summary plan description will say so. Second, when a claim is denied, the internal appeal deadline is the one that matters most: for ERISA plans, 180 days from the denial notice. Miss it and your options narrow sharply. The TPA on the other end of the phone processes the paperwork; the rules that decide who wins the fight sit above them.

1
Center on Health Insurance Reforms. Questionable Conduct: Allegations Against Insurers Acting as Third-Party Administrators
2
eCFR. 29 CFR 2560.503-1 Claims Procedure
3
Office of the Law Revision Counsel. 29 U.S. Code 1132 – Civil Enforcement
4
NAIC. Registration and Regulation of Third Party Administrators
5
U.S. Department of Labor. Understanding Your Fiduciary Responsibilities Under a Group Health Plan
6
U.S. Department of Labor. Enforcement Manual – Civil Penalties
7
eCFR. 45 CFR 164.504 – Uses and Disclosures
8
HHS.gov. Business Associates