Self-insured group health plans are HIPAA “covered entities” and—unlike most fully insured arrangements—typically must maintain and distribute ...