Larger corporations may offer “self-insured” health care plans where the employer itself assumes the risk of health care costs and has the responsibility for paying heath care claims, effectively acting as an insurer. Claims may be processed by company personnel or contracted out to other companies that process and maintain the records. HIPAA rules apply to medical records used in this situation, including how information is shared and the requirement for written consent to share information in most situations.