Subscribe (Free) to
Daily or Weekly Newsletters
Post a Job

Featured Jobs

Regional VP of Sales

The Retirement Plan Company
(Remote / AZ / CA / CO / MN / MO / OR / WA)

The Retirement Plan Company logo

DB/DC Administrator

Primark Benefits
(Remote / San Mateo CA)

Primark Benefits logo

Retirement Plan Administrator

Nicholas Pension Consultants

Nicholas Pension Consultants logo

Client Relationship Manager

Wespath Benefits and Investments
(Remote / Glenview IL)

Wespath Benefits and Investments logo

Senior Consultant

(Remote / Putnam Valley NY)

Pentegra logo

Director of Member Services, Member/ Employer Experience

Orange County Employees Retirement System
(Santa Ana CA)

Orange County Employees Retirement System logo

Sr. Retirement Plan Administrator

Tycor Benefit Administrators, Inc.

Tycor Benefit Administrators, Inc. logo

401(k) Plan Administrator

Abacus Retirement Solutions, LLC
(Remote / Albuquerque NM)

Abacus Retirement Solutions, LLC logo

Retirement Plan Administrator

Carpenter Morse Group Inc.

Carpenter Morse Group Inc. logo

View More Employee Benefits Jobs

Free Newsletters

“BenefitsLink continues to be the most valuable resource we have at the firm.”

-- An attorney subscriber

Mobile App image LinkedIn icon
Twitter icon
Facebook icon

Guest Article

(From the Employer's Guide to HIPAA Privacy Requirements, Thompson Publishing Group)

Health Plan Representatives Call for Further Changes to Privacy Proposal

Summary: General support for the proposed changes to HIPAA's privacy rules was expressed by health plan representatives, in written comments submitted to HHS. However, they called for further amendments to many provisions of the rules, including those governing business associate contracts and marketing. Other commenters were critical of HHS' proposal, arguing that it would weaken privacy protections.

General support for the recently proposed changes to HIPAA's privacy rules was expressed by health plan representatives, in written comments submitted to the U.S. Department of Health and Human Services (HHS). However, they called for further amendments to many provisions of the rules, including those governing business associate contracts, marketing and the disclosure of protected health information (PHI) for the health care operations of another entity.

Other commenters were critical of HHS' proposal, arguing that it would weaken privacy protections. A federal advisory committee urged HHS to narrow the proposed exceptions from the definition of "marketing," and a consumer group criticized many elements of the proposal, including the provisions governing marketing and PHI disclosure between covered entities. The comment period closed April 26.

Business Associates

Health plan representatives were supportive of HHS' one-year extension for revising certain contracts with business associates, but urged the agency to go further. Health plans may find it difficult to take advantage of the extension as currently proposed, because it only applies to contracts in effect before the rule changes are finalized, according to the American Association of Health Plans (AAHP).

If HHS issues the final rule in August as expected, "covered entities must rush to make sure that contracts are in place with potential business associates fairly quickly in order to take advantage of the transition period," AAHP states. Therefore, the group recommends that HHS instead set the cutoff date at April 14, 2003 -- the general compliance deadline for HIPAA's privacy rules.

The proposed requirement that the privacy provisions be included in a business associate contract when it is modified, notwithstanding the extension, also would impose administrative burdens, according to AAHP. "Even minor changes to the business relationship between a covered entity and a business associate, such as a new purchase order sent to a vendor, may be considered a modification and could trigger the requirement to update the contract to include the privacy rule's business associate provisions," the group contends.

AAHP and the Health Insurance Association of America (HIAA) also argue that the relief afforded by the extension would be undermined if health plans still had to ensure, as of April 2003, that their business associates were making PHI available to HHS and individuals as the rules require.

"The proposed modification ... places covered entities in the untenable position of being required to ensure that their business associates guarantee the availability of information ... during the contract extension period, without having an amended contract through which to enforce this guarantee," HIAA explains. The rule should be amended to require simply that a covered entity "attempt in good faith to obtain the business associate's cooperation" in meeting the PHI availability requirements, the group recommends.

One way to solve both of the foregoing problems, according to AAHP, would be to extend the compliance deadline for all business associate requirements until April 14, 2004. "This extension of the compliance date will give covered entities sufficient time to identify all the full extent of their business associates and to enter into the necessary business associate agreements," AAHP states.

Health plan representatives also expressed concern about a provision in HHS' model business associate contract that requires the business associate to make available to the covered entity its internal practices, books and records relating to PHI use and disclosure. "We are concerned that including this language in a business associate contract could impute knowledge and duties to the covered entity that are not required by the rule," HIAA states. "If covered entities were to adopt the language of the proposed model contract provisions, their potential liability for wrongful disclosures of PHI by their business associates could dramatically increase," AAHP adds.


Health plan representatives asked HHS to clarify its exclusions from the definition of "marketing" so that certain communications could continue to be made without requiring specific individual authorization. "We urge the Department to clarify that the exclusions to the definition of 'marketing' permit communications describing covered services, payment for services, and additional insurance options or enhancements, without requiring authorization," HIAA states. "Providing such information to policyholders is especially important given that individual and marketwide needs, as well as benefit offerings, change considerably over time."

AAHP suggested that the rule "be modified to allow health plans to make certain kinds of general communications to their members through newsletters and membership mailings." Under HHS' proposed exclusion for disease management, which is limited to communications that apply directly to an individual, "a health plan would not be permitted to include any information in a general communication, such as a member newsletter or informational packets mailed to the plan's membership as a whole, if that information might be considered as encouraging the individual to purchase or use a product or service," according to AAHP. As a result, health plans would be effectively prevented from informing members about health-promoting activities not included in plan benefits, health-related products or other health insurance options, the group contends.

The National Committee on Vital and Health Statistics (NCVHS), a federal advisory body whose prior recommendations on marketing had influenced HHS' proposed changes, called on the agency to narrow the proposed exclusions from the definition of "marketing," particularly the exclusion of communications for "case management or care coordination for that individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to that individual." NCVHS recommends "the inclusion of additional language clearly limiting the applicability of this exception."

"Marketing" also should be defined to cover any communications about a product or service, even those that do not directly "encourage the recipient of the communication to purchase or use a product or service," NCVHS states. Currently, "communications encouraging the recipient to tell others about a product or service are not covered, nor are marketing communications couched as merely informational messages," the committee explains.

The Health Privacy Project (HPP), a consumer group, criticized HHS' proposed changes to the marketing provisions, arguing that the agency was essentially exempting all health-related promotions from the definition of "marketing," even those for which a covered entity is paid by a third party. "Many activities that health care consumers would consider marketing and find objectionable would be excluded from the definition of marketing under this proposal."

Reprinted with permission from the June 2002 newsletter of the Employer's Guide to HIPAA Privacy Requirements, © Thompson Publishing Group, Inc., 2002. All rights reserved.

BenefitsLink is an independent national employee benefits information provider, not formally affiliated with the firms and companies who kindly provide much of the content and advertisements published on this Web site, including the article shown above.
© 2022, Inc.