HIPPA & Hardship Withdrawals

[Guest CSTS]

We just had a participant email regarding a hardship request. They claim a medical hardship, but do not wish to provide the medical bills for privacy reasons. The participant claims that HIPPA affords her that right. Anyone ever dealt with this before? I'm not very familiar with HIPPA and this seems like it may have some validity.

For now, we suggested the care be covered/blacked out so that only the amounts remain on a document that is clearly a medical bill/invoice. This practice should offer the protection the participant wants while still providing meaningful documentation to the sponsor/Trustee.

Any thoughts?

[J Simmons]

The plan has a legitimate need for the information. The plan might be required to have HIPAA privacy and security policies in place, and notices given, but if the employee doesn't want to give up the info, no hardship payout.

As for the blackout, how would you know that the medical services provided were not for a facelift or other cosmetic surgery or procedure, and not be a proper basis for a hardship?

[Guest SEV]

People give HIPAA a lot more credit that it should get. HIPAA's privacy rules apply to covered entities, which include health care providers and group health plans but do not include 401k plans or employers. The plan should be provided the minimum amount of information necessary to determine that the hardship request qualifies and if the employee refuses to provide it, that is her decision.

[masteff]

Insurance "Explanation of Benefits" (EOBs) generally don't have excess detail about diagnoses but do fully substantiate how much of the expense was not reimbursed and is the responsibility of the employee.

My mind goes to two possible directions... the diagnosis is embarassing to the employee (mental health, drug treatment, infertility, etc) or the employee is trying to slide one over on you. As stated above, HIPPA is no excuse for the employee to not provide information to you. But it may require you to protect what you learn... which is exactly what you'd do anyway because as HR/Benefits professionals, we know to maintain the personal information of our employees in a safe and confidential manner. Which is what I'd emphasize to the employee.... "safe and confidential".

[Flyboyjohn]

This old thread seems to conclude that obtaining Protected Health Information when processing hardship withdrawal requests for medical expenses should not invoke HIPPA since the employer and TPA are not "covered entities".

Wondering if anybody feels differently? What if the employer/plan sponsor is a hospital or medical practice? 

 

[card]

One thing that's changed is that plans using the safe harbor hardship rules can now allow self-certification by employees that their hardship withdrawal meets the "immediate and heavy need" requirement. See https://www.irs.gov/pub/foia/ig/spder/tege-04-0217-0008.pdf

Plans using self-certification could, for example, instead of asking for actual medical bills ask for a summary of the medical expense. This would include "What was the purpose of the medical care (not the actual condition but the general category of expense, for example, diagnosis, treatment, prevention, associated transportation, long-term care)?"

This could provide a backdoor way for plans to avoid having to seek delicate medical information from employees. Note, though, that the employee would still need to maintain the actual bills and provide them to the employer upon request.