Jump to content

Can a TPA disclose enrollment or disenrollment information about adult child to subscriber (parent)?


Recommended Posts

I work for a TPA (covered entity), and our legal office has a disagreement over whether we can disclose to the plan subscriber if an adult child is or is not enrolled on the subscriber's (the parent's) plan. I say that their enrollment information is PHI and we need approval from the adult child. Another attorney says it isn't PHI, and we can tell the parent who is enrolled on his/her plan. Please weigh in.

Link to comment
Share on other sites

@Cate I'm assuming you're a business associate for an employer plan sponsor of a covered entity (i.e., a self-insured group health plan).  

The point of confusion here probably stems from the fact the enrollment/disenrollment information (that does not include any substantial clinical information) is not PHI if it is maintained by the employer.  That information is considered an employment record held by the plan sponsor (not a covered entity) rather than PHI held by the plan (covered entity).

In this case, you are not the employer.  You are the TPA acting as a business associate to the employer's covered entity health plan.  Therefore, I agree with you that the enrollment information is PHI and cannot be disclosed absent an authorization from the adult child.

Note that there are exceptions where a CE/BA can disclose PHI to a family member.  The details depend on the capacity of the individual.  Overview here: https://www.theabdteam.com/blog/disclosing-phi-to-family-members-under-hipaa/

 

Relevant cites below--

 

45 CFR §160.103:

(2) Protected health information excludes individually identifiable health information:

(i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g;

(ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv);

(iii) In employment records held by a covered entity in its role as employer; and

(iv) Regarding a person who has been deceased for more than 50 years.

 

67 Fed. Reg. 53181, 53208 (Aug. 14, 2002):

While the standard enrollment and disenrollment transaction does not include any substantial clinical information, the information provided as part of the transaction may indicate whether or not tobacco use, substance abuse, or short, long-term, permanent, or total disability is relevant, when such information is available. However, the Department clarifies that, in disclosing or maintaining information about an individual’s enrollment in, or disenrollment from, a health insurer or HMO offered by the group health plan, the group health plan may not include medical information about the individual above and beyond that which is required or situationally required by the standard transaction and still qualify for the exceptions for enrollment and disenrollment information allowed under the Rule.

 

65 Fed. Reg. 82461, 82496 (Dec. 28, 2000):

The preamble to the Transactions Rule noted that plan sponsors of group health plans are not covered entities and, therefore, are not required to use the standards established in that regulation to perform electronic transactions, including enrollment and disenrollment transactions. We do not change that policy through this rule. Plan sponsors that perform enrollment functions are doing so on behalf of the participants and beneficiaries of the group health plan and not on behalf of the group health plan itself. For purposes of this rule, plan sponsors are not subject to the requirements of § 164.504 regarding group health plans when conducting enrollment activities.

Link to comment
Share on other sites

3 hours ago, Cate said:

I work for a TPA (covered entity), and our legal office has a disagreement over whether we can disclose to the plan subscriber if an adult child is or is not enrolled on the subscriber's (the parent's) plan. I say that their enrollment information is PHI and we need approval from the adult child. Another attorney says it isn't PHI, and we can tell the parent who is enrolled on his/her plan. Please weigh in.

Cate, I may be a little confused so I apologize ahead of time.  Is this a situation where a parent/subscriber has dependent coverage (an adult child) and the subscriber does not know if the dependent is on their plan?  If so, how can the parent/subscriber not know who is on their plan?  Thanks.

Link to comment
Share on other sites

39 minutes ago, leevena said:

Cate, I may be a little confused so I apologize ahead of time.  Is this a situation where a parent/subscriber has dependent coverage (an adult child) and the subscriber does not know if the dependent is on their plan?  If so, how can the parent/subscriber not know who is on their plan?  Thanks.

@leevena good question.  I was assuming this was a COBRA situation for an aged out child.  Can't think of any other situation where that would be in question.

Link to comment
Share on other sites

  • 2 months later...
On 11/13/2020 at 2:08 PM, leevena said:

Cate, I may be a little confused so I apologize ahead of time.  Is this a situation where a parent/subscriber has dependent coverage (an adult child) and the subscriber does not know if the dependent is on their plan?  If so, how can the parent/subscriber not know who is on their plan?  Thanks.

I'm sorry, I didn't get a notification that anyone had commented, I appreciate you taking the time. Yes, this is a situation where a parent/subscriber has dependent coverage on an adult child, and called into us (TPA) to ascertain if the child was still on the plan. I'm not sure why the parent called in. And I agree it is strange that a subscriber doesn't know who is on their plan. Perhaps they were attempting to verify it, I don't know. 

Link to comment
Share on other sites

On 11/13/2020 at 1:43 PM, Brian Gilmore said:

@Cate I'm assuming you're a business associate for an employer plan sponsor of a covered entity (i.e., a self-insured group health plan).  

The point of confusion here probably stems from the fact the enrollment/disenrollment information (that does not include any substantial clinical information) is not PHI if it is maintained by the employer.  That information is considered an employment record held by the plan sponsor (not a covered entity) rather than PHI held by the plan (covered entity).

In this case, you are not the employer.  You are the TPA acting as a business associate to the employer's covered entity health plan.  Therefore, I agree with you that the enrollment information is PHI and cannot be disclosed absent an authorization from the adult child.

Note that there are exceptions where a CE/BA can disclose PHI to a family member.  The details depend on the capacity of the individual.  Overview here: https://www.theabdteam.com/blog/disclosing-phi-to-family-members-under-hipaa/

 

Relevant cites below--

 

45 CFR §160.103:

(2) Protected health information excludes individually identifiable health information:

(i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g;

(ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv);

(iii) In employment records held by a covered entity in its role as employer; and

(iv) Regarding a person who has been deceased for more than 50 years.

 

67 Fed. Reg. 53181, 53208 (Aug. 14, 2002):

While the standard enrollment and disenrollment transaction does not include any substantial clinical information, the information provided as part of the transaction may indicate whether or not tobacco use, substance abuse, or short, long-term, permanent, or total disability is relevant, when such information is available. However, the Department clarifies that, in disclosing or maintaining information about an individual’s enrollment in, or disenrollment from, a health insurer or HMO offered by the group health plan, the group health plan may not include medical information about the individual above and beyond that which is required or situationally required by the standard transaction and still qualify for the exceptions for enrollment and disenrollment information allowed under the Rule.

 

65 Fed. Reg. 82461, 82496 (Dec. 28, 2000):

The preamble to the Transactions Rule noted that plan sponsors of group health plans are not covered entities and, therefore, are not required to use the standards established in that regulation to perform electronic transactions, including enrollment and disenrollment transactions. We do not change that policy through this rule. Plan sponsors that perform enrollment functions are doing so on behalf of the participants and beneficiaries of the group health plan and not on behalf of the group health plan itself. For purposes of this rule, plan sponsors are not subject to the requirements of § 164.504 regarding group health plans when conducting enrollment activities.

Thank you, Brian, I appreciate very much your response!

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

×
×
  • Create New...