Allison Reuter

Bri is correct. Here are the relevant citations: Code §410(b)(3)(C); Treas. Reg. §1.410(b)-6(c).

I agree with all of the above. Although the letter contains PHI, it would likely be a permitted disclosure. (It sounds like it could've been an EOB, as I'm unsure why an insurance company would "confirm" a visit that already took place.) The key question is whether the document the spouse "has on file" with the insurance provider is a request for confidential communications, as JWK points out, and whether the insurance company granted the request. In any event, this is an issue for the insurance company (assuming this is a fully insured plan), not you. You should tell the spouse to contact the insurance company as well as HHS since he would not have a private cause of action. HHS would then investigate further on the spouse's behalf.