A contributing employer to a multiemployer welfare fund has received a request from CMS to provide information about its employees for purposes of the CMS data match program. The employer is required by law to provide the requested information. The employer does not have the information, which resides with the multiemployer fund.
Under HIPAA, does anyone have any thoughts on whether the fund can provide the information (mostly health plan enrollment information) to the contributing employer without authorization under HIPAA's privacy rules?
In the non-multiemployer plan context, the employer can provide the information to CMS under the "required by law" exception (EDIT: the employer is not a covered entity so it need not rely on a HIPAA exception) and the employer, as plan sponsor, can obtain the enrollment information from its group health plan. But a contributing employer is not the plan sponsor of the multiemployer plan so this rationale does not seem applicable.
Thanks!