Hipaa Privacy - Claims Advocacy

[DTH]

I work as a health care claims advocate for plan sponsors that have fully insured group health plans. I have two scenarios I would like some feedback on:

1. Patients call the plan sponsor directly to resolve claims issues. The plan sponsor forwards the claims issues to me to work directly with the insurance company. The plan sponsor will need to either:

(a) obtain authorization from the patient to use and disclose their PHI (that flows through to me), or

(b) the plan sponsor needs to amend the plan and certify to the plan administrator that the plan document has been amended and the plan sponsor agrees to comply with the amendment.

If the plan sponsor amends the plan document, no business associate contract is needed since I do not work for the covered entity. Since the plan sponsor must agree to comply with HIPAA privacy through the plan amendment, I would think that the plan sponsor would want some sort of agreement with me where I will also comply (e.g., through the service agreement).

2. I work for the plan sponsor and patients call me directly to advocate their claims with the insurance company. I work directly with the insurance company to get the claims issues resolved. If the insurance company denies the claim, I then go to the plan sponsor for resolution.

I assume when the patient calls me directly, there is no PHI so no authorization is needed. If I need to go to the plan sponsor and I only provide them with summary information, I do not need patient authorization. If I need to provide the plan sponsor with PHI, either I need to get patient authorization or the plan sponsor needs to amend the plan and certify to the plan administrator that the plan document has been amended and the plan sponsor agrees to comply with the amendment.

Do you agree with my assessment? Any feedback will be most helpful. Thanks!