Fully Insured and HIPAA--again

[KJohnson]

ADP perfroms the "typical" COBRA services for an employer with a fully insured plan. Employer will receive no PHI from its insurer. ADP has sent a Business Associate Agreement to be signed.

1) What kind of PHI would ADP be handling in processing COBRA notices, forms and payments?

2) If this is a small plan, would there be any requirement to have this agreement in place before 2004 (if it is required in the first instance)?

[Sandra Pearce]

The health plan itself would be the Covered Entity effective either 4/14/2003 (large plan) or 4/14/2004 (small plan). ADP might be considered a Business Associate of the health plan when the regulations effect the specific health plan.

[KJohnson]

I thought to be a business associate you had to be receiving individually identifiable health information . I just didn't think that kind of information would be involved in typical COBRA administration for a fully insured plan.

[Sandra Pearce]

I used the word "might" for exactly that reason. I would not consider the information they are receiving to be PHI; however, it appears that everyone is erring on the side of caution at this point in time.

[Steve72]

Enrollment information is PHI if held by the plan (it's not PHI if held by the employer). Because it's not clear from whom the COBRA administrator is receiving the information, some plan sponsors are insisting that such entities sign the business associate agreement.

From the plan sponsor's perspective, having a BAA in place with a COBRA administrator shouldn't do any harm, absent unusal provisions in the agreement.

[GBurns]

Steve72,

Where did you see or find that enrollment information is PHI if held by the Plan and not PHI if held by the employer?

[Steve72]

GBurns:

The employer is not a covered entity, and therefore cannot hold PHI, except in its role as plan sponsor. If enrollment information is part of the employment record of an employee, it is explicitly excluded from the definition of PHI.

The following is cut 'n' pasted from the preamble to the August 6, 2002 final regs:

One commenter requested clarification as to whether the term ``employment record'' included the following information that is either maintained or transmitted by a fully insured group health plan to an insurer or HMO for enrollment and/or disenrollment purposes: (a) the identity of an individual including name, address, birth date, marital status, dependent information and SSN; (b) the individual's choice of plan; © the amount of premiums/contributions for coverage of the individual; (d) whether the individual is an active employee or retired; (e) whether the individual is enrolled in Medicare. Response: All of this information is protected health information when held by a fully insured group health plan and transmitted to an issuer or HMO, and the Privacy Rule applies when the group health plan discloses such information to any entity, including the plan sponsor. There are special rules in Sec. 164.504(f) which describe the conditions for disclosure of protected health information to the plan sponsor. If the group health plan received the information from the plan sponsor, it becomes protected health information when received by the group health plan. The plan sponsor is not the covered entity, so this information will not be protected when held by a plan sponsor, whether or not it is part of the plan sponsor's ``employment record.'

[GBurns]

Thank you, I had not noticed that preamble, and figured you must have seen something otherwise you would not have worded your post in the manner that you did.