Helping Employees With Health Claims

[Christine Roberts]

If HR staff employed by a company with a self-funded plan assist employees with questions on their health plan claims, and the HR person needs PHI from the health plan, is a written authorization not required?

I have seen some interpretations that it is "health care operations" to share the info with HR and am wondering if I am missing something.

I am also assuming its a different situation if employee gets help from the TPA or insurer acting under ASO agreement - TPA/ASO can get PHI from self-funded plan pursuant to business associate agreement.

Any thoughts/comments appreciated....

[Guest DMK]

Most of the materials I have read, including the preamble to the privacy regulations, suggest that assisting employees with claims/claims advocacy is not a plan administration function -- rather, when a plan sponsor provides such assistance, it does so as the employer and an authorization should be obtained. I think that this would be particuarly true in the case of a self-insured plan for which claims administration has been outsourced to a TPA. Also, if one were to try to argue that claims assistance was "health care operations," the HR folks at the employer would have to worry about complying with the minimum necessary requirements. I think the safest approach is to obtain an authorization. Here is an excerpt from the preamble that is helpful:

Comment: Several commenters stated that employers often advocate on behalf of their employees in benefit disputes and appeals, answer questions with regard to the health plan, and generally help them navigate their health benefits. These commenters questioned whether this type of assistance would be allowed under the regulation, whether individual consent was required, and whether this intervention would make them a covered entity.

Response: The final rule does nothing to hinder or prohibit plan sponsors from advocating on behalf of group health plan participants or providing assistance in understanding their health plan. Under the privacy rule, however, the plan sponsor could not obtain any information from the group health plan or a covered provider unless authorization was given. We do not believe obtaining authorization when advocating or providing assistance will be impractical or burdensome since the individual is requesting assistance and therefore should be willing to provide authorization. Advocating on behalf of participants or providing other assistance does not make the plan sponsor a covered entity.

[Steve72]

I suppose an argument could be made that this assistance is a payment or heath care operations function, and no authorization would be required, but that would require training all customer service personnel and bringing them within the HIPAA "firewall". I agree with DMK that the safer course of action is to obtain an authorization.

[Christine Roberts]

I agree with you both - thanks much.