More HIPAA Stuff

[oriecat]

This isn't going to make sense since I haven't been able to think too clearly about this all, but in reading through some of the stuff in my HIPAA implementation checklist, it just starts to boggle me about how the plan can't release info to the employer, but when you are one and the same person how do you differentiate between when you are working in one capacity and when you are in the other, and how are you supposed to keep yourself from knowing information that the employer isn't supposed to know without authorization, when you already know it, because you do the work for the plan?! I must be missing something...

[Steve72]

No, I don't think you're missing anything.

Certain employees will have separate responsibilities for both the employee and the plan. Obviously, they can't "forget" PHI when performing employer functions, but they should be trained to keep the two as separate as possible, and to document the source of the information used (e.g., employee discloses IIHI to HR rep acting for employer-not PHI).