Information and HIPAA Privacy Rights

[Guest Ben Schutzenhofer]

I am a Union representative. Recently the Union filed, and won, an arbitration in which the employer was found to have unilaterally reduced benefits in the health plan. The arbitrator directed the parties to meet to calculate an appropriate remedy. The Union made a demand for information so that we could calculate how much each bargaining unit member lost because of the reduced or eliminated benefits because of the employer's unilateral reduction in benefits.

The employer is trying to hide behind HIPAA privacy regulations. I do not believe this is appropriate for the following reasons:

1. Under state law, the Union is the collective bargaining representative and has a legal right to information necessary to enforce the contract.

2. I believe that, under HIPAA, the Union is each employee's personal representative.

3. This may be a stretch, but isn't the Union at least a business associate, with rights to information?

I would really like to hear any opinions, get any citations of law or regs, or any government documents that deal with this issue.

Ben Schutzenhofer, CEBS, Research Director

Illinois Federation of Teachers

[Guest kowen]

Personal representatives other than parents under the Privacy Regs are generally limited to people who have the power to make health care decisions for the individual. The union would not be a business asscociate unless it performed services on behalf of the plan. Even if this was the case, business associates do not have the right to demand PHI from a plan, they just have to agree not to use the PHI they do have in any way that violates the Privacy Rule. I do agree, however, that the plan can disclose PHI in this case in order to carry out health care operations (See S. 164.506). You could also make the case that the information could be disclosed under S. 164.512(e) for judicial and administrative proceedings. I hope this helps.

[Jbentz]

I agree with Kowen, you are not a BA of the plan, nor are you a personal rep. If they will not bend under the suggestions from Kowen, you might also try having the arbitrator making it very clear what information is to be shared. It is possible that the arbitrator's decision may have a loop hole in it by not being specific enough (what information is to be given to you, etc...) If the decision just states to meet and calculate an appropriate remedy, that does not necessarily mean they will share reports with you.

You may also try getting a HIPAA compliant authorization from each of the Union members to share all claim information with the Union, using the time period in question. This may be a chore depending on how many members you are representing, but they cannot argue with that.

You may want to post your question to the WediSnip website http://www.wedi.org/listserve/ and choose the listserve for privacy for a different audience perspective.

Good luck.

[Guest eafredel]

You may want to ask for information without the individual identifiers (e.g., without Social Security numbers, names, addresses, etc.) or in aggregate form for all individuals covered under the collective bargaining agreement. This may be all that you need to do a basic analysis of the issue.

You do not make clear the nature of the reduction in benefits. For example, if the employer unilaterally increased the copayment for office visits under the plan from $10 to $20, all you would need to know is the total number of office visits by all individuals covered by the collective bargaining agreement.

Alternatively, you could ask a health actuary to calculate a reasonable estimate based upon the information available to you.

[Steve72]

Just wanted to add my agreement that the union is neither a BA or the personal representative of the plan.