HIPAA and Plan Participation

[Guest blackacre]

I am in great need of help in answering this question --

Does the privacy rule apply to the identification of which medical plan retirees have chosen? The context is a request for information from a company in bankruptcy that is threatening a section 1114 filing (that is the section of the bankruptcy code that allows a debtor to modify or terminate retiree medical benefits). The company says it can't provide the information because it is covered by HIPAA.

I don't think that identifying in which plan a person participates (and nothing more) is PHI. I see this as similar to the incidental disclosures allowed under the Rule, like calling out a patient's name, or even sitting in the HMO's waiting room.

Can anyone tell me how stating the fact of who is in which plan is PHI?

I have calls into the legal department at OCR but may not hear from them any time soon.

Some help today would be truly appreciated.

Thanks!

[Steve72]

The answer to this one is a bit odd. Enrollment information (such as what you are describing) is PHI when held by a covered entity (like the plan). However, HHS has drawn a practical line here, as enrollment information is legitimately held by the employer both in its role as plan sponsor and as employer (for example, for determining premium withholding from active employees paychecks). Enrollment and eligibility information, when held by the employer as employer, is outside the definition of PHI.

I think you can make the argument that this information is held by the employer in its role as employer, and is therefore not sunject to HIPAA.

[Jbentz]

If they won't accept that argument, even if it does fall under the HIPAA regulations, you can use the information for operations purposes. This would qualify under 164.501, definitions of operations:

(3) Underwriting, premium rating, and

other activities relating to the creation,

renewal or replacement of a contract of health

insurance or health benefits, and ceding,

securing, or placing a contract for reinsurance

of risk relating to claims for health care

(including stop-loss insurance and excess of

loss insurance), provided that

the requirements of § 164.514(g) are met, if

applicable;

Either way, covered or not, I think they can release that information to you.

[Guest blackacre]

Thank you very much for these replies. You've helped me a lot and I appreciate your effort.