HIPAA - Social Security #'s and 401(k) Plans

[Guest Emiman]

I'm not sure if this is the right message board to ask this, but I'm hoping there is someone experienced both on HIPAA and retirement plans. I work for a TPA of 401(k) plans and a new client of ours refuses to provide our firm with the social security numbers of the plan participants. The client is a medical office and states as a result of HIPAA privacy rules she is enable to provide this information.

I have heard about HIPAA - but not all the details - but there must be something in the regulations of HIPAA that just refer to privacy information only within the context of health plans or medical information. Would someone be able to provide me information or point me in the right direction for research?

Thank you!

[Steve72]

The client is incorrect. Based on your post, HIPAA would not prevent the release of this information.

The social security numbers of employees of a covered entity are not subject to HIPAA (although they may be subject to other privacy rules). Only information relating to medical information (e.g., information about patients) would be subject to the rules.

Paragraph (2) of the definition of "Health Information" in HIPAA should be the starting point. Since employee SSNs do not "®elate to the past present or future physical or mental health or condition of the individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual", it will not be health information, and therefore not PHI.

However, convincing your client of this may be difficult. I would imagine that their privacy department could clarify this issue with your contact person. She may simply misunderstand the policies established by the medical office.

[GBurns]

The client is probably just following what the majority of carriers are doing in response to state Privacy Laws. All the BCBS, Aetna, UHC etc have or are in the process of discontinuing using SS# as an identifier on documents and cards. This change should be completed by the end of 2005.

Here is a BCBS news release:

http://www.bcbsil.com/producer/whatsnew/social_security.htm

[Kirk Maldonado]

There is also a California law that places some limitations upon the ability of employers to use Social Security Numbers. (I don't know if any other states have similar laws.)

This law is not directed at medical plans; it is much broader in scope.

There seems to me to be an ERISA pre-emption issue to the extent that law would apply to employee benefit plans subject to ERISA.

[Guest Emiman]

Thank you for the help and direction!