BAA for insured group health plan

[Guest Stevecpa]

Has anyone requested a BAA from their health plan insurance carrier? If so, what was the response?

[GBurns]

Why would an employer/plan sponsor need it? The relationship between a group health plan and the insurance provided is not required because it is an organized health care arrangement (OHCA).

[Guest Stevecpa]

I don't have an issue with the plan and the underlying insurance, but for instance the availability of EOBs on the internet from the carrier. What happens if the system is hacked and my EOBs are accessed?

[Chaz]

I don't have an issue with the plan and the underlying insurance, but for instance the availability of EOBs on the internet from the carrier. What happens if the system is hacked and my EOBs are accessed?

The insurer is a covered entity itself under HIPAA and is subject to liability for violations of the rules on its own if the EOBs are put online as a part of the insurance coverage.

I'm not sure if I am missing anything here.

[GBurns]

I don't have an issue with the plan and the underlying insurance, but for instance the availability of EOBs on the internet from the carrier. What happens if the system is hacked and my EOBs are accessed?

It seems that we are not understanding your concern. What does a BAA have to do with this? What does the employer have to do with this?