Medicare Data Match Program and HIPAA

[Chaz]

A participating employer in a multiemployer welfare fund receives a request from CMS for participant enrollment/eligibility information to use in the Medicare Data Match program The participating employer forwards the request to the fund asking for the information. (The employer is required to provide the information under the Medicare rules so the disclosure would generally be "Required By Law" under the Privacy Rules.)

Can the fund disclose the information to the employer? A single employer/plan sponsor can disclose the information to CMS if it has the information in its role as employer because the information is not PHI. If it doesn't, it can also get the information from the health plan it sponsors if, in its capacity as plan sponsor, has certified to the plan that it complies with HIPAA, etc.

In my situation, the employer doesn't hold the information in its role as employer (the fund does) and the employer is not a plan sponsor so the certification rules are seemingly not applicable. I'm not sure the fund can disclose the information to the employer.

Does anyone have any thoughts?

[FormsRstillmylife]

An employer does not have to certify HIPAA compliance to have pure enrollment information. This is the one thing an employer is allowed to know when it is not going to be otherwise involved with a plan.

To avoid any argument, could the data be sent straight to CMS on the employer's behalf?