Protected Health Information

[Mel B.]

We include a listing of the new employees who are participants in the COBRA, FSA and HRA plans when we send them our invoices.  I would like to know if the names of the employees are PHI and if we should send our bill via a secure mode of communication?

 

 

[leevena]

Any email with PHI should be sent encrypted and secured.

[Mel B.]

The invoice does not have PHI other than the names of the new employees who participate in the plan - that is all.  However, do the names of the employees who participate in the FSA plan are considered PHI or not - that is what I would like to know.

[Chaz]

Information about whether an employee is enrolled in a group health plan may or may not be PHI depending on whether the information is held by or on behalf of the plan (it is) or by or on behalf of the employer (it is not).  Sometimes/often making this determination is difficult so it makes sense to follow HIPAA's requirements even though it may not technically be required.  Encrypting emails disclosing this information seems to be a relatively easy step to take in this regard.

If there is some reason why encrypting this information when transmitting it is not desired or practical, you might want to ask your benefits counsel for guidance.

[MichaelMinix]

On 11/21/2018 at 8:54 PM, Chaz said:

Information about whether an employee is enrolled in a group health plan may or may not be PHI depending on whether the information is held by or on behalf of the plan (it is) or by or on behalf of the employer (it is not).  Sometimes/often making this determination is difficult so it makes sense to follow HIPAA's requirements even though it may not technically be required.  Encrypting emails disclosing this information seems to be a relatively easy step to take in this regard.

If there is some reason why encrypting this information when transmitting it is not desired or practical, you might want to ask your benefits counsel for guidance.

Agree with you.

[leevena]

I disagree, sorry.  If Mel B is sending out invoices to a number of employees and each of those employees can see the names of other participants, their coverages, costs, along with other information, I would be concerned.  I agree with Chaz, they should seek guidance.