PHI - family member - service provider letters

[chuTzPA]

Received an inquiry, have no idea how to respond:

Person in question is the spouse of an employee who is a subscriber of an employer offered health insurance plan, so the insurance is held in the employee's name, but it is the spouse with the inquiry.

The spouse has on file with the insurance provider to not provide PHI to the employee subscriber holding the policy. 

The spouse visited a doctor. The insurance company then sent a follow up letter to the subscriber regarding that visit by the spouse to confirm the visit (specific details of the visit apparently not provided).  Spouse felt this was PHI, but upon checking in with the insurance company, spouse was informed that that is not considered PHI.  spouse believes just providing the doctor information to the subscriber is.

To be clear this question is about PHI, not the relationship between the employee subscriber and spouse.

[Chaz]

I would need more information about the specific contents of the letter to provide a more definitive answer but, in general, there is no need for the letter to have specific medical information in it to be considered containing protected health information.  The definition of PHI is very broad and I would take the position that a sentence saying something along the lines of "Spouse X visited Dr. Smith on October 1, 2019" (with or without a date, in fact) is enough to meet the definition because it relates to  "the provision of health care to an individual."

[chuTzPA]

Chaz - that is what spouse believes, and what I believe, but I'll have to do some additional research to see what kind of documentation to back it up exists, since this is likely not specified directly. I was curious first what a general consensus would be before putting that kind of time in. 

[EBAtty]

I agree with Chaz. 

[JWK]

This information is PHI because it relates to the past, present, or future health care of an individual, or payment for that health care. 

An insurance company generally is not precluded from disclosing PHI regarding a family member to the primary subscriber.  This issue usually arises in the context of EOBs. That doesn't mean that the information isn't PHI; it just means that disclosure is permissible (subject to the minimum necessary rule.) So, for example, the disclosure should not include diagnosis information.

These disclosures also are subject to the "confidential communications" rule. So, even if disclosures of a spouse's PHI to the primary subscriber are generally permissible, the spouse's request for confidential communications could override the general rule. To determine whether the insurer's disclosure was permissible in this case, you should analyze the insurer's actions in light of the confidential communications rule.

[Allison Reuter]

I agree with all of the above.  Although the letter contains PHI, it would likely be a permitted disclosure.  (It sounds like it could've been an EOB, as I'm unsure why an insurance company would "confirm" a visit that already took place.)  The key question is whether the document the spouse "has on file" with the insurance provider is a request for confidential communications, as JWK points out, and whether the insurance company granted the request.  In any event, this is an issue for the insurance company (assuming this is a fully insured plan), not you.  You should tell the spouse to contact the insurance company as well as HHS since he would not have a private cause of action.  HHS would then investigate further on the spouse's behalf.

[GBurns]

I agree with all of the above. The issue of what is PHI is constantly  disputed.

However, you might find that there is an answer  in either the Application for Coverage or in the HIPAA  Information Release that the patient signed when the Patient was filling out the paperwork at the Doctor's Office. Either one or both should override any subsequent filing by a beneficiary to the Insurance carrier. The insurance carrier cannot override what the insured dictated. A beneficiary usually, in most cases  gets only what the covered insured allows.