HIPAA Privacy Rule Requirements

Are Plan Sponsors (employers who offer/sponsor group health plans) required to comply with the HIPAA Privacy Rules published on August 14, 2002?

While employers are not directly regulated by the new federal regulations governing the privacy of medical records, the HIPAA Privacy Rules indirectly affect employers that sponsor group health plans.  Regardless if fully-insured or self-insured, the compliance requirements imposed on the plan sponsor will vary, depending upon whether or not it has access to personally identifiable health information (PHI) or, Summary Health Information (SHI).

The difference between Summary Health Information (SHI) and Protected Health Information (PHI) is clearly distinguishable and, according to the HIPAA Privacy Rules, determines to what degree a plan sponsor may be required to comply with the HIPAA Privacy Rules guidelines and administrative requirements.

·         SHI summarizes (1) claims history, (2) claims experience, or (3) type of claims experienced by individuals from whom a plan sponsor has provided health benefits under a group health plan. 

·         (PHI) is defined as including; (1) oral, written, or electronic, (2) individually identifiable health information; created or received by a covered entity, and (4) relates to past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

For larger employer groups of 100 or more insured employees, SHI is typically acceptable to an underwriter in order to properly assess the risk and adequately estimate the cost of future medical expenses when establishing premiums charged to employers for coverage. This type of underwriting is called “experience rating.” For smaller employers insuring between 2 and 99 employees, (specifically 2-50) most insurance company underwriters require an individual enrollment form including written, electronic, individually identifiable health information and/or past, present or future (prognostic) information on the physical or mental health or condition of an individual – including perhaps the past, present or future payment for the provision of health care to an individual. This type of underwriting is often referred to as “Individual Medical Underwriting.” Since the underwriting practices of most insurance companies require the procurement of PHI (as defined by HIPAA), the HIPAA Privacy Rules appear to clearly require plan sponsors with access to such PHI via the enrollment process or by other means to comply with the HIPAA Privacy Rules guidelines and administrative requirements.

For more information or research on this topic, please write or call StrictlyHR.

This StrictlyHR Regulartory & Legislative Brief is not intended to be exhaustive nor should any discussion or opinions be construed as legal advice.  Readers should contact legal counsel for legal advice.