Can an employer get some health information from the plan without triggering significant HIPAA compliance obligations?
A. An employer can receive health information from the plan as long as it is not identifiable as to a particular person. Often, this will meet the employer’s needs. An employer can also receive “summary health information” from the plan, which is information which has been modified so almost all identifiers have been eliminated, as long as this information is used only for obtaining premium bids or amending or terminating the plan. Finally, an employer can receive enrollment or disenrollment information from the plan without meeting HIPAA’s compliance burdens.
Related Questions
- What are a covered entity’s obligations under the HIPAA Privacy Rule with respect to protected health information held by a business associate during the contract transition period?
- May a health care provider disclose protected health information to a health plan for the plans Health Plan Employer Data and Information Set (HEDIS)?
- How will the plan affect my existing compliance obligations?
