|
Legal and Compliance: HIPAA COMPLIANCEFrom time to time we receive requests that we sign a “Business Associates Agreement” to permit us to receive individually identifiable health information (Protected Health Information or PHI) under HIPAA, the Health Insurance Portability and Accountability Act of 1996. As you are well aware, HIPAA established national standards to protect individuals’ medical records and adopted privacy protections for PHI. The Department of Health and Human Services (HHS) regulates the HIPAA mandates and on December 28, 2000 published the final Privacy Rules which were to be implemented over a period of time. In the preamble of the final HIPAA Privacy Rules, HHS defined Stop-Loss as “functionally equivalent” to reinsurance for the purposes of the Privacy Rules (Volume 65 Federal Register Page 82609 dated 12/28/2000). The HIPAA Privacy Rules also clarifies that Stop-Loss insurance carriers are not health plans because “…They do not provide or pay for the cost of medical care…but rather insure health plans and providers against unexpected losses.” (Volume 65 Federal Register Page 82576 dated 12/28/2000). ASG Risk Management, Inc. and the insurance carriers it represents as a Managing General Underwriter (MGU) do not believe we are “Business Associates” under the clarifications put forth by HHS. HHS stated that the Stop-Loss insurance carrier or its legal representative, ASG Risk Management, Inc. in this instance, becomes a “Business Associate” by virtue of performing additional services for or on behalf of the group health plan. The HHS commented that “whether an entity is a business associate depends on what the entity does (for the covered entity), not what the entity is.” (Volume 65 Federal Register Page 82643 dated 12/28/2000). As an example, services provided directly for the covered entity (Employer), such as Case Management, Utilization Review, claim processing, etc. would qualify an entity as a “Business Associate”. ASG Risk Management, Inc. on behalf of its Stop-Loss insurance carriers does not perform functions on behalf of a covered entity; rather it reimburses a self-funded employer for eligible medical expenses incurred on behalf of its employees and their covered dependents. Accordingly, it would be inappropriate for us to sign “Business Associate Agreements”. While not a “Business Associate” under the HHS rules interpretation, ASG Risk Management, Inc. and our Stop-Loss insurance carriers are permitted to receive PHI without prior individual authorization. HHS further elaborates that group health plans and/or their Business Associates are permitted to use and disclose PHI without prior individual authorization when performing “healthcare operations”. (Volume 65 Federal Register Page 82490 dated 12/28/2000). Healthcare operations are activities considered to be compatible with and directly related to treatment and payment for medical care, including insurance activities relating to the renewal of a contract of insurance, as well as ceding, securing or placing a contract for reinsurance of risk relating to claims for health care, including Stop-Loss and excess of loss insurance. (Volume 65 Federal Register Page 82803 dated 12/28/2000). This HHS clarification of the HIPAA mandates permits ASG Risk Management, Inc. on behalf of its Stop-Loss insurance carriers to receive PHI from group health plans (Employers) and/or their Business Associates without prior individual authorization. The activity of procuring and administering Stop-Loss insurance is an activity covered under the definition of a “healthcare operation”. We do and will continue to sign Confidentiality Agreements that specifically address the use or disclosure of PHI for purposes related to our quoting or administering Stop-Loss coverage. We recognize the need to maintain the confidentiality of PHI and take all appropriate measures to protect PHI. These forms are in Adobe .PDF format. To view them, please download the viewer here.
|
