Which HIPAA requirements apply to us?
Half HR
47 Posts
I'm trying to figure out exactly which HIPAA requirements we'll have to comply with. We've bought a kit online, but much of the info seems to apply to doctor's offices or self-insured employers. We're a government agency with over 50 employees.
We're fully insured, but we do require pre-employment physicals and maintain a confidential medical file on each of our employees. Disability claims and FMLA documents also contain health information.
Can anyone help me sort out what we have to do? What do we do and what should come from our insurance companies?
Thanks much,
Half HR
We're fully insured, but we do require pre-employment physicals and maintain a confidential medical file on each of our employees. Disability claims and FMLA documents also contain health information.
Can anyone help me sort out what we have to do? What do we do and what should come from our insurance companies?
Thanks much,
Half HR
Comments
We administer enrollment and terminations, pay premiums, and very occasionally help with problematic claims, but that's it.
Are we sponsors of the plan?
Thanks,
Half HR
As long as you do not get information "on behalf of the plan" you're fine. An example would be if you were self-insured and were getting information to pay claims. Then you would be a covered entity and subject to HIPAA. But as long as you are not getting any health information from the carrier you're OK.
PHI (Private Health Information ) DO NOT INCLUDE the informaiton in employment records held by the covered entity (the Health Plan) in its role as employer. (This like sick leave records or fitness for duty exams.) The regs do not apply to employment functions of a covered entity when acting as an employer. Therefore, "forget about W/C, FMLA, ADA, Disablity, Drug Testing and physicals. These are not PHI, they are information you hold as the role of employer. Just keep in mind that "if information "connects" to group insurance or claims, then it is PHI". If it is employment information, it isn't.
Also, since you are not self insured, your insurance company has probably done the work for you. I would call your rep there and see what they have done and what you need to do. (You may have some Business Agreements to sign or distribute, depending upon your benefits.)
E Wart
E Wart
Just making sure we don't deal with PHI:
I've seen name, social security number, and address defined as PHI. If we and our insurance companies include that data in our enrollment paperwork and bills, is that considered PHI?
Thanks,
Half HR
Thanks again,
Half HR
Just kidding, In our world there is no half answer or half response. We are a private company with a full medical benefit plan to which we assist in the application and enrollment process and keep record thereof. We no longer get firectly involved with the processing of claims. We retain the enrollment forms in a medical record file and in a security container in a limited access locked vault. We do not ask for medical information but sometimes it is thrust upon us. It is this last statement that has thrown us into a full admin training session tomorrow morning for everyone in the office who who have access to the office fax machines or mail room.
I thought we were home free and without an worry. However, our corporate headquarters and our insurance carrier wanted to insure our mail clerk knows what to do with a piece of medical information contained in the physician's communication (a letter) to us about "suez or Billy Bob's" failed payment after being diagnosed with "AIDs" and died before the physician got paid. Even the dead employee is protected and the information revealed by a mistaken or errant piece of communication is no excuse for not HIPAA protecting the document and the information or anything that might resemble fact. The clerk or anyone in the office that might potentially have access to any part of a medical situation must be trained and must exercise correct, "due course", action. Otherwise, the "HIPAA ATTACK DAWGS" WILL BE ABOUT OUR SHOULDERS.
Take heed and use on "Deet" to prevent West Nile Virus! Do not toss any possibility of covering your company with proper training to some level. Using "Deet" to protect against VNV" is like using a minimum information training program to protect your company from a potential failure. It is a real threat, and we will apply a sensible and information training program with our admin staff about this subject. Even our Accounting Manager will attend and will be tested. I saw a potential medical HIPAA document that she printed this morning which falls in this very category, it was a printed document that broke down the medical claims cost by department and named family member. I did not realize that we accounted for cost to that degree, but we do and when named it became a potential HIPAA document.
PORK