Self Funded Employer insurance & HIPAA

[Guest]

I have health insurance that is a self funded plan by my employer and administered by a third party. I was under the impression that my employer did not see specific information regarding each employee. However, today a member of upper management came to me & told me he was the HIPAA officer or representative (forget the word he chose) and sworn to confidentiality. He told me he knew how much money my medications cost & just wanted to see if I would be renewing them before the end of the year, something to do with the amount they are insured for. He again told me he would discuss this with nobody.

I am now left wondering what else he knows. What exactly are they allowed to see? Is it strictly financial or do they see the medications, tests, and other medical information?

 

[cbg]

If the insurance is self-funded, SOMEONE knows what's being paid for. How else would they know how to fund the plan?

I can't tell you precisely what is seen by who. I can tell you that is seen and by whom is rigidly restricted. Depending on how large your employer is, it could be limited to one person or there could be a dozen, and each person there can only see what they need to be able to see in order to do their jobs.

To give you an example, I work in the Benefits office of a large university. I am HIPAA trained and qualified, and fall under the HIPAA umbrella for the university. The only information I can access on my own is which insurance plans you are covered under and what dependents you have enrolled. If you have a claims issue, the insurance vendor is allowed to tell me whether or not they have the claim and what action they are taking to have it resolved. In order for me to know anything more than that, either you have to tell me or you have to sign a release that expressly allows the insurance company to talk to me. You have complete control over how much information they can give me and for how long the release is valid.

The next "layer" of people in my office know the amounts that are paid to each vendor, but they only see aggregate amounts, not specific to the employee.

There is at a very high level someone who knows the amount that is paid out on each employee, but even they do not see medications, tests, or other medical information.

I'm not going to tell you that no one, ever, in a self-funded, third party administered situation ever sees your specific medical information but those situations would be few, far between, limited to a need-to-know, and that person would be subject to firing if they disclosed that information to someone who did not have a need to know AND was under the HIPAA umbrella AND did not have your specific authorization to disclose it.