|
As you are aware, HIPAA, the Health Insurance
Portability and Accountability Act of 1996, established national
standards to protect individuals’ medical records and adopted
privacy protections for individually identifiable health information
(Protected Health Information or PHI). In response to the HIPAA
mandates, the Department of Health and Human Services (HHS)
published final Privacy Rules (to be implemented over time) on
December 28, 2000.
In the preamble of the final HIPAA Privacy Rules,
the HHS states that Stop-Loss insurance is "functionally equivalent"
to reinsurance for the purposes of the Privacy Rule (12/28/00 - 65
Fed. Reg. 82609). The HIPAA Privacy Rule also clarifies that
Stop-Loss insurance carriers are not health plans because "they do
not provide or pay for the cost of medical care. . . but rather
insure health plans and providers against unexpected loss."
(12/28/00 - 65 Fed. Reg. 82576)
As a by-product of the HIPAA Privacy Rules
interpretation, some clients of SLG Benefits have inquired about the
need and appropriateness for a “Business Associates Agreement” and
the entities in which said agreement should be party to. SLG
Benefits & Insurance and our insurance carrier partners do not believe an
employer's purchase of Stop-Loss coverage from a Stop-Loss insurance
carrier deems the insurance carrier and Underwriting Program Manager
(SLG Benefits) a “Business Associate”, unless the carrier, or its
legal agent, is performing additional services for or on behalf of
the group health plan. The HHS clarifies, "whether an entity is a
business associate depends on what the entity does (for the covered
entity), not what the entity is." (12/28/00 - 65 Fed. Reg. 82643) A
Stop-Loss carrier does not perform functions on behalf of a Covered
Entity; rather it reimburses a self-funded employer for eligible
medical expenses incurred on behalf of its employees. Therefore,
since SLG Benefits, as a legal agent of the insurance carrier,
is not operating in a “Business Associate” capacity, as defined by
the HIPAA Privacy Rules, it would be inappropriate for us to sign a
Business Associate Agreement.
When performing, “healthcare operations”, group
health plans and/or their Business Associates are permitted to use
and disclose PHI without prior individual authorization (12/28/00 –
Vol. 65 Fed. Reg. Pg. 82490). Healthcare operations are activities
considered to be compatible with and directly related to treatment
and payment for medical care, including insurance activities
relating to the renewal of a contract of insurance, as well as
ceding, securing or placing a contract for reinsurance of risk
relating to claims for health care, including Stop-Loss and excess
of loss insurance (12/28/00 – Vol. 65 Fed. Reg. Pg. 82803).
Consequently, Stop-Loss carriers may obtain PHI from Covered
Entities and/or their Business Associate without prior individual
authorization since the activity of procuring and administering
stop-loss insurance is considered as a “healthcare operation”.
As a legal agent of a Stop-Loss carrier, SLG
Benefits & Insurance, LLC does not have interest in using or
disclosing PHI for purposes not related to our quoting or
administration of Stop-Loss coverage. We do, however, recognize the
need to maintain the confidentiality of PHI that we receive from the
employer, TPA or associated vendor. Please note that we take all
appropriate measures and maintain strict guidelines to protect PHI.
We are, therefore, certainly agreeable to enter
into a Confidentiality Agreement that specifically addresses the use
or disclosure of PHI for purposes related to our quoting or
administration of Stop-Loss coverage. Accordingly, we are pleased to
execute a Confidentiality Agreement for this purpose. Please contact
your SLG Benefits Underwriter or visit the
forms section of this website to review a copy of this
agreement. Please do not hesitate in
contacting
us should you have any additional questions or
concerns.
|
