A new Frequently Asked Question (FAQ) was posted on the Office for Civil Rights (OCR) HIPAA Resources website, which clarifies the conditions under which a group health plan or health insurance issuer may disclose PHI to a plan sponsor for purposes of the Retiree Drug Subsidy.  You can readily access this new FAQ from the “What’s New” column on the OCR website, http://www.hhs.gov/ocr/hipaa/, by clicking on “FAQ on Disclosing PHI to a Plan Sponsor for the Retiree Drug Subsidy.”

Keep informed about these HIPAA Privacy FAQs and other new resources available to assist you in understanding the HIPAA Privacy Rule.  This information was sent from the OCR-Privacy-list listserv, operated by the Office for Civil Rights (OCR) in the US Department of Health and Human Services.  This is an announce-only list, a resource to distribute information about the HIPAA Privacy Rule. For additional information on a wide range of topics about the Privacy Rule,

please visit OCR Privacy website at www.hhs.gov/ocr/hipaa/

please call OCR Privacy toll-free phone line at (866) 627-7748

please visit OCR home page at www.hhs.gov/ocr  for information about OCR's civil rights authorities and responsibilities.

If you believe that a person or organization covered by the Privacy Rule (a "covered entity") violated your health information privacy rights or otherwise violated the Privacy Rule, you may file a complaint with OCR. For additional information about how to file a complaint, see the Fact Sheet "How to File a Health Information Privacy Complaint," available at http://www.hhs.gov/ocr/privacyhowtofile.htm  

To subscribe to or unsubscribe from the OCR-Privacy-list listserv, please go to: http://list.nih.gov/cgi-bin/wa?SUBED1=ocr-privacy-list&A;=1  

For your convenience the following HIPAA Privacy FAQ is provided:

Can a group health plan disclose to the plan sponsor the information required for the retiree drug subsidy?

Question

Can a group health plan, or health insurance issuer with respect to a group health plan, disclose to the plan sponsor the protected health information (PHI) required by the Centers for Medicare and Medicaid Services (CMS) for the retiree drug subsidy, without obtaining the individual’s authorization?

Answer

Yes, when the conditions set forth in 45 CFR 164.504(f) of the HIPAA Privacy Rule have been met. Specifically, 45 CFR 164.504(f)(3)(i) allows a group health plan or a health insurance issuer with respect to the group health plan – or its business associate – to disclose PHI to a plan sponsor to carry out plan administration functions as long as it meets the requirements of 45 CFR 164.504(f)(2). As such, where the plan sponsor is carrying out the plan administration function of submitting to CMS the PHI required by 42 CFR 423.884 for the retiree drug subsidy, 45 CFR 164.504(f)(2) sets forth how the group health plan’s plan documents are to be amended to allow the group health plan to permit its health insurance issuer (or business associate, such as a third party administrator) to disclose PHI, without the individual’s authorization, to the plan sponsor of the group health plan. As with other disclosures for plan administration functions, the PHI disclosed must be limited to the minimum necessary to fulfill the requirements of 42 CFR 423.884.