Health Information Compliance Alert

Question: Can a group health plan disclose protected health information to the plan sponsor without obtaining an individual's authorization if the information is required by the Centers for Medicare & Medicaid Services for the retiree drug subsidy?


New York Subscriber

Answer:  Yes.  Such a disclosure would be permitted if the conditions set forth in 45 CFR 164.504(f) of the HIPAA Privacy Rule have been met, according to the Department for Health and Human Services.
 
This part of the Rule says that a group health plan may disclose PHI to a plan sponsor to carry out "plan administration functions" as long as the disclosure meets certain requirements. Thus, when the plan sponsor is carrying out the plan administration function of submitting to CMS the PHI required per 42 CFR 423.884 for the retiree drug subsidy, the Privacy Rule dictates how the group health plan's plan documents must be amended to allow the plan to permit its health insurance issuer (or business associate) to disclose PHI to the plan sponsor of the group health plan without getting patient authorization.

Just remember:  The group health plan and/or any other involved parties must limit the PHI disclosed to the minimum necessary to fulfill the requirements of 42 CFR 423.884.