Human Resource Blog

HIPAA, TPA and the HR worker

We have a third party adminstrator for our health insurance. Once a deductible is satisfied, we will reimburse half the cost to the employee. There are two of us in HR and the insurance broker told us that due to HIPAA laws, the employee needs to contact them directly because even though we work in HR, we are co-workers and we would be in violation of HIPAA. My question is if an employee were to bring in receipts/EOB to me for reimbursement, would I be violating HIPAA laws by being involved and forwarding to the TPA? We are very careful with Protected information and have separate medical and confidential files away from personnel files. It is a small company (65 eligible employees) and many would prefer to come to the HR department during the day with any questions and/or issues as opposed to trying to contact the TPA. Please advise.

Employees can come to the company HR department instead of the third party administrator, and it is understandable that they would want to. However, you and your coworker in HR need to realize that when this happens, you are acting as  a third party administrator, and all the HIPAA regulations apply to you.

 

It is very common for an employee to volunteer private medical information during a conversation about benefits. Or, you may learn private medical information by reviewing the employees receipts. Any information learned during these conversations is even more private than that learned under an ADA-protected conversation.

 

Under HIPAA, you cannot reveal any of the employees private health information to anyone whatsoever, including the other HR employee, the employees supervisor, coworkers or even the employees immediate family. You cannot even imply that the employee has an illness. (Under ADA, medical information can be revealed if the supervisor has a legitimate need to know. Under HIPAA, it cannot.)

 

Suppose during this conversation about benefits you learn that Joe has cancer and is not expected to live for more than 6 months. You cannot share that information with anyone – not even your HR coworker or Joes supervisor. You cannot even say that Joe is in poor health. You cannot ask your friends from church to pray for Joes illness. You cannot have Joes coworkers sign a get-well card for him. Nor can you consider this factor when making any employment decisions. If Joe is up for promotion, you need to give him the promotion regardless of what you now know about his medical condition.

 

As one prominent HR guru has put it, HIPAA requires you to  *forget* that you ever knew this.

 

Even though you keep private health information in a confidential folder, papers regarding HIPAA information need to be returned to the employee or destroyed ASAP.

 

It is understandable that employees would want to discuss benefits with the HR department rather than a third party administrator. But If you decide to take on this responsibility, you and the other person in HR must be trained in HIPAA standards and rigorously follow them.