Chapter 7: The Who: Plans, Providers, and Clearinghouses, and the First of the Rule of 3s.
In most of my lectures and seminar presentations about HIPAA, I point out that one of the most confused elements of the general public’s understanding of HIPAA stems from how it is limited and focused. I’ve previously discussed (Chapter 3) how privacy law in the US is sectoral: HIPAA for healthcare, FERPA for education, GLB for banking and finance, etc. HIPAA is specifically limited in who and what is subject to the law (I’ll discuss the “what” in Chapter 8).
HIPAA only applies to specifically listed types of persons and entities, called “covered entities” in the law. The HIPAA statute listed three types of entities that would be subject to the law: healthcare providers, health plans, and healthcare clearinghouses. Because the law limited its own scope to those 3 types of entities, the regulations also had to be so limited: despite the deference granted to regulators under the Chevron doctrine, the regulations can’t add things that aren’t within the scope of the statute. Many people think that HIPAA has some type of general applicability: for example, there’s a common complaint that a business (such as airline, or your employer) has no right to ask your vaccination status because to do so would violate your HIPAA rights (or, more likely, your “HIPPA” rights). Obviously, that’s not so.
(Note: there are a lot of groupings of "threes" in HIPAA, as you'll see later. This is the first)
That limitation also meant that a great many entities that commonly hold medical records would not be subjected to the law and regulations. For example, billing companies, lawyers, accountants, pharmacy benefit managers, and the like will often come into contact with medical records if their clients or customers are in the healthcare business, but since they are not health plans, providers or clearinghouses, they are not (directly) subject to HIPAA under the law, which means they can’t be subject (directly) to the regulations, at least not until the law itself was amended by HITECH. That ultimately resulted in the concept of the “business associate;” more on that in Chapter 12.
Each type of covered entity has its own peculiar issues.
Healthcare Providers: The definition of a healthcare provider in HIPAA is pretty expansive. The Stark Law, for example, only applies to physicians, but in HIPAA, pretty much any person or entity involved in the provision of pretty much anything having to do with health constitutes a “healthcare provider.” However, not all healthcare providers are subject to the law: only those healthcare providers “who [transmit] any health information in electronic form in connection with a transaction covered by” HIPAA. HIPAA specifically regulates 9 electronic transactions between healthcare providers, payors, and employers, such as a provider submitting bills for healthcare services to a payor, or a payor checking with an employer to determine which employees are to be covered. Generally speaking, if a healthcare provider does not submit bills electronically to insurers, he/she/it will not be a covered entity under HIPAA. That leads to the anomaly that some healthcare providers are more like airlines, at least as far as HIPAA goes.
However, it’s useful to note that even those providers who are not subject to HIPAA generally follow the same rules with regard to privacy and security as providers who engage in HIPAA-covered transactions. First, there are other privacy laws (including the FTC’s general privacy and data security rules) that these providers are subject to. Secondly, even without privacy laws, most providers are subject to ethical and legal requirements to protect patient privacy and data security. Finally, providers have general a duty to provide services subject to a reasonable standard of care, and HIPAA is the de facto standard of care for data privacy and security in today’s world. Thus, even if not all providers are HIPAA-covered entities, they are strongly encouraged to live up to the same standards as HIPAA-covered providers.
Health Plans: Pretty much any entity that pays for or arranges for the payment for healthcare services is a covered entity under HIPAA. That means that Medicare and Medicaid are subject to HIPAA. But most Americans get their health insurance from their employers, and contrary to common knowledge, most employers don’t simply buy insurance from United HealthCare or Blue Cross: rather, most employers with more than just a few employees actually establish their own in-house insurance plan under the law known as ERISA. Those self-insured plans then contract with United HealthCare or Blue Cross to manage and administer their health plan (“hey, we’re a trucking company, what do we know about running an insurance company?”), which helps lead to the confusion. But the plan itself isn’t United HealthCare, it’s Joe’s Trucking Company Employee Health Benefit Plan.
Most ERISA plans (or employer self-insured plans) are just that: a plan established by the employer, with bank accounts that pay for some of the healthcare, some insurance for care that goes beyond what the employer pays directly, and the third-party administrator to run the program, arrange for the panel of physicians, etc. These ERISA plans aren’t separate companies, but more like a trust: not really an entity, and certainly not a legal entity. However, under HIPAA, they are “covered entities,” even though they are not “entities” at all. Funny, huh?
One additional thing to note with regard to plans: the US is alone in having employer-provided health insurance as the norm. That’s neither good nor bad in itself, but that relationship, and the structure ERISA encourages of employers having their own plan rather than just buying insurance from an insurer, means that your employer might know a lot more about you than they would if you got your health insurance the way you got your car or homeowner’s insurance. That crossover also is addressed by provisions in HIPAA that require certain degrees of separation between your employer as employer and your employer as the health plan it provides. A health plan can only share limited information with the plan sponsor (the employer), and the employer is prohibited from using health plan information to make employment-related decisions.
Healthcare Clearinghouses: The best way to describe a healhcare clearinghouse is as a data translation company. They take data on one format (for example, the way a particular healthcare service is described in electronic format by a physician practice’s business software) and translate it into a different format (for example, the format required to submit a bill to a particular insurance company). These entities are specifically covered by HIPAA. However, remember that one of the initial goals of HIPAA was to standardize all of these electronic transactions that occur in the healthcare arena. If those transactions are all standardized, who needs healthcare clearinghouses?
Don’t know if you’re a clearinghouse? Then you almost certainly aren’t one. There aren’t that many, but they know who they are.
So, as originally written by Congress, HIPAA only applies to certain “covered entities:” healthcare clearinghouses, health plans, and healthcare providers who engage in HIPAA-covered transactions. If that’s not you, you’re not covered by HIPAA. Unless you’re a “business associate;” yeah, we’ll get to that in Chapter 12.