[ Thursday, February 17, 2022 ]
Chapter 7: The Who: Plans,
Providers, and Clearinghouses, and the First of the Rule of 3s.
In most of my lectures and
seminar presentations about HIPAA, I point out that one of the most confused
elements of the general public’s understanding of HIPAA stems from how it is
limited and focused. I’ve previously
discussed (Chapter 3) how privacy law in the US is sectoral: HIPAA for
healthcare, FERPA for education, GLB for banking and finance, etc. HIPAA is
specifically limited in who and what is subject to the law (I’ll discuss the
“what” in Chapter 8).
HIPAA only applies to
specifically listed types of persons and entities, called “covered entities” in
the law. The HIPAA statute listed three
types of entities that would be subject to the law: healthcare providers,
health plans, and healthcare clearinghouses.
Because the law limited its own scope to those 3 types of entities, the
regulations also had to be so limited: despite the deference granted to
regulators under the Chevron
doctrine, the regulations can’t add things that aren’t within the scope of the
statute. Many people think that HIPAA
has some type of general applicability: for example, there’s a common complaint
that a business (such as airline, or your employer) has no right to ask your
vaccination status because to do so would violate your HIPAA rights (or, more
likely, your “HIPPA” rights). Obviously,
that’s not so.
(Note: there are a lot of groupings of "threes" in HIPAA, as you'll see later. This is the first)
That limitation also meant that
a great many entities that commonly hold medical records would not be subjected
to the law and regulations. For example,
billing companies, lawyers, accountants, pharmacy benefit managers, and the
like will often come into contact with medical records if their clients or
customers are in the healthcare business, but since they are not health plans,
providers or clearinghouses, they are not (directly) subject to HIPAA under the
law, which means they can’t be subject (directly) to the regulations, at least
not until the law itself was amended by HITECH.
That ultimately resulted in the concept of the “business associate;”
more on that in Chapter 12.
Each type of covered entity has
its own peculiar issues.
Healthcare Providers:
The definition of a healthcare provider in HIPAA is pretty expansive. The Stark Law, for example, only applies to
physicians, but in HIPAA, pretty much any person or entity involved in the
provision of pretty much anything having to do with health constitutes a
“healthcare provider.” However, not all
healthcare providers are subject to the law: only those healthcare providers
“who [transmit] any health information in electronic form in connection with a
transaction covered by” HIPAA. HIPAA
specifically regulates 9 electronic transactions between healthcare providers,
payors, and employers, such as a provider submitting bills for healthcare
services to a payor, or a payor checking with an employer to determine which
employees are to be covered. Generally
speaking, if a healthcare provider does not submit bills electronically to
insurers, he/she/it will not be a covered entity under HIPAA. That leads to the anomaly that some
healthcare providers are more like airlines, at least as far as HIPAA goes.
However, it’s useful to note
that even those providers who are not subject to HIPAA generally follow the
same rules with regard to privacy and security as providers who engage in
HIPAA-covered transactions. First, there
are other privacy laws (including the FTC’s general privacy and data security
rules) that these providers are subject to.
Secondly, even without privacy laws, most providers are subject to
ethical and legal requirements to protect patient privacy and data
security. Finally, providers have
general a duty to provide services subject to a reasonable standard of care,
and HIPAA is the de facto standard of care for data privacy and security in
today’s world. Thus, even if not all
providers are HIPAA-covered entities, they are strongly encouraged to live up
to the same standards as HIPAA-covered providers.
Health Plans: Pretty
much any entity that pays for or arranges for the payment for healthcare
services is a covered entity under HIPAA.
That means that Medicare and Medicaid are subject to HIPAA. But most Americans get their health insurance
from their employers, and contrary to common knowledge, most employers don’t
simply buy insurance from United HealthCare or Blue Cross: rather, most
employers with more than just a few employees actually establish their own
in-house insurance plan under the law known as ERISA. Those self-insured plans then contract with United
HealthCare or Blue Cross to manage and administer their health plan (“hey, we’re
a trucking company, what do we know about running an insurance company?”),
which helps lead to the confusion. But
the plan itself isn’t United HealthCare, it’s Joe’s Trucking Company Employee
Health Benefit Plan.
Most ERISA plans (or employer
self-insured plans) are just that: a plan established by the employer, with
bank accounts that pay for some of the healthcare, some insurance for care that
goes beyond what the employer pays directly, and the third-party administrator to
run the program, arrange for the panel of physicians, etc. These ERISA plans aren’t separate companies,
but more like a trust: not really an entity, and certainly not a legal
entity. However, under HIPAA, they are
“covered entities,” even though they
are not “entities” at all. Funny, huh?
One additional thing to note
with regard to plans: the US is alone in having employer-provided health
insurance as the norm. That’s neither
good nor bad in itself, but that relationship, and the structure ERISA
encourages of employers having their own plan rather than just buying insurance
from an insurer, means that your employer might know a lot more about you than
they would if you got your health insurance the way you got your car or
homeowner’s insurance. That crossover
also is addressed by provisions in HIPAA that require certain degrees of separation
between your employer as employer and your employer as the health plan it provides.
A health plan can only share limited information with the plan sponsor
(the employer), and the employer is prohibited from using health plan
information to make employment-related decisions.
Healthcare Clearinghouses:
The best way to describe a healhcare clearinghouse is as a data translation
company. They take data on one format
(for example, the way a particular healthcare service is described in
electronic format by a physician practice’s business software) and translate it
into a different format (for example, the format required to submit a bill to a
particular insurance company). These
entities are specifically covered by HIPAA.
However, remember that one of the initial goals of HIPAA was to
standardize all of these electronic transactions that occur in the healthcare
arena. If those transactions are all
standardized, who needs healthcare clearinghouses?
Don’t know if you’re a
clearinghouse? Then you almost certainly
aren’t one. There aren’t that many, but
they know who they are.
So, as originally written by
Congress, HIPAA only applies to certain “covered entities:” healthcare
clearinghouses, health plans, and healthcare providers who engage in
HIPAA-covered transactions. If that’s
not you, you’re not covered by HIPAA.
Unless you’re a “business associate;” yeah, we’ll get to that in Chapter
12.
Jeff [3:44 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
