HIPAA Question and Answer: When do I need an Authorization Form?

Employers hire insurance agents to help them purchase and administer their employee benefits program.  Many times that help can include handling protected health information (“PHI”) about employees and their dependents. As you represent your clients, it’s important to understand when an activity requires a signed authorization form from the insured.

Before we move forward, please note that this article explains BEST Life’s business practices to comply with the HIPAA Privacy Rule, and is not a source for legal information or advice. For more specific details on the HIPAA Privacy Rule, we recommend reading the Summary of the HIPAA Privacy Rule posted on the US Department of Health and Human Resources website, or consulting with your legal counsel.

Why would I need a signed authorization form?

The US Department of Health and Human Services (“HHS”) is in charge of regulating violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and has issued the Privacy Rule to establish the standards for the implementation of this act.

HIPAA violations are taken very seriously.  Covered Entities (a health care provider or insurance carrier) that violate HIPAA can be penalized with fines; while individuals who knowingly violate HIPAA can be fined up to $250,000 or even be sentenced to prison, depending on the degree of violation.

The HHS is very specific about how an individual’s PHI cannot be released without consent, unless it is to provide treatment, pay a claim, or for the operations of a Covered Entity.

Group Health Plans may disclose the following PHI to the employer, and through the Business Associate Agreement, to you the insurance agent as well:

• Enrollment or disenrollment
• Summary health information to obtain premium bids, or to modify, amend or terminate the group health plan
• Summary health information is defined as claims history, claims expenses, or types of claims experience of individuals and that is stripped of all individual identifiers other than five digit zip code
• PHI of the group health plan’s enrollees to perform plan administration functions

Situations outside of the above will require a signed authorization form from the insured.  The HHS also states that while the employer may ask for PHI directly from the employee, no health care provider may release PHI without that employee’s authorization.

In order to comply with this intent, BEST Life requires an authorization form signed by the insured, for the purpose of disclosing specified PHI, for one incident or event, to an employer or employer’s insurance agent.

What about the Business Associate Agreement I signed?

BEST Life’s Business Associate Agreement is to provide assurance from the organizations that do business with us that they will comply with the Privacy Rule and will disclose PHI only as permitted by the Privacy Rule and as it relates to their area of service or function.

As an insurance agent, BEST Life may provide you with the same information we can provide to an employer for the purposes listed above. The Business Associate Agreement still does not allow us to disclose PHI without authorization from the insured.

How do I obtain an Authorization Form?

BEST Life has an Authorization Form you can use.  You can download a copy here or request BEST Life Customer Service or your Sales Representative to email you one.

The Authorization Form can only be used for one specific activity.  An expiration date or description of the event is required. Once the authorization has expired or the event that triggered the need for this form is over, BEST Life will no longer be authorized to disclose PHI.  A new Authorization Form will need to be submitted after the original authorization has expired, if necessary.

The insured has the right to revoke given authorization at any time or refuse to sign the authorization form. The rights of the individual are provided on the second page of the Authorization Form.

For any more questions on BEST Life’s process, please contact BEST life’s Privacy Officer by writing to BEST Life Privacy Officer, 2505 McCabe Way, Irvine, CA 92614 or by telephone at (949) 253-4080.

For all other assistance, contact your BEST Health Plans Sales Representative at 1-800-237-8543 or BEST Life Customer Service at 1-800-433-0088 or via email at cs@bestlife.com.

Source: US Department of Health and Human Services: http://www.hhs.gov/ocr/privacy/

Advertisement