03.20.2020
|
Updates
As federal and state governments respond to COVID-19, employers and plan fiduciaries must also address the evolving issues arising under employer-sponsored health plans. The specific considerations covered in this update are limited to HIPAA privacy and health coverage. Addressing these issues will likely require coordination among the employer’s human resources or benefits department and a third-party administrator or insurance carrier.
Protecting Employee Privacy
HIPAA Considerations for Self-Insured Health Plans
HIPAA privacy rules impose limitations on a self-insured health plan’s ability (or the ability of a human resources or benefits department acting on behalf of the plan) to use or disclose Protected Health Information (PHI) without the related individual’s prior written authorization to do so. Improper uses or disclosures of PHI in violation of these restrictions without individual authorization typically carry the risk of substantial penalties and fines.
However, due to the unprecedented threat posed to public health by COVID-19, self-insured health plans may be permitted or required to use or disclose PHI without individual authorization. For example, self-insured health plans may use or disclose PHI without individual authorization
- To public health authorities such as the Centers for Disease Control and Prevention (CDC) or state and local health departments that are legally authorized to collect or receive PHI to prevent or control the spread of disease. Specifically, the self-insured health plan could disclose to the CDC PHI pertaining to confirmed COVID-19 cases.
- At the direction of a public health authority, to a foreign government agency acting in collaboration with the public health authority.
- To individuals at risk of contracting or spreading a disease if other laws, including state laws, authorize the self-insured health plan to provide such notice to such persons as is necessary to prevent or control the spread of disease.
- To a patient’s family members, relatives, friends, or other individuals identified by the patient as involved in his or her care, or as necessary to identify, locate, and notify such individuals of the patient’s location, general condition, or death (noting that there may be initial permissions that must be obtained from the individual to which the PHI relates before the PHI can be disclosed without authorization). This type of disclosure can also be made to a disaster relief organization authorized by law to assist in disaster relief efforts.
HIPAA contains other exceptions allowing for use or disclosure of PHI without individual authorization that may arise during the COVID-19 public health emergency, but not all exceptions are available to self-insured health plans (e.g., healthcare providers may disclose PHI without authorization to help avert a serious and imminent threat to public health).
Further, HIPAA requires that all uses and disclosures of PHI be limited to the minimum necessary to accomplish the (permissible) purpose of the use or disclosure. This minimum necessary standard applies even when an exception to HIPAA’s authorization requirement is available. There are some exceptions to HIPAA’s minimum necessary standard (e.g., it does not apply to healthcare providers using PHI for treatment purposes), but, as with above, not all such exceptions are available to self-insured health plans.
In addition, a self-insured health plan is limited in what it can disclose to third-parties outside of those narrow exceptions provided above. This would include disclosures to the plan sponsor (generally, the employer), the media, or other third parties, which may otherwise seem warranted given the nature of the COVID-19 public health emergency (e.g., disclosing a workforce member’s positive coronavirus test to protect the sponsor’s workforce on the whole). It is important to consult with counsel to determine whether disclosure is appropriate under the circumstances and whether prior authorization from the individual is required.
For more information on permitted uses and disclosures of PHI in connection with the COVID-19 public health emergency, see the linked bulletin released by the U.S. Department of Health and Human Services’ (HHS) Office of Civil Rights.[1]
Other Privacy Considerations
An employer may receive information on an employee’s coronavirus symptoms or diagnosis for which additional considerations under HIPAA and related state privacy laws may apply. For example, an employee may voluntarily disclose their coronavirus diagnosis to their employer (and many employers are encouraging self-disclosure of a positive test). Additionally, an employer may consider implementing an on-site screening procedure to identify coronavirus symptoms in an effort to protect its workforce.
As a general matter, employers are not “covered entities” or “business associates” subject to HIPAA. But employers that sponsor self-insured health plans are responsible for HIPAA compliance of their plans. And medical information in the hands of an employer could subsequently become PHI regulated by HIPAA if it is disclosed to (or there is otherwise interaction with) a health plan or healthcare provider (e.g., disclosing a positive test to trigger eligibility for benefits that are not otherwise made available to the employee’s class).
Employers must also carefully consider other state and federal privacy requirements before using or disclosing an employee’s medical information (whether or not such information is considered PHI), including but not limited to the Genetic Information Nondiscrimination Act, Americans With Disabilities Act, and the National Labor Relations Act.
Providing Group Healthcare Coverage
The changes below apply only to those employers currently offering group health plans to their employees.
Required COVID-19 Testing Coverage
The Families First Coronavirus Response Act (the Families First Act), enacted March 18, 2020, requires a group health plan and a health insurance issuer offering group or individualized insurance to provide coverage for COVID-19 diagnostic testing. This testing must be provided at no cost to the participant.[2] Testing must include the cost of the test, as well as the cost of the provider, urgent care center, and/or emergency room visits in order to receive testing. The Families First Act indicates that further guidance should be issued to determine implementation of this provision, but the requirement that coverage be provided at no cost to the participant is effective as of the date of enactment.
Impact of COVID-19 Coverage on High Deductible Health Plans
Per IRS Notice 2020-15, a qualified high deductible health plan (HDHP) will not cease to qualify as such if it provides coverage for testing and treatment of COVID-19 before the participant’s payment of the applicable minimum deductible. Accordingly, participants who receive such services will not be rendered ineligible for tax-favored contributions to a health savings account. The IRS will disregard all medical care services received and any items purchased that are associated with COVID-19 testing or treatment for purposes of determining HDHP qualification and HSA eligibility.
Essential Health Benefit Changes
HHS has issued FAQ guidance confirming that certain services related to COVID-19 treatment will be considered an “essential health benefit” or EHB. Under the Patient Protection and Affordable Care Act, EHBs cannot be subject to annual or lifetime limits and the cost of such services must also be included in the calculation of out-of-pocket maximums.
In particular, COVID-19 care that is an EHB includes the following:
- Coverage for the diagnosis and treatment of COVID-19
- Medically necessary isolation and quarantine under the supervision of a medical provider during a hospital admission
COVID-19 care that is not an EHB would cover, for example, quarantine outside of a hospital setting.
Some plans may still require cost-sharing and prior approval for these treatments pending the terms of the plans. The federal government has mandated that cost-sharing be waived for testing, and some states have mandated that prior approval be waived for testing.
Endnotes
[1] HHS also recently released its Limited Waiver of HIPAA Sanctions and Penalties During a Nationwide Public Health Emergency, but self-insured health plans and plan sponsors should note that this waiver applies only to covered hospitals and does not provide relief for improper uses or disclosures made by self-insured health plans.
[2] Prior guidance from the IRS indicated that cost sharing for testing may be permissible under the terms of the plan, however this guidance is now superseded. Diagnostic testing must be provided at no cost to the covered individual.
© 2020 Perkins Coie LLP
