HIPAA Notice

PBS Insurance Underwriting Corporation Protected Health Information Agreement provides satisfactory assurances that PBS Insurance will use the information only for the purposes for which it was engaged.

What does PBS Insurance Protected Health Information Agreement Accomplish?

PBS Insurance Protected Health Information Agreement provides satisfactory assurances that satisfies the requirements of 45 CFR 164.504(e).
Who is a Business Associate?
1. Except as provided in paragraph (B) of this definition, business associate means, with respect to a covered entity, a person who:
  1. On behalf of such covered entity or of an organization health care arrangement in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, performs, or assists in the performance of:
    
    A function or activity involving the use or disclosure of individually identifiable health information, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, practice management, and repricing; or
    
    Any other function or activity regulated by this subchapter; or
  2. Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangements in which the covered entity participates, where the provisions of the service involves the discloser of individually identifiable health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.
2. A covered entity participating in an organized health care arrangement that performs a function or activity as described in paragraph
  1. of this definition for or on behalf of such organized health care arrangements, or that provides a service as described in paragraph
  2. of this definition to or for such organized health care arrangement, does not, simply through the performance of such function or activity or the provision of such service, become a business associate of other covered entities participating in such organized health care arrangement.
3. A covered entity may be a business associate of another covered entity.
A Business Associated Contract is not required when:

Where one covered entity purchases a health plan product or other insurance, for example, reinsurance, from an insurer. Each entity is acting on its own behalf when the covered entity purchases the insurance benefits, and when the covered entity submits a claim to the insurer and the insurer pays the claim.
Is a reinsurer a business associate of a health plan?

Generally, no. A reinsurer does not become a business associate of health plan simply by selling reinsurance policy to a health plan and paying claims under the reinsurance policy. Each entity is acting on its own behalf when the health plan purchases the reinsurance benefits, and when the health plan submits a claim to a reinsurer and the reinsure pays the claim.
Is PBS Insurance a business associate of health plan when it provides stop loss insurance or excess of loss insurance?

No. Stop loss insurance or excess loss insurance are considered health care operations under 164.501 provided that the requirements of 164.514(g) are met.
What is considered Health care operation as it is related to insurance/reinsurance?

164.501 states: “Underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract health insurance or health benefits, and ceding, securing, or placing an contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance), provided that the requirements of 164.514(g) are met, if applicable”.
How does the HIPAA Privacy Rule apply to professional liability insurance? Specifically, how can professional liability insurers continue to arrange for and maintain medical liability insurance for health care providers covered by the rule?

The December 3, 2002 Guidance from the HHS states: “The privacy rule permits a covered health care provider to disclose information for ‘health care operations’ purposes, subject to certain requirements. Disclosures by a covered health care provider to a professional liability insurer or a similar entity for the purpose of obtaining or maintaining medical liability coverage or for the purpose of obtaining benefits from such insurance, including the reporting of adverse events, fall within ‘business management and general administrative activities’ under the definition of ‘health care operations.’ Therefore, a covered health care provider may disclose individual identifiable health information to a professional liability insurer to the same extent as the provider is able to disclose such information for other care operations purposes.
Is an entity that is acting as a third party administrator to a group health plan a covered entity?

No, providing services to or acting on behalf of a health plan does not transform a third party administrator (TPA) into a covered entity. Generally, a TPA of a group health plan would be acting as a business associate. Of course, the TPA may meet the definition of a covered entity bases on its other activities.
Are Business Associates subject to the requirements of the Privacy Rule?

No. The Secretary cannot impose civil monetary penalties on a business associate for breach of its business associate contract with the covered entity, unless the business associate is itself a covered entity. For example, covered entities do not need to ask their business associates to agree to appoint a privacy officer, or develop policies and procedures for use and disclosure of protected health information.