I read a recent Forbes.com post by Rick Ungar (“Claims That Obamacare Website Violates Health Privacy Reveals Embarrassing Fact – GOP Does Not Understand HIPAA or Obamacare”) that revealed a truly embarrassing fact: very few of us really understand HIPAA, let alone the intricacies of the Affordable Care Act (“ACA” or “Obamacare”) and its interplay with HIPAA. These misunderstandings are prevalent and not limited to any particular political party or viewpoint on the ACA. Even as a lawyer who deals with HIPAA issues on a near-daily basis, I frequently find myself picking and plodding my way through the regulatory definitions and cross-references (both pre- and post-Omnibus rule) to see whether a particular piece of information might enjoy, or be burdened by, HIPAA protections. The ACA merely complicates the picture, adding new layers to the privacy and security regulatory morass.
HIPAA as originally enacted in 1996 was updated by HITECH in 2009 – light years ago, considering the rapid pace of technology development and plethora of changes triggered by the ACA. Perhaps Congress didn’t envision the widespread on-line purchasing of health insurance coverage by individuals when HIPAA and HITECH were enacted, and perhaps the Department of Health and Human Services (“HHS”), the agency responsible for the HIPAA regulations, didn’t envision widespread ACA Website technological glitches when it published rules on the Affordable Insurance Exchanges (“Exchanges”) in 2012 or the HIPAA Omnibus Rules this past January. Still, personal information submitted on an Exchange and sent to a qualified health plan may, in fact, be subject to HIPAA. It doesn’t matter that the Exchange is not itself a health care provider, a health care plan, or a clearinghouse (i.e., a “Covered Entity” under HIPAA), or that individuals are not submitting medical information. HIPAA is big, broad and inclusive and captures lots of little pieces of electronic information in its protective net.
In some ways, HHS side-stepped this issue when it published rules in March of 2012 dealing with the establishment of Exchanges. In response to commenters seeking clarification on whether an Exchange would be subject to HIPAA as a business associate, HHS said that each State would determine the applicability of HIPAA to their Exchange. HHS added “clarifying” language to 45 CFR 155.200 saying that to the extent an Exchange performs “minimum functions” described in the regulation, it would not be acting on behalf of a qualified health plan offering coverage on the Exchange and so would not be subject to HIPAA. These “minimum function” Exchanges are still required to abide by privacy and security requirements set forth in 45 CFR 155.260 (which can be seen as “HIPAA-light” standards), but they are only subject to full-fledged HIPAA requirements if they perform functions other than or in addition to those described in section 155.200. By way of example, HHS says that some States may need to consider whether the Exchange performs eligibility assessments for Medicaid or CHIP.
In short, information submitted to an Exchange may be subject to HIPAA if the Exchange is performing a function on behalf of a qualified health plan that goes beyond the minimum functions required of the Exchanges. For example, the Exchange may be a “Business Associate” under HIPAA, and information it submits to a “Covered Entity” health plans may be “Protected Health Information” or “PHI” under HIPAA. 45 CFR 160.103 contains the relevant series of definitions.
When the series of definitions is properly followed through and applied, it becomes clear that information which identifies an individual (name, address, and social security number will definitely do that!) that is electronically transmitted from the Exchange to a health plan and relates to the future payment for the provision of health care to the individual is protected by HIPAA – if the Exchange is transmitting the information on the health plan’s behalf. The Exchange and the health plan covered entity should have a BAA in place that complies with HIPAA in the post-Omnibus period and clearly identifies the roles and responsibilities of the parties with respect to protecting the privacy and security of the PHI.