Correct. PHI coming from insurance claims absent a signed HIPAA release for uses related beyond "treatment/medical education, payment, and operations" would be

Correct. PHI coming from insurance claims absent a signed HIPAA release for uses related beyond "treatment/medical education, payment, and operations" would be a HIPAA violation on the part of the insurance company. Employers themselves are not HIPAA-covered entities. Insurers are however.