4 ms·

This is a misleading statement. Corps that offer insurance as a benefit can get reports that tell them how the benefit is being used by employees in the aggrega

This is a misleading statement. Corps that offer insurance as a benefit can get reports that tell them how the benefit is being used by employees in the aggregate. However, corps cannot see each employee interaction as this would be a huge HIPAA violation.

undefined3840 7y ago
They can access individual claims because they themselves are the insurer. Claims have medical codes that map to treatments, diseases, prescriptions, doctor visits, etc. That’s what I mean by visibility.
ohazi 7y ago
This is not what the parent is talking about. "Corps that self insure" is corporations that are so large that it's more effective for them to use a large bank account as the insurance plan for their employees than to buy a corporate policy from an actual health insurance company. Huge companies like SAP or Microsoft or Oracle will do this, even though they may also hire a traditional branded health insurer to "manage" this large-bank-account health plan (i.e. give out cards, negotiate with hospitals, etc.). But the bank account (brokerage account, really) remains in control of the corporation, and the traditional plan premiums are not paid to the health insurance company named on the card. Fees for managing the plan are paid separately. Doctors and hospitals get paid from the corporation's account. This is what the parent means when they say that the corporation has visibility into employees' healthcare usage.
- wmfiv 7y ago
  Just so it's clear to everyone, companies much smaller than SAP or Microsoft self insure. In the United States virtually every employer with more than 500 employees is going to self insure. And while these companies do have access to detailed claim data in theory, in practice access to this data is typically heavily limited a small number of HR or finance employees who are responsible for healthcare accounting and financial management and the data presented is typically restricted to a large claim report within a monthly/quarterly reporting period.
oakmad 7y ago
Unlikely to be a HIPAA violation, pretty standard to get a BAA in place between entities sharing PHI type data. Its spelled out on those HIPAA forms you sign at the providers before they'll see you. "The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule." https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
- rabidonrails 7y ago
  Your quote misses the most important part: >>"Covered entities may disclose protected health information to an entity in its role as a business associate only to help the covered entity carry out its health care functions – not for the business associate’s independent use or purposes, except as needed for the proper management and administration of the business associate." BAA's keep the chain of HIPAA in place but just because a BAA is in place does not allow for violation of privacy.
  - oakmad 7y ago
    Agreed. The key point I was attempting to make is that a BAA allows orgs to share data legally. AFAIK Google hasn't violated any privacy with this project and indeed they would be in violation if they did.

undefined3840 7y ago

They can access individual claims because they themselves are the insurer. Claims have medical codes that map to treatments, diseases, prescriptions, doctor visits, etc. That’s what I mean by visibility.

ohazi 7y ago

This is not what the parent is talking about. "Corps that self insure" is corporations that are so large that it's more effective for them to use a large bank account as the insurance plan for their employees than to buy a corporate policy from an actual health insurance company. Huge companies like SAP or Microsoft or Oracle will do this, even though they may also hire a traditional branded health insurer to "manage" this large-bank-account health plan (i.e. give out cards, negotiate with hospitals, etc.). But the bank account (brokerage account, really) remains in control of the corporation, and the traditional plan premiums are not paid to the health insurance company named on the card. Fees for managing the plan are paid separately. Doctors and hospitals get paid from the corporation's account. This is what the parent means when they say that the corporation has visibility into employees' healthcare usage.

wmfiv 7y ago
Just so it's clear to everyone, companies much smaller than SAP or Microsoft self insure. In the United States virtually every employer with more than 500 employees is going to self insure. And while these companies do have access to detailed claim data in theory, in practice access to this data is typically heavily limited a small number of HR or finance employees who are responsible for healthcare accounting and financial management and the data presented is typically restricted to a large claim report within a monthly/quarterly reporting period.

oakmad 7y ago

Unlikely to be a HIPAA violation, pretty standard to get a BAA in place between entities sharing PHI type data. Its spelled out on those HIPAA forms you sign at the providers before they'll see you. "The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule." https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...

rabidonrails 7y ago
Your quote misses the most important part: >>"Covered entities may disclose protected health information to an entity in its role as a business associate only to help the covered entity carry out its health care functions – not for the business associate’s independent use or purposes, except as needed for the proper management and administration of the business associate." BAA's keep the chain of HIPAA in place but just because a BAA is in place does not allow for violation of privacy.
- oakmad 7y ago
  Agreed. The key point I was attempting to make is that a BAA allows orgs to share data legally. AFAIK Google hasn't violated any privacy with this project and indeed they would be in violation if they did.