HIPAA PLAN SPONSOR (EMPLOYER) CERtIfICAtION fORM REgARdINg
Transcript Of HIPAA PLAN SPONSOR (EMPLOYER) CERtIfICAtION fORM REgARdINg
HIPAA PLAN SPONSOR (EMPLOYER) Certification Form Regarding Receipt of PHI
The federal HIPAA privacy and security regulations (Rules) impose specific restrictions on how protected health information (PHI) held by an employer-sponsored health plan (Plan) may be used and disclosed. ___________________, as the Plan Sponsor, is responsible for ensuring that its self-insured or self-funded plans comply with the Rules. For fully insured plans, the Plan Sponsor is responsible to make sure that any PHI it receives is used or disclosed only as allowed by the Rules. AvMed requests that the Plan Sponsor document its HIPAA compliance as follows:
(Initial)
Option 1: (only for Plans that are fully insured): The Plan Sponsor chooses not to receive, nor allow its agents, brokers, or consultants to receive, PHI from AvMed with the exception
of summary health information (subject to employer membership levels with AvMed) and Plan participation information. Any additional PHI may only be obtained by submitting a HIPAA compliant PHI Authorization Release Form completed by the covered individual whose information is being released.
________ Option 2: (available for all Plans): The Plan Sponsor chooses to receive, either directly or (Initial) through agents, brokers, and consultants, PHI and, comply with applicable laws and rules,
including 45 CFR §164.504(f). HIPAA requires that in order for a Plan Sponsor to receive PHI from the Plan, it must first certify that its Plan documents have been amended to incorporate provisions to:
1. Establish the permitted and required uses and disclosures of PHI by the Plan Sponsor, consistent with the Rules;
2. Provide that the Plan will disclose PHI to the Plan Sponsor only upon receipt of a certification by the Plan Sponsor that the Plan documents have been amended to incorporate the following provisions and the Plan Sponsor agrees to:
a. Not use or further disclose the PHI except as allowed by the Plan Documents or as required by law;
b. Ensure that any agents of the Plan Sponsor that receive PHI will comply with the same restrictions and conditions that apply to the Plan Sponsor with respect to such information;
c. Not use or disclose PHI for employment-related actions and decisions or in connection with any other benefit or employee benefit plan of the Plan Sponsor;
d. Report to the Plan any uses or disclosures of PHI of which it becomes aware that are inconsistent with the permissible uses or disclosures;
e. Make available PHI in accordance with the Rules;
f. Make available PHI for amendment and incorporate any amendments to PHI in accordance with the Rules;
g. Make available the information required to provide an accounting of disclosures of PHI as required by the Rules;
continued on reverse side
continued from reverse side
h. Make its internal practices, books, and records related to the use and disclosure of PHI available to the Secretary of the Department of Health and Human Services for purposes of determining the Plan’s compliance with the Rules;
i. If feasible, the Plan Sponsor will return or destroy all PHI received from the Benefit Plan when it is no longer needed; and
j. Ensure that adequate separation between the Plan and the Plan Sponsor is established. In order to provide for this separation, the Plan documents must:
1. Describe the employees or classes of employees or other persons under control of the Plan Sponsor who will be given access to PHI or who receive PHI relating to payment under, health care operations of, or other matters pertaining to the Plan in the ordinary course of business;
2. Restrict access to, and use of, PHI by the Sponsor’s employees and others under the control of the Sponsor consistent with the administrative functions that the Plan Sponsor performs for the Plan; and
3. Provide an effective mechanism for resolving any issues of noncompliance by the Plan Sponsor’s employees and others under control of the Plan Sponsor.
AvMed requests that the Plan Sponsor identify the individuals designated within the Plan with whom AvMed may exchange PHI. If the Plan Sponsor authorizes an agent, broker or consultant to also receive PHI from AvMed, the Plan Sponsor, in addition to the requirements on this form, must also comply with all of the requirements on the attached HIPAA Plan Sponsor/Business Associate Certification Form. The Plan Sponsor represents and warrants that such individuals are authorized to receive PHI and have been trained in their HIPAA obligations under the Rules:
Name or Title of Designated Individual(s)
In accordance with the foregoing, Plan Sponsor hereby certifies that the Plan documents have been appropriately amended to satisfy the HIPAA requirements, and Plan Sponsor represents and warrants that its use and disclosure of Plan PHI is in compliance with the Rules.
Signature Plan Sponsor/Employer Representative:
By:
Print Name:
Title:
Date:
The federal HIPAA privacy and security regulations (Rules) impose specific restrictions on how protected health information (PHI) held by an employer-sponsored health plan (Plan) may be used and disclosed. ___________________, as the Plan Sponsor, is responsible for ensuring that its self-insured or self-funded plans comply with the Rules. For fully insured plans, the Plan Sponsor is responsible to make sure that any PHI it receives is used or disclosed only as allowed by the Rules. AvMed requests that the Plan Sponsor document its HIPAA compliance as follows:
(Initial)
Option 1: (only for Plans that are fully insured): The Plan Sponsor chooses not to receive, nor allow its agents, brokers, or consultants to receive, PHI from AvMed with the exception
of summary health information (subject to employer membership levels with AvMed) and Plan participation information. Any additional PHI may only be obtained by submitting a HIPAA compliant PHI Authorization Release Form completed by the covered individual whose information is being released.
________ Option 2: (available for all Plans): The Plan Sponsor chooses to receive, either directly or (Initial) through agents, brokers, and consultants, PHI and, comply with applicable laws and rules,
including 45 CFR §164.504(f). HIPAA requires that in order for a Plan Sponsor to receive PHI from the Plan, it must first certify that its Plan documents have been amended to incorporate provisions to:
1. Establish the permitted and required uses and disclosures of PHI by the Plan Sponsor, consistent with the Rules;
2. Provide that the Plan will disclose PHI to the Plan Sponsor only upon receipt of a certification by the Plan Sponsor that the Plan documents have been amended to incorporate the following provisions and the Plan Sponsor agrees to:
a. Not use or further disclose the PHI except as allowed by the Plan Documents or as required by law;
b. Ensure that any agents of the Plan Sponsor that receive PHI will comply with the same restrictions and conditions that apply to the Plan Sponsor with respect to such information;
c. Not use or disclose PHI for employment-related actions and decisions or in connection with any other benefit or employee benefit plan of the Plan Sponsor;
d. Report to the Plan any uses or disclosures of PHI of which it becomes aware that are inconsistent with the permissible uses or disclosures;
e. Make available PHI in accordance with the Rules;
f. Make available PHI for amendment and incorporate any amendments to PHI in accordance with the Rules;
g. Make available the information required to provide an accounting of disclosures of PHI as required by the Rules;
continued on reverse side
continued from reverse side
h. Make its internal practices, books, and records related to the use and disclosure of PHI available to the Secretary of the Department of Health and Human Services for purposes of determining the Plan’s compliance with the Rules;
i. If feasible, the Plan Sponsor will return or destroy all PHI received from the Benefit Plan when it is no longer needed; and
j. Ensure that adequate separation between the Plan and the Plan Sponsor is established. In order to provide for this separation, the Plan documents must:
1. Describe the employees or classes of employees or other persons under control of the Plan Sponsor who will be given access to PHI or who receive PHI relating to payment under, health care operations of, or other matters pertaining to the Plan in the ordinary course of business;
2. Restrict access to, and use of, PHI by the Sponsor’s employees and others under the control of the Sponsor consistent with the administrative functions that the Plan Sponsor performs for the Plan; and
3. Provide an effective mechanism for resolving any issues of noncompliance by the Plan Sponsor’s employees and others under control of the Plan Sponsor.
AvMed requests that the Plan Sponsor identify the individuals designated within the Plan with whom AvMed may exchange PHI. If the Plan Sponsor authorizes an agent, broker or consultant to also receive PHI from AvMed, the Plan Sponsor, in addition to the requirements on this form, must also comply with all of the requirements on the attached HIPAA Plan Sponsor/Business Associate Certification Form. The Plan Sponsor represents and warrants that such individuals are authorized to receive PHI and have been trained in their HIPAA obligations under the Rules:
Name or Title of Designated Individual(s)
In accordance with the foregoing, Plan Sponsor hereby certifies that the Plan documents have been appropriately amended to satisfy the HIPAA requirements, and Plan Sponsor represents and warrants that its use and disclosure of Plan PHI is in compliance with the Rules.
Signature Plan Sponsor/Employer Representative:
By:
Print Name:
Title:
Date: