NATIONAL INSURANCE CRIME BUREAU - Laserfiche WebLink

23 Part 9: Health Insurance Portability and Accountability Act of 1996 (HIPAA) 1 . Existing Procedures ISO has reviewed HIPAA; the HIPAA Privacy Rule 45 C.F.R. Part 160 and 164, Subparts A and E; the HIPAA Security Rule 45 C.F.R. Parts 160 and 164, Subparts A and C; and the Health Information Technology for Economic and Clinical Health (HITECH) Act. Those measures do not impose new obligations on the vast majority of ISO ClaimSearch® Participating Organizations. Since 2003, ISO has followed special procedures for claim reports that contain protected health information (PHI) submitted by ISO ClaimSearch Participating Organizations that are covered entities or business associates to covered entities. ISO has implemented administrative, technical, and physical safeguards that “reasonably and appropriately” protect such PHI. Most ISO ClaimSearch customers experience no operational change to their information reporting and receipt procedures because property/casualty insurers are not covered entities under HIPAA and do not submit PHI to the system . Participating Organizations must consult with ISO ClaimSearch before submitting coverage and loss types of HEAL (health) into the ISO ClaimSearch database . Property/casualty insurer disclosures to and use of the ISO ClaimSearch database are not subject to the HIPAA rules . Furthermore, HIPAA does not apply to certain excepted benefits. Certain benefits are always treated as excepted benefits because they are not considered health coverage or part of a health plan. Excepted coverage includes accident and disability income insurance, auto no-fault programs, workers’ compensation, liability coverages, and certain dental and vision plans. The Privacy Rule generally restricts the use and disclosure of PHI by covered entities and their business associates. However, covered entities may disclose PHI to carry out payment and healthcare operations for their own organizations and for other covered entities. Participating Organizations that obtain health information in connection with workers’ compensation activities may provide that information to ISO, and ISO may provide that information to other ISO ClaimSearch members because workers’ compensation is an excepted benefit under HIPAA. ISO considers only the claim reports submitted by healthcare Participating Organizations and their business associates as subject to the Privacy Rule, because these Participating Organizations are considered covered entities and are operating in their role as a covered entity. We then consider the information in the “alleged injury” field (legacy format) and/or the “part of body” and “nature of injury” fields (Universal Format) to be PHI submitted by covered entities to ISO ClaimSearch pursuant to HIPAA’s disclosure restrictions. The HIPAA Privacy Rule affects specific types of insurance and Authorized Users: • Property/casualty insurance, self-insurers, and insurers (including workers’ compensation insurers) are not covered entities and will experience no change to their reporting operations. The injury information those customers report originates from a variety of different sources, including claimants and adjusters, and therefore is not considered PHI. Furthermore, the bene- fits that the property/casualty industry issues are excepted benefits under HIPAA. Also, Privacy Rule 45 C.F.R. Section 164.512 (2013) provides regulatory permission for covered entities Docusign Envelope ID: 329281D2-142C-8B83-837A-7CD218C257C4