2. 2
HIPAA Overview
This training course is designed to equip you with the necessary tools to properly process HIPAA
Privacy Requests. During the two day training period we will:
• Familiarize you with HIPAA, the HIPAA Privacy Rule and various HIPAA Forms
• The effects HIPAA has on Horizon BCBSNJ
• Referring HIPAA Privacy Complaints
• Detailed review of the HIPAA Personal Representative Form
• Understand the different types of Personal Representative
Requests/Representation
• Determine when a form is Valid or Invalid
• Processing Valid and Invalid requests in UCSW
• Processing Valid requests in NMS 2.10 & 2.23 and Nasco
• Processing a verbal Personal Representative Request
• Review various scenarios
• Answer Questions
• Provide a HIPAA Contact List
3. 3
What is HIPAA?
The Health Insurance Portability and Accountability Act
(HIPAA) was enacted by the U.S. Congress in 1996.
The Administrative Simplification provisions of the Health
Insurance Portability and Accountability Act of 1996 (HIPAA,
Title II) required the Department of Health and Human
Services (HHS) to establish national standards for electronic
health care transactions and national identifiers for
providers, health plans, and employers. It also addressed
the security and privacy of health data. As the industry
adopts these standards for the efficiency and effectiveness
of the nation's health care system will improve the use of
electronic data interchange.
4. 4
What is the HIPAA Privacy Rule?
The HIPAA Privacy Rule
establishes national standards to
protect individuals’ medical
records and other personal health
information and applies to health
plans, health care
clearinghouses, and those health
care providers that conduct
certain health care transactions
electronically.
5. 5
What is the HIPAA Privacy Rule?
• The Rule requires appropriate safeguards to protect the
privacy of personal health information, and sets limits and
conditions on the uses and disclosures that may be made of
such information without patient authorization.
• The Rule also gives patients rights over their health
information, including rights to examine and obtain a copy of
their health records, and to request corrections.
6. 6
How does this effect Horizon?
Horizon must treat a personal representative
as the member. That includes a person who
under applicable state law has authority to
make health-related decisions on behalf of
an adult or an emancipated minor. In
addition, the Rules allow disclosures of
private information (PI) to persons who are
involved in the care or payment for the care
of a member.
8. 8
HIPAA Privacy Forms
• Authorization for Disclosure of Protected Health Information
• Request to Access Private Information
• Request for Confidential Communications
• Request for Termination of Confidential Communications
• Request for Personal Representative
• Request to Represent a Deceased Member
• Request to Terminate Personal Representative
• Other HIPAA Forms (Amendment to PI, Accounting of
Disclosures)**
**Refer to New OLI2 for all forms relating to privacy matters**
9. 9
Authorization for Disclosure of PHI *
• The member requests that Horizon
disclose specific PI to someone
other than the member (third-party);
• Someone else (third-party) requests
that Horizon disclose the member’s
PI; or
• Horizon obtains a member’s
permission to disclose his/her PI (in
those circumstances that require an
authorization).
*PHI Protected Health Information
10. 10
Access to Private Information Form
• A member can request
access to his/her PI and
obtain a copy.
• A HIPAA access request is
a member’s right under the
Privacy Rules. It is treated
differently than a “routine”
request for information,
such as a request for a
duplicate copy of an EOB
or SOP.
11. 11
Request for Confidential Communications
• Horizon must approve a member’s
reasonable request to receive PI at
an alternate location, or by
alternative means, IF he/she states
that the disclosure to the normal
location could endanger him/her.
• While Horizon will trigger processing
based on an oral Confidential
Communications request, the
member must complete a written
form as a follow up to his/her oral
request.
• Set up an Alert in UCSW with a
password — this is the only
circumstance where you should set
up passwords.
12. 12
Request for Personal Representative Form
This form is used by our members to
appoint a personal representative.
If a member/individual contacts Member
Services and verbally request the
appointment of a personal
representative, the CSR (Customer
Service Representative) will inform the
member/individual that such a request
must be submitted to Horizon in writing
using the Request for Personal
Representative Form.
If the member states that the request is
urgent, the CSR should also inform the
member that the forms can be accessed
from the Member Portal, and faxed back
to the CSR to be processed.
13. 13
Request to Represent a Deceased Member
• Allows a person to represent a
deceased Horizon member.
• The person needs to attach legal
documentation to prove his/her
authority to represent the member’s
estate. (e.g. Order of Probate, valid
will, appointment as administrator;
not Power of Attorney).
• If the person was already designated
as the member’s Personal
Representative prior to the
member’s death, no new form is
needed. (However, his/her
representation must be changed if
someone with a greater legal right to
represent the deceased notifies us
and requests to represent the
deceased member.)
14. 14
Request to Terminate Personal Representative
• Allows the member to terminate
his/her designated or automatic
personal representative. (e.g.
spouse-to-spouse, parent-to-child)
• By terminating the Personal
Representative, Horizon agrees not
to disclose PI to that person. Thus,
the verification procedure is critical,
since that’s the way we will know not
to disclose PI to that person!
15. 15
Referrals to HIPAA Privacy Team and Privacy Office
All HIPAA Forms received, should be referred as follows:
• Department: HBC Appeals/ HIPAA/ Exec & Reg Complaints
• Team (Choose one of the following): CCU HIPAA Privacy Team Nasco
Escalations should be e-mailed to the following mailbox:
• HIPAA Appeals Unit
***Note: Only Privacy Complaints should be referred to HBC Privacy Team.
Detailed information on how to properly handle a privacy complaint can
be found on New OLI under HIPAA/Privacy/Privacy Procedures/ Receiving
and Handling Privacy Complaints and Violations – HIPAA ***
• Department: HBC Privacy Office
• Team: Privacy Office
• Assigned To: Privacy Office
16. 16
Request for Personal Representative Form
Under the Privacy Rules, Horizon must treat
a personal representative as the member.
That includes a person who under
applicable state law has authority to make
health-related decisions on behalf of an
adult or an emancipated minor. In addition,
the Rules allow disclosures of private
information (PI) to persons who are
involved in the care or payment for the care
of a member. Horizon also treats them as
personal representatives.
Generally, Horizon requires a member to
designate a personal representative in
writing, although it is Horizon’s policy to
treat a spouse or parent on the coverage as
a personal representative without any such
designation.
17. 17
Types of Requests for Personal Representation
• Request for Personal Representative Form
• Request to Represent a Deceased Member
Form
• Request to Terminate Personal
Representative Form
**Refer to New OLI to access current HIPAA Forms**
18. 18
Types Of Representation
• Limited Authority - The member appoints a person who can contact
Horizon and receive the member’s PI.
• Full Authority - The member appoints a person who will receive the
member’s correspondence, EOBs and checks. This requires setup of
an alternate address for the member.
NOTE: Reimbursement checks will, per our contracts, still be made payable in the
name of the subscriber, absent special circumstances.
20. 20
Case Study #1
Mrs. Jones calls and states “I no longer want my husband,
who I am divorcing, to be my Personal Representative.
What is the correct form to send the member?
Answer: A Request to Terminate a Personal
Representative Form
21. 21
Case Study #2
Mr. Lin calls and states he is from an attorney's office and
is seeking records related to a motor vehicle accident
involving our member.
What form should be sent to Mr.Lin?
Answer: An Authorization for Disclosure of Protected
Health Information Form
22. 22
Case Study #3
Ms. McPhee complains that her appeal was denied by Horizon
and that she wants a copy of her records.
What form should be sent to the member?
Answer: A Request to Access to Private Information
Form
23. 23
Case Study #4A
The caller states his grandmother, Mrs. Smith, (for whom he is
the Personal Representative with limited authority) has passed
away and he needs to take care of her affairs, including her
insurance claims with Horizon.
What is the correct form to send caller?
Answer: No form is needed because the caller was the
member’s Personal Representative prior to her death.
24. 24
Case Study #4B
A second caller states she has never called before and she
has been appointed as the Executrix for the same Mrs.
Smith.
What is the correct form to send to caller?
Answer: Yes, but with limited authority.
Answer: Request to Represent a Deceased
Member Form.
Can first caller still represent Mrs. Smith?
25. 25
Case Study #5
Ms. Greer is calling on behalf of her mother. While being
verified, she says that she is the daughter and her mother is
in a nursing home. Her mother wants her to receive all of her
correspondence.
What is the correct form to send to Ms. Greer?
Answer: A Request for Personal Representative Form
26. 26
Case Study #6
Mrs. Williamson states that she is in danger if her husband
discovers that she is going to have an abortion. She does
not want her husband to find out.
What is the correct form to send to Mrs. Williamson?
Answer: A Request for Confidential Communications
Form.
To what address should the form be sent?
Answer: To Mrs. Williamson’s alternate address.
27. Case Study #7
Mary is the mother of Joseph who is a minor child who has his
own single policy. By court order she is the residential
custodial parent. She would like all correspondence sent to her
address although Paul, the father premium payments. What
form does she need to complete?
Answer: A Request for Personal Representative Form
Mary must complete the Request for Personal Representative
Form and appoint herself with full authority so correspondence
can be redirected to her address and supply all legal
documentation.
27
28. Case Study #8
Susan is the parent of a minor child who has a single policy in
which she pays the premium. She would like all
correspondence sent to her address. What form does she
need to complete?
Answer: No form is required due to the Minor Child Verification
Workflow that has been implemented and can be found on
OLI2. As long as the mother can verify the identity of the child
and advises she is the parent/guardian, the child’s PI can be
disclosed to the mother.
http://oli2.bcbsnj.com/Subsystems/HIPAA/Content/Privacy/Privacy_Procedures_HIPAA/
28
29. Case Study # 9
A member calls to advise that received an EOB that does not
belong to them. You document the inappropriate disclosure in
UCSW. Where do you assign this service request?
Answer: Department: HBC Privacy Office
Team: Privacy Office
Assigned To: Privacy Office
The HIPAA Team works closely with the Privacy Office with
investigating privacy complaints and inappropriate disclosures,
however, the function of the HIPAA Team is to process HIPAA
Forms only. All Privacy Complaints should be forwarded to the
Privacy Office for tracking/documenting purposes.
29
30. Case Study # 10
You received a call from an irate member who is seeking to
have their personal representative form escalated. You have
located the service request in UCSW. Who do you contact to
escalate the request?
Answer: All HIPAA Escalations should be e-mailed to the
HIPAA Appeals Unit (HIPAAAppealsUnit@horizonblue.com)
This is a dedicated mailbox which is monitored daily by a
member of the HIPAA Appeals team.
30
