Okay. The information is PHI (protected health information) and there are several ways companies can structure information sharing.

The health plan is the entity that is responsible for keeping the information safe. There are people that work on the health plan (a few HR, certain IT folks, etc.) that have to undergo training about keeping the information safe and how and when they can disclose it. They can also be personally liable if the information is disclosed.

The plan can tell an employer about certain information in order to price premiums (typically aggregate information) and even specific information if they need it to structure benefits. However, they can't use the information against you for health plan purposes and they can't do anything to your employment based on the information. The general rule is that employers don't want it. They want the aggregate data (it may also be de-identified which means they remove all ways of linking the data to an individual) there or they have a third party analyze it for them and give them plan design suggestions. They do this because they want to stay away with a 10-foot pole. There is no benefit in knowing who has what condition because they can't use it and just knowing it makes them open to liability for claims if they need to terminate you or take other action (because you can argue that it was because of your health condition, etc.)

The way these programs are structured is that a third party collects the data and then tells payroll when you get a credit. This usually ends up resulting in having to limit premium data to fewer folks and then training them on keeping the information confidential. If they are also announcing that they are not disclosing to the company (without a caveat - "we will not tell your employer" vs. "we only disclose as allowed under HIPAA"), then they are not disclosing. They can't get you to take tests under the guise of confidentiality and then turn around and share the data.

Hope this helps.

Anonymous wrote:Thanks, folks. OP here. I did a little more research and found the website of one of the screening companies. It didn't spell out exactly what they do with the data, but it implied that they give it in aggregate to the company and then the company can use it to better target a wellness program's goals. For example, if they find they have high numbers of a particular condition, they could target interventions for it.

I am still skeptical...and I am really skeptical that our laws are written well enough to cover this sort of thing. Not sure that HIPPA foresaw this when it was written.

I hear ya. I have read about people who paid out of pocket for expensive testing to see if they had genes for cancer because they didn't want their insurance company to know.

Thanks, folks. OP here. I did a little more research and found the website of one of the screening companies. It didn't spell out exactly what they do with the data, but it implied that they give it in aggregate to the company and then the company can use it to better target a wellness program's goals. For example, if they find they have high numbers of a particular condition, they could target interventions for it.

I am still skeptical...and I am really skeptical that our laws are written well enough to cover this sort of thing. Not sure that HIPPA foresaw this when it was written.

Anonymous wrote:Anything that creates a record can be subpeaona'd and/ or compromised via breach/ hack

Just don't get your tits "screened"....or your va-j.j.

Anything that creates a record can be subpeaona'd and/ or compromised via breach/ hack

I am not an HR person but business owner. Our health insurance company does this but the numbers are given to the insurance company, we don't see them.

Anonymous wrote: Call me paranoid, but I don't really trust this. Any insight?

I don't trust them either. we don't do the screenings.

But isn't it true that while they may not share the names, they will disclose conditions (who's been treated for what, etc.)?

I don't know about your company, I'm the HR person at mine and the insurance cos, medical centers, what have you do *not* share any info about you with management.

We must work for the same company...
They said that our health info would not be shared with our employer (protected by HIPAA), and it would not be used to deny coverage, etc.
It would be shared with the health insurance company, but it's not like they don't know already if someone is obese, has type 2 diabetes, high cholesterol, etc just by using the info your physician submits on insurance forms and by prescriptions you get filled.

Doesn't HIPPA protect your information?

My company has started voluntary health screenings where you complete a questionnaire, get a blood draw and then get some basic numbers later in the mail -- cholesterol, etc. In return, you get a one time $150-$200 off your insurance premium (last year it was less, this year it's more because our premiums have increased so they are trying to soften the blow). They tell us the data is confidential and they won't receive our information, but I wonder.

If you are familiar with these programs from the inside, are they really confidential? If it helps, our company is large and self-insured. I am wondering if they are receiving aggregate data and trying to use it to negotiate for better insurance rates, or if they are planning to use it against us individually in some way. Call me paranoid, but I don't really trust this. Any insight?