HIPAA
The Health Insurance Portability and Accountability Act, or HIPAA, affects the privacy of your health care information. Select one of the sections below to answer your questions about this important subject.
HIPAA stands for the Health Insurance Portability and Accountability Act. It is a Federal Law that was passed by Congress in 1996. There is a section of HIPAA called the Privacy Rule. The HIPAA Privacy Rule was enacted in order to protect your privacy when it comes to your "protected health information" (also called "PHI"). The HIPAA Privacy Rule went into effect on April 14, 2003. This Privacy Rule gives specific requirements and rules to health insurance organizations (such as the State Health Plan), health care providers and health care clearing houses which they must follow in order to protect your PHI. Please Note: In these FAQs, the State Health Plan will mainly discuss how HIPAA's Privacy Rule affects you in regards to the State Health Plan. The HIPAA Privacy Rule may also affect you in regards to your health care providers. You should talk to your health care providers about how this Rule will affect your relationship with them.
What is "protected health information" or "PHI"?
Protected health information, also called PHI, is (1) any information that can identify you (2) which is used or held by a health insurance organization (such as the State Health Plan) or a health care provider. PHI includes information that may not seem like health information. It includes such information as: your name, address, phone number, date of admission or discharge, date of birth, email address or social security number. Of course, things like your diagnosis or the kind of medication you’re taking is also PHI (if it identifies you). As a result of the HIPAA Privacy Rule, there will be changes in how the State Health Plan is allowed to deal with everyone, including you, your friends and family members, Health Benefit Representatives – everyone.
Back to top
First, the State Health Plan wants to point out that the HIPAA Privacy Rule does not affect your coverage under the State Health Plan. However, as a result of this Rule, the two biggest changes regarding how you deal with the State Health Plan are: (1) the requirement that the State Health Plan receive your written authorization before speaking to someone else about your PHI; and (2) verifying the identity of the person asking for your PHI.
Authorizations:
Generally, the State Health Plan and its claims processor (Blue Cross and Blue Shield of North Carolina) will require written authorization from you before they will discuss your PHI with another person. This written authorization must be on a certain form. Because of an exception to the HIPAA Privacy Rule, the pharmacy benefit manager (Medco) generally will not require your written authorization before it will discuss your PHI with another person. However, the pharmacy benefit manager will ask the caller certain questions to make sure they are involved in your care.
Verification:
The State Health Plan and its claims processor will ask for certain information for verification purposes (i.e. confirm that the person the State Health Plan is talking to is who they say they are).
Back to top
An authorization is when you give another person permission to receive and have access to your PHI. You give this permission by signing an authorization form and submitting it to the State Health Plan.
Can my spouse, my friends or other family members receive my PHI from the State Health Plan or its claims processor (Blue Cross and Blue Shield) without first submitting a written authorization?
Generally, no. In most cases, the State Health Plan and its claims processor will require your written authorization before they will discuss your PHI with another person, including spouses and friends.
I am the parent of a child who is under 18. Can I still find out about his or her PHI?
In most cases, yes. Generally, the HIPAA Privacy Rule allows a parent of a minor child to continue to receive this child’s PHI.
I have a child over the age of 18 who is covered through me (I am responsible for their dependent coverage). Can I still receive this child's PHI?
Only in certain situations. If you are the State Employee, Teacher or Retiree member responsible for the coverage, you may receive payment information regarding this child without an authorization. This includes how much is left to meet your deductible or out of pocket expenses. However, you will need an authorization to receive all non-payment PHI regarding your adult child (a child who is over the age of 18).
Can the Health Benefit Representative (“HBR”) at my office receive my PHI without my authorization?
For the most part, Health Benefit Representatives cannot receive your PHI unless you given them authorization. Without your authorization, an HBR will not be able to do such things as check the status of your claim or an appeal. Without an authorization, the HBR is limited to receiving information regarding enrollment or eligibility (as a part of their duties as an HBR).
I have dependent coverage. Can I still receive payment information without an authorization?
Yes. If you have dependent coverage, you may receive payment information without an authorization. This includes how much is left to meet your deductible and out of pocket expenses. To receive non-payment PHI, you will need an authorization.
Can my dependents receive my PHI or other dependents' PHI without an authorization?
Generally, no. Your dependents cannot receive PHI about you or other dependents, including payment information, without an authorization. However, in most cases the parent (who is a dependent) of a minor child can receive the minor child’s PHI. See the FAQ regarding minor children above.
After I go to the doctor, will the doctor or the State Health Plan need my authorization before the Plan will pay my doctor's bill?
No. The State Health Plan will not need your authorization to pay your claims.
Back to top
No. Use a separate form for each person you would like to authorize to receive your PHI.
Can I authorize an entity rather than an individual to receive my PHI?
Yes. You may authorize a company, an organization, or a department within an organization etc. to receive your PHI.
Back to top
Yes. You need to submit a new authorization on the form provided by the State Health Plan. You can download an authorization form from the State Health Plan’s Web site. Or, you may call the customer service hotline and request that a copy be mailed to you. PPO plan members should call 1-888-234-2416. To request an authorization for the former Indemnity plan, please call 1-800-422-4658.
Do I have to use the authorization form provided by the State Health Plan?
The State Health Plan recommends that you use this form. Your authorization must meet certain requirements under the HIPAA Privacy Rule. The Plan has included these requirements in its. If you do not use this, the Plan may not be able to accept it.
Back to top
You can download the authorization form from the State Health Plan Web site. Or you may call the customer service hotline and request that a copy be mailed to you. PPO plan members should call 1-888-234-2416. Former Indemnity plan members needing an authorization form should call 1-800-422-2658.
Whom do I send the form to?
First, read the authorization form carefully and fill out the entire form. If the entire form is not filled out, the State Health Plan may not be able to accept it (in other words, the State Health Plan won’t be able to give your PHI to the person you are authorizing). PPO plan members should send their form to:
NC State Health Plan
c/o BCBSNC Appeals Department
PO Box 30055
Durham, NC 27702-3055
Former Indemnity Plan members should send their form to:
Attn: HIPAA Privacy Officer
NC State Health Plan and NC Health Choice
PO Box 30111
Durham, NC 27702-3111
If authorization is received with wrong or incomplete information, will I be notified?
Yes. The State Health Plan will send a letter to you stating the information was wrong or incomplete. To avoid this, please read the authorization form carefully and fill out the entire form.
Can the authorization form be sent with electronic enrollment?
No. Enrollment forms and Authorization forms must be sent separately.
Back to top
Powers of Attorney
If I already have a valid power of attorney on file, do I need to send in another one?
No. As long as the power of attorney is legally valid, the State Health Plan and its claims processor will disclose PHI consistent with this power of attorney.
Back to top
Yes. If you call about your own PHI, the State Health Plan will ask you for certain verification information. This process will be similar to when you call your credit card company.
When the people I authorize call the State Health Plan or its or its claims processor (Blue Cross and Blue Shield of North Carolina) will they ask for certain information to verify their identity (i.e. make sure they are who they say they are)?
Yes. In order to verify their identity, the State Health Plan and its claims processor will ask authorized persons certain questions. These questions will regard information contained in the written authorization form you submitted. If you choose, you may give a copy of this authorization form to the authorized person, so that they have this information on hand when they call us.
Back to top
No. Assisting with claims or an appeal is not a part of an HBR's duties. You are not required to give an HBR, or anyone else, authorization to receive your PHI. This will not affect any of your rights under the State Health Plan, including your coverage or your right to make a claim or appeal. You may, of course, choose to give an HBR authorization to assist with your claims or an appeal.
Back to top
Note: The information contained in these Frequently Asked Questions does not include all the benefits or everything you need to know about the State Health Plan. Please check your Benefit Booklet for further details. For more information click on the appropriate Benefits Book for your health plan: PPO Basic , PPO Standard , PPO Plus . We encourage you to call if you have questions about any of your health plan benefits. For the contact information, consult our Contact Us page.
- HIPAA and the Privacy Rule, Generally
- How Does HIPAA Affect Me? New Procedures With the State Health Plan
- When Do I Need a Written Authorization?
- Authorizing More Than One Person or an Entity
- Old Authorizations and Non-HIPAA Authorizations
- How to Get an Authorization Form and Submit it to the Plan
- Powers of Attorney
- Verification: Information You Will Need When Calling the Plan
- No Requirement to Give Health Benefit Representatives Authorization
HIPAA and the Privacy Rule, Generally
What is the HIPAA Privacy Rule? What does it protect?HIPAA stands for the Health Insurance Portability and Accountability Act. It is a Federal Law that was passed by Congress in 1996. There is a section of HIPAA called the Privacy Rule. The HIPAA Privacy Rule was enacted in order to protect your privacy when it comes to your "protected health information" (also called "PHI"). The HIPAA Privacy Rule went into effect on April 14, 2003. This Privacy Rule gives specific requirements and rules to health insurance organizations (such as the State Health Plan), health care providers and health care clearing houses which they must follow in order to protect your PHI. Please Note: In these FAQs, the State Health Plan will mainly discuss how HIPAA's Privacy Rule affects you in regards to the State Health Plan. The HIPAA Privacy Rule may also affect you in regards to your health care providers. You should talk to your health care providers about how this Rule will affect your relationship with them.
What is "protected health information" or "PHI"?
Protected health information, also called PHI, is (1) any information that can identify you (2) which is used or held by a health insurance organization (such as the State Health Plan) or a health care provider. PHI includes information that may not seem like health information. It includes such information as: your name, address, phone number, date of admission or discharge, date of birth, email address or social security number. Of course, things like your diagnosis or the kind of medication you’re taking is also PHI (if it identifies you). As a result of the HIPAA Privacy Rule, there will be changes in how the State Health Plan is allowed to deal with everyone, including you, your friends and family members, Health Benefit Representatives – everyone.
Back to top
How Does HIPAA Affect Me? New Procedures with the State Health Plan
How does the HIPAA Privacy Rule affect me and how I deal with the State Health Plan and its claims processor (Blue Cross and Blue Shield)?First, the State Health Plan wants to point out that the HIPAA Privacy Rule does not affect your coverage under the State Health Plan. However, as a result of this Rule, the two biggest changes regarding how you deal with the State Health Plan are: (1) the requirement that the State Health Plan receive your written authorization before speaking to someone else about your PHI; and (2) verifying the identity of the person asking for your PHI.
Authorizations:
Generally, the State Health Plan and its claims processor (Blue Cross and Blue Shield of North Carolina) will require written authorization from you before they will discuss your PHI with another person. This written authorization must be on a certain form. Because of an exception to the HIPAA Privacy Rule, the pharmacy benefit manager (Medco) generally will not require your written authorization before it will discuss your PHI with another person. However, the pharmacy benefit manager will ask the caller certain questions to make sure they are involved in your care.
Verification:
The State Health Plan and its claims processor will ask for certain information for verification purposes (i.e. confirm that the person the State Health Plan is talking to is who they say they are).
Back to top
When Do I Need a Written Authorization?
What is an authorization?An authorization is when you give another person permission to receive and have access to your PHI. You give this permission by signing an authorization form and submitting it to the State Health Plan.
Can my spouse, my friends or other family members receive my PHI from the State Health Plan or its claims processor (Blue Cross and Blue Shield) without first submitting a written authorization?
Generally, no. In most cases, the State Health Plan and its claims processor will require your written authorization before they will discuss your PHI with another person, including spouses and friends.
I am the parent of a child who is under 18. Can I still find out about his or her PHI?
In most cases, yes. Generally, the HIPAA Privacy Rule allows a parent of a minor child to continue to receive this child’s PHI.
I have a child over the age of 18 who is covered through me (I am responsible for their dependent coverage). Can I still receive this child's PHI?
Only in certain situations. If you are the State Employee, Teacher or Retiree member responsible for the coverage, you may receive payment information regarding this child without an authorization. This includes how much is left to meet your deductible or out of pocket expenses. However, you will need an authorization to receive all non-payment PHI regarding your adult child (a child who is over the age of 18).
Can the Health Benefit Representative (“HBR”) at my office receive my PHI without my authorization?
For the most part, Health Benefit Representatives cannot receive your PHI unless you given them authorization. Without your authorization, an HBR will not be able to do such things as check the status of your claim or an appeal. Without an authorization, the HBR is limited to receiving information regarding enrollment or eligibility (as a part of their duties as an HBR).
I have dependent coverage. Can I still receive payment information without an authorization?
Yes. If you have dependent coverage, you may receive payment information without an authorization. This includes how much is left to meet your deductible and out of pocket expenses. To receive non-payment PHI, you will need an authorization.
Can my dependents receive my PHI or other dependents' PHI without an authorization?
Generally, no. Your dependents cannot receive PHI about you or other dependents, including payment information, without an authorization. However, in most cases the parent (who is a dependent) of a minor child can receive the minor child’s PHI. See the FAQ regarding minor children above.
After I go to the doctor, will the doctor or the State Health Plan need my authorization before the Plan will pay my doctor's bill?
No. The State Health Plan will not need your authorization to pay your claims.
Back to top
Authorizing More Than One Person or an Entity
I want to authorize more than one person to receive my PHI, should I put all of them on one authorization form?No. Use a separate form for each person you would like to authorize to receive your PHI.
Can I authorize an entity rather than an individual to receive my PHI?
Yes. You may authorize a company, an organization, or a department within an organization etc. to receive your PHI.
Back to top
Old Authorizations and Non-HIPAA Authorizations
I have previously given a written authorization to the State Health Plan and its claims processor (Blue Cross and Blue Shield). This authorization was not on the new form provided by the State Health Plan. Do I need to submit a new one?Yes. You need to submit a new authorization on the form provided by the State Health Plan. You can download an authorization form from the State Health Plan’s Web site. Or, you may call the customer service hotline and request that a copy be mailed to you. PPO plan members should call 1-888-234-2416. To request an authorization for the former Indemnity plan, please call 1-800-422-4658.
Do I have to use the authorization form provided by the State Health Plan?
The State Health Plan recommends that you use this form. Your authorization must meet certain requirements under the HIPAA Privacy Rule. The Plan has included these requirements in its. If you do not use this, the Plan may not be able to accept it.
Back to top
How to Get an Authorization Form and Submit it to the Plan
How can I get an authorization form?You can download the authorization form from the State Health Plan Web site. Or you may call the customer service hotline and request that a copy be mailed to you. PPO plan members should call 1-888-234-2416. Former Indemnity plan members needing an authorization form should call 1-800-422-2658.
Whom do I send the form to?
First, read the authorization form carefully and fill out the entire form. If the entire form is not filled out, the State Health Plan may not be able to accept it (in other words, the State Health Plan won’t be able to give your PHI to the person you are authorizing). PPO plan members should send their form to:
NC State Health Plan
c/o BCBSNC Appeals Department
PO Box 30055
Durham, NC 27702-3055
Former Indemnity Plan members should send their form to:
Attn: HIPAA Privacy Officer
NC State Health Plan and NC Health Choice
PO Box 30111
Durham, NC 27702-3111
If authorization is received with wrong or incomplete information, will I be notified?
Yes. The State Health Plan will send a letter to you stating the information was wrong or incomplete. To avoid this, please read the authorization form carefully and fill out the entire form.
Can the authorization form be sent with electronic enrollment?
No. Enrollment forms and Authorization forms must be sent separately.
Back to top
Powers of Attorney
If I already have a valid power of attorney on file, do I need to send in another one?No. As long as the power of attorney is legally valid, the State Health Plan and its claims processor will disclose PHI consistent with this power of attorney.
Back to top
Verification: Information You Will Need When Calling the Plan
When I call the State Health Plan or its claims processor (Blue Cross and Blue Shield) will they ask for certain information to verify my identity (i.e. make sure I am who I say I am)?Yes. If you call about your own PHI, the State Health Plan will ask you for certain verification information. This process will be similar to when you call your credit card company.
When the people I authorize call the State Health Plan or its or its claims processor (Blue Cross and Blue Shield of North Carolina) will they ask for certain information to verify their identity (i.e. make sure they are who they say they are)?
Yes. In order to verify their identity, the State Health Plan and its claims processor will ask authorized persons certain questions. These questions will regard information contained in the written authorization form you submitted. If you choose, you may give a copy of this authorization form to the authorized person, so that they have this information on hand when they call us.
Back to top
No Requirement to Give Health Benefit Representatives Authorization
If I decide not to give the Health Benefit Representative ("HBR") authorization to receive my PHI, will this affect my coverage or my rights to make a claim or an appeal?No. Assisting with claims or an appeal is not a part of an HBR's duties. You are not required to give an HBR, or anyone else, authorization to receive your PHI. This will not affect any of your rights under the State Health Plan, including your coverage or your right to make a claim or appeal. You may, of course, choose to give an HBR authorization to assist with your claims or an appeal.
Back to top
Note: The information contained in these Frequently Asked Questions does not include all the benefits or everything you need to know about the State Health Plan. Please check your Benefit Booklet for further details. For more information click on the appropriate Benefits Book for your health plan: PPO Basic , PPO Standard , PPO Plus . We encourage you to call if you have questions about any of your health plan benefits. For the contact information, consult our Contact Us page.
