Policy

PHI refers to individually identifiable health information received by the college’s group health plans, or by a health care provider, health plan or health care clearinghouse. This information relates to an employee’s past or present health, or to the payment of health care claims. PHI includes medical conditions, health status, claims experience, medical histories, physical examinations, genetic information and evidence of disability. Ensuring the private and confidential use of PHI is the responsibility of all college employees whose job duties require access to it.

St. Norbert College performs health care plan enrollment, changes in enrollment and payroll deduction activities annually, or more frequently if necessary. The college also helps with explanation of benefits issues and in resolving claims problems, and helps coordinate benefits with other providers. Some or all of these activities may require the use or transmission of PHI. Thus, all information related to these processes is maintained in confidence. College employees will not disclose PHI from these processes except as allowed by administrative procedures approved by the HIPAA Compliance Officer.

Full HIPAA Notice

Procedures

PHI disclosures that are not protected include:

• Disclosures to the individual to whom the PHI belongs
• Disclosures to health care providers for treatment or payment
• Disclosures requested by the PHI holder to be made to authorized parties
• Disclosures to government agencies for reporting or enforcement purposes
• Disclosures to workers’ compensation providers and those authorized by workers’ compensation providers

Information regarding whether an employee is covered by a health care plan for claims processing purposes may be disclosed.

Information external to a health plan is not considered PHI if the information is being furnished for claims processing purposes involving workers’ compensation or short- or long-term disability, or to verify Americans with Disabilities Act (ADA) or Family and Medical Leave Act (FMLA) status.

Records Retention
Personnel records and PHI disclosures will be maintained for six years, as required by federal law, unless state law requires a longer retention period. After this time is up, the records will be destroyed in a manner that ensures data privacy, and according to the college’s records-destruction policy.