We just had a participant email regarding a hardship request. They claim a medical hardship, but do not wish to provide the medical bills for privacy reasons. The participant claims that HIPPA affords her that right. Anyone ever dealt with this before? I'm not very familiar with HIPPA and this seems like it may have some validity.

For now, we suggested the care be covered/blacked out so that only the amounts remain on a document that is clearly a medical bill/invoice. This practice should offer the protection the participant wants while still providing meaningful documentation to the sponsor/Trustee.

Any thoughts?

The plan has a legitimate need for the information. The plan might be required to have HIPAA privacy and security policies in place, and notices given, but if the employee doesn't want to give up the info, no hardship payout.

As for the blackout, how would you know that the medical services provided were not for a facelift or other cosmetic surgery or procedure, and not be a proper basis for a hardship?

People give HIPAA a lot more credit that it should get. HIPAA's privacy rules apply to covered entities, which include health care providers and group health plans but do not include 401k plans or employers. The plan should be provided the minimum amount of information necessary to determine that the hardship request qualifies and if the employee refuses to provide it, that is her decision.

Insurance "Explanation of Benefits" (EOBs) generally don't have excess detail about diagnoses but do fully substantiate how much of the expense was not reimbursed and is the responsibility of the employee.

My mind goes to two possible directions... the diagnosis is embarassing to the employee (mental health, drug treatment, infertility, etc) or the employee is trying to slide one over on you. As stated above, HIPPA is no excuse for the employee to not provide information to you. But it may require you to protect what you learn... which is exactly what you'd do anyway because as HR/Benefits professionals, we know to maintain the personal information of our employees in a safe and confidential manner. Which is what I'd emphasize to the employee.... "safe and confidential".