What is the most efficient and effective way to audit health claims paid for a large self-funded welfare plan that requires an audit due to a VEBA trust? Claims administrators are concerned about the new HIPPA rules and may not offer to share claims information, etc. If claims paid can not be tested, this would cause a report qualification, which would be rejected by the DOL.

The HIPAA privacy regulations permit use and disclosure of protected health information (PHI) for "health care operations." Health care operations is defined as including "Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs[.]"