If an employer is generally relying on the fully-insured exception to most of HIPAA's privacy requirements and only receiving Summary Health Information and enrollment/disenrollment information, should the employer still be getting Business Associate Agreements with respect to their fully-insured plans if they use a payroll provider or outside service provider for enrollment (e.g., provides web-based enrollment, administration processing, etc.) or a broker that also may receive enrollment/disenrollment or other PHI?

I want to try to simplify this question a bit -- Under the fully-insured exception, the group health plan can still disclose to the plan sponsor enrollment and disenrollment info. Can a payroll service or broker/TPA-type also receive this info, or is a Business Associate Agreement needed?

Is there something that you see in the enrollment/disenrollment info or SHI that would constitute PHI?

I think that, technically speaking, enrollment and disenrollment info and SHI are PHI. (If they weren't PHI, then I don't think the "fully insured exception" would have been necessary.)

The activities you describe appear to be performed on behalf of the employer, not the plan, therefore, no business associate agreement is necessary.

However, you should review the services provided by the broker. I know many brokers offer "value added" services (like customer service activities for enrollees). It is possible that some of these services may be business associate activities.

Steve -- What about an outside payroll service vendor who also is providing a web-based enrollment system; provides the employer with web access to census data, benefit elections, premium history, etc.; makes premium calculations, and interfaces/communicates with a self-insured plan's tpa or an insurance carrier? Would you consider these services to be "value-added" or do they all ultimately relate to the employer's enrollment functions? Thanks for your input.

Why does the broker interface/communicate with the TPA/carrier? If it's for a plan function, there is probably a need for a business associate agreement