Employers make contributions on behalf of their employees to a multiemployer health plan. For tracking purposes, the plan provides to third-party service provider SSNs and certain other info of the participants to document the amounts that been contributed on their behalf.
Does the HIPAA privacy rule protect the transmission of this info even though it pertains only to the fact that contributions have been made for health coverage and does not relate to the actual health condition of the employees? In other words, does information pertaining only to plan funding (and not payment for claims) sufficiently "relate to the payment for the provision of health care to an individual" so as to constitute IIHI? If so, this would require a business associate agreement w/ the service provider, right?