HIPAA guidelines say employers that sponsor employee group health plans must maintain privacy of which __________________ in secured locations, if kept in the office?

Question

Options

• AInformation related to lawsuits again employers
• BEnrollment and claim information
• CWorkman's Compensation claims
• DDeidentified information

• A
  3% (2)
• B
  89% (59)
• C
  2% (1)
• D
  6% (4)

Explanation

Enrollment and claim information (B) is correct because HIPAA's Privacy Rule specifically governs Protected Health Information (PHI) within group health plans, which includes enrollment records (who is covered, dependent info) and claims data (diagnoses, treatments, costs) - all of which can identify individuals and their health status.

• A is wrong because lawsuit information against employers falls under employment law and litigation records, not HIPAA's health privacy scope.
• C is wrong because Workers' Compensation claims are governed by separate state Workers' Comp laws, and HIPAA explicitly carves them out from its standard protections.
• D is wrong because de-identified information, by definition, has had all personal identifiers removed - HIPAA's protections do not apply to it, so there is no requirement to secure it under HIPAA.

Memory tip: Think "HIPAA protects what the health plan knows about you" - enrollment (are you in the plan?) and claims (what care did you get?) are the two core data types a group health plan holds that can reveal someone's identity and health condition, making them the bulls-eye of HIPAA's privacy requirements.

No community discussion yet for this question.