I agree that each plan can make a business decision to move away from the SS#, but I don't see how that helps you avoid any responsibilities under the privacy rule. You are just creating another identifier that could be used to identify an individual and their health information. If you put your proprietary number on the ID card which then gets matched up against clinical information for billing purposes and all subsequent claims information (EOB's), how is that new identification number not PHI? PHI can be many things beyond SS#. It can be a URL, ISP, etc. I'd consult with your counsel to make sure you aren't making an incorrect assumption that you can avoid certain responsibilities just by not using a SS#.
>>> "Beth Kranda" <[EMAIL PROTECTED]> 02/05/02 12:40PM >>> While I agree with David that the use of an SSN simplifies COB, I have also taken the position of eliminating the SSN as ID number. In the definition of Payment and in section 164.514 on de-identification, the SSN is referenced as an element that is considered PHI. Some have interpreted this to mean it is then protected, and taken that further to imply that, if the ID card has the SSN on it, it is then considered PHI and subject to the same type of protection requirements as the clinical record. Not sure if this is true, but certainly, reporting is easier if you have a unique identifier that is not the SSN with which to tie de-identified information back to a member. As for the HEDIS problem, this simply means your company needs a "person ID" to tie a person's health history together across systems and across enrollment records. While convenient, it is not necessary to use the SSN to accomplish this. This is one of those decisions that needs to be driven by the legal and business issues. My guess is that the "Privacy Act" this patient cited is state based or some other provacy legislation, not HIPAA. Most of the general public is still not aware of HIPAA's rules. All of the Health Plans I have talked to in Indiana are moving away from the SSN. -- M. Beth Kranda Sr. Project Consultant and Privacy Director OASYS t- (317) 614-2139 f- (317) 614-2001 e- [EMAIL PROTECTED] info- www.oasys.com David Blasi wrote: > Don't see this as a HIPAA Privacy Rule requirement. In fact, until > there is an alternative individual identifier, each plan or provider > assigning a proprietary number to identify an individual creates even > more confusion than we currently have. Especially in COB situations. > But, are you in California? California recently passed SB 168 regarding > the use of SS#'s. However, the law does allow use of SS# for "internal > verification or administrative purposes." This is what most plans or > providers use the SS# for anyway. What it will require is for a plan or > provider to take a look at notifications sent or ID cards used. Have > your counsel take a look at this bill or similar bills proposed in other > states. Essentially, you can prepare a response that states you are > permitted to use SS# in certain limited situations, such as eligibility > and claims payment. > > >>> "Waterhouse, Melissa" <[EMAIL PROTECTED]> 02/05/02 09:33AM > >>> > Recently, we have been experiencing resistance from members when we > request > their social security number and the numbers of their dependents. > Several > letters from employees quote The Privacy Act. We are considering not > requiring dependents socials but this could negatively impact HEDIS > numbers > since SSN's are the only way to track continuous enrollment. > > I am wondering if other health plans are also experiencing this and if > they > decided to not require social security numbers or have moved to using > another identifier. > > Thank you, > Melissa Waterhouse > SummaCare Health Plan > > ********************************************************************** > To be removed from this list, go to: > http://snip.wedi.org/unsubscribe.cfm?list=privacy > and enter your email address. > > ********************************************************************** > To be removed from this list, go to: http://snip.wedi.org/unsubscribe.cfm?list=privacy > and enter your email address. CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. ********************************************************************** To be removed from this list, go to: http://snip.wedi.org/unsubscribe.cfm?list=privacy and enter your email address.
