Where PHI actually goes
Formal flows — TPA to plan, plan to stop-loss carrier — are usually documented. Informal flows are not: an appeal forwarded to a manager, a claims report saved locally for a budget meeting, a wellness platform sharing biometric results.
- Broker and consultant email containing claim-level detail.
- Stop-loss disclosure packets assembled by internal staff.
- Wellness, EAP, and telehealth vendors without a current BAA.
- Shared drives and inboxes holding appeal documentation.
The plan sponsor firewall
Plan documents must describe who on the employer's staff may access PHI and for what purpose, and the practice has to match the document. Employment decisions and plan administration cannot share a workspace.
Minimum necessary, in practice
Most sponsors request more detail than they need because the report already exists in that format. Ask vendors for de-identified or aggregated reporting by default and treat claim-level access as an exception with a reason.
Want this reviewed against your actual plan?
We'll look at your documents, contracts, and filings and tell you plainly where the exposure sits.