Short answer: The plan document must be amended to limit the employer’s uses, the employer must certify in writing that it agrees, and the document must name which employees may see the information and restrict them to plan administration work.
Before a group health plan (or its carrier) discloses PHI to the employer as plan sponsor, the plan document must include, and the employer must certify that it agrees to, restrictions that include:
- use or disclose the information only as the plan document permits or as law requires;
- never use it for employment-related actions and decisions, or for any other benefit plan;
- make any agents who receive it agree to the same restrictions;
- report improper uses, support individuals’ access, amendment and accounting rights, open its records to HHS, and return or destroy the information when done.
The document must also create “adequate separation” (often called the firewall): it describes the employees or classes of employees who may see PHI, limits them to plan administration functions, and provides a way to deal with noncompliance. For electronic PHI, the plan document must also require the employer to safeguard it.
In practice that means a short named list (for example, the benefits manager and one backup), not the whole HR department, and nothing flowing to supervisors.