Short answer: Only within HIPAA’s limits. Before the plan gives identifiable health information to the employer, the plan documents must be amended, the employer must certify it will not use the information for employment decisions, and only the employees named in the documents may see it.
A self-funded group health plan is a HIPAA covered entity, separate from the employer in its role as employer. HIPAA lets the plan give the plan sponsor summary health information for getting premium bids or amending the plan, and enrollment information, without more.
For identifiable protected health information, the plan documents must be amended to set permitted uses, and the employer must certify that it will not use or disclose the information for employment-related actions and decisions or for other benefit plans, will bind its agents to the same limits, and will report misuse. The documents must also describe which employees or classes of employees may access the information, creating a firewall.
For most business decisions, such as renewal strategy or vendor review, de-identified or summary reports are enough. No one should pass around identifiable claimant details outside the authorized process.