Short answer: The employer can get summary, de-identified claims information to get premium bids or to change or end the plan, and contracts cannot block the plan’s access to de-identified claims data. Names and other identifying details are not part of that summary information.
Under the HIPAA privacy rule, a group health plan or its insurer may give the plan sponsor summary health information when the sponsor asks for it to obtain premium bids or to modify, amend or terminate the plan. Summary health information summarizes claims history, claims expenses or types of claims, with the HIPAA identifiers removed (geography may be kept at the five-digit zip code level). The plan may also tell the employer who is enrolled or has disenrolled.
Getting identifiable health information for other purposes requires the plan document to be amended with specific HIPAA protections, and even then it cannot be used for employment decisions.
Separately, the Consolidated Appropriations Act, 2021 bars a group health plan or insurer from agreeing to contract terms that stop it from electronically accessing de-identified claims and encounter data for each participant, on request. Plans file an annual attestation that their contracts comply.
Texas goes further for insured plans. Under Insurance Code 1215.003, once the employer certifies that its plan documents meet the HIPAA plan-sponsor rules in 45 CFR 164.504(f)(2), the carrier’s claims report must include each person whose paid claims topped $15,000 in the past 12 months, listed by a code rather than a name, with amounts paid, dates of service and procedure and diagnosis codes.
Practical advice: treat a large claimant report as confidential, keep it with the people who need it for the renewal, and do not try to work out who the claimants are.