Short answer: Summary health information (claims history and costs with names and most identifiers removed), but only to get premium bids or to change or end the plan, plus enrollment and disenrollment information. Anything more needs a plan amendment and certification.
Without amending the plan document, a group health plan or its carrier may give the employer:
- Summary health information: a summary of claims history, claims expenses or types of claims, with the identifiers listed in HIPAA’s de-identification rule removed (geography may stay at the five-digit zip code level). It may be shared only when the employer asks for it to obtain premium bids or to modify, amend or terminate the plan.
- Enrollment information: whether someone is participating in the plan, or has enrolled in or disenrolled from a carrier’s coverage.
Summary health information can still identify people in a small employer (a single large claim is easy to attribute), so treat it as sensitive. A report naming individual claimants or diagnoses is PHI, and the employer may receive it only after the plan document is amended and the employer certifies the restrictions.