CurrentBaylor Scott & White Health PlanPolicy SWHP CO.064

Member Confidentiality

This policy governs protection, use, disclosure, and internal handling of Members' protected health information (PHI) for Scott & White Health Plan employees, vendors, and plan sponsors. It sets confidentiality practices, access controls, breach response, member notices, and plan sponsor certification requirements.

Policy Summary

PayerBaylor Scott & White Health Plan

PolicyMember Confidentiality

Policy CodePolicy SWHP CO.064

Change TypeNo material change

Effective Date

Next Review Date

Key ActionDo not release identifiable PHI except for treatment, payment, or health care operations without the Member's written authorization or specific legal authority.

SourceLink

POLICY UPDATE CHANGES

No material clinical or coverage changes in this revision.

10+internal protection steps for PHI

9plan sponsor obligations

Yesencryption required

Enrollment + Annualmember notices

PHI Use, Protection, and Disclosure Criteria

Trek Health ingests and normalizes Transparency in Coverage data and payer policy updates to give provider organizations a clear view of how commercial reimbursement behaves across markets, payers, and services. Our platform transforms raw payer disclosures into structured intelligence that supports contract evaluation, payer negotiations, and service line strategy. By combining market benchmarks with ongoing policy visibility, Trek helps teams identify variability, risk, and opportunity in commercial reimbursement. The result is faster insight, stronger negotiating positions, and more informed financial decisions.

PHI Use, Protection, and Disclosure Criteria

Covered when ALL of the following rules for use, protection, and disclosure of Protected Health Information (PHI) are met:

ALL of the following

Scott & White Health Plan (SWHP) protects the confidentiality of Members' medical information and records in accordance with federal and state statutes.
policy statement
This policy applies to all SWHP employees and vendors who access Member PHI.

ALL of the following

ONE of: PHI may be used for treatment, payment, or health care operations.
INCLUDES: Uses include, but are not limited to: coordination of care (utilization management, case management), quality assessment and measurement (including member surveys), accreditation, billing, and research.

ALL of the following

Employees must not release identifiable information obtained from medical records or other sources for any purpose other than treatment, payment, or health care operations without the Member's expressed written authorization or specific legal authority.
ALL of the following
- Encrypt laptops and smartphones used to store or transmit PHI.
- Use password-protected screensavers on workstations; assign unique workstation identifiers to support access auditing.
- Do not transfer sensitive information to portable storage devices (e.g., USB drives, disks, CDs).
- E-mails containing sensitive information must be encrypted.

ALL of the following

Disclosures identified via reports, hotline, or audits must be reported and appropriate notifications made to the Compliance Officer (and Privacy Officer as required) and to involved Covered Entities or Business Associates; determine and apply required employment actions and legal notifications.

ALL of the following

Require written Plan Sponsor certification of HIPAA compliance (Attachment A) before releasing PHI to a Plan Sponsor, and ensure the Plan Sponsor agrees to restrictions including prohibition on employment‑related uses, requiring agents/subcontractors to comply, notifying SWHP of inconsistent uses, providing member access and accounting support, and procedures for return or destruction of PHI.
EXCEPTIONS: Exceptions to the Plan Sponsor certification requirement include products managed by third‑party administrators, government‑sponsored products (e.g., Medicare), and delegated services as specified in the policy.

ALL of the following

Provide Notice of Privacy Practices to Members at enrollment and annually; post confidentiality policies on the website and make copies available via Customer Service upon request.

Permitted PHI Uses (Code Reference)

Permitted PHI Usesmixed

List of permitted uses: treatment, coordination of care (utilization management/case management), quality assessment and measurement (including member surveys), accreditation, billing, research; personal information may be transmitted outside SWHP for these purposes; aggregated de-identified data not subject to privacy restrictions.

Permitted PHI Use — Treatmentmixed

Treatment

Use of personal health information for treatment.

Permitted PHI Use — Coordination of Caremixed

Coordination of Care

Coordination of care (Utilization Management, Case Management).

Permitted PHI Use — Quality Assessmentmixed

Quality Assessment

Quality assessment and measurement, including surveys of Members.

Permitted PHI Use — Accreditationmixed

Accreditation

Accreditation-related uses.

Permitted PHI Use — Billingmixed

Billing

Billing.

Permitted PHI Use — Researchmixed

Research

Research.

Release, Authorization, and Plan Sponsor Requests

Documentation Required

Release and Authorization Rules

SWHP staff must not release identifiable Member information obtained from medical records or other sources for any purpose other than treatment, payment, or health care operations without the Member's expressed written authorization or specific legal authority. SWHP maintains physical and electronic safeguards (secure facility access, media/device controls, workstation protections, and role-based access) and has procedures to identify, report, and act on impermissible uses or disclosures of sensitive information.

Only Treatment, Payment, and Health Care Operations (TPO) disclosures allowed without Member authorization.
All other releases require the Member's expressed written authorization or specific legal authority.

Note

Plan Sponsor PHI Requests

When SWHP receives a request for Protected Health Information (PHI) from a Plan Sponsor, SWHP will request written certification (Plan Sponsor Certification of HIPAA Compliance). No PHI shall be shared with the plan sponsor until the required written certification is obtained. Exceptions where certification is not required include: products managed by third‑party administrators, products sponsored by state or federal government (e.g., Medicare/Medicaid), and services that the organization delegates to other entities. The certification must confirm that the plan documents comply with 45 C.F.R. §164.504(f)(2) and that the Plan Sponsor will safeguard and limit use/disclosure of PHI to plan administration functions, ensure subcontractors/agents agree to the same restrictions, prohibit use of PHI for employment or benefit decisions, notify SWHP of inconsistent uses/disclosures, permit access to amend PHI as required, provide information for accountings of disclosures, identify sponsor staff with PHI access, include procedures for return/destruction/restriction of PHI, and include provisions for action if staff inappropriately use or disclose PHI.

Obtain written Plan Sponsor Certification before sharing PHI.
Exceptions: third‑party administrator products; state/federal sponsored products (e.g., Medicare/Medicaid); delegated services.
Certification must include required provisions per 45 C.F.R. §164.504(f)(2) and commitments listed in policy (e.g., limit use, safeguard PHI, prohibit employment use, notify SWHP of inconsistent disclosures).

Defined Terms

Protected Health Information (PHI)

DefinitionProtected Health Information (PHI): subset of health information, including demographic information collected from an individual that either (1) identifies the individual or (2) there is a reasonable basis to believe the information can be used to identify the individual; PHI includes information transmitted by electronic media or maintained in any other form or medium (e.g., medical records, claims, benefits, and other administrative data).

Forms CoveredIncludes PHI transmitted by electronic media or transmitted or maintained in any other form or medium, such as medical records, claims, benefits, and other administrative data.

Identifiability CriteriaIdentifies the individual explicitly or, implicitly, there is a reasonable basis to believe the information could be used to identify the individual.

Plan Sponsor

DefinitionPlan Sponsor: the employer, employee organization, association, committee, joint board of trustees, or other similar group of representatives of the parties who establish or maintain the plan.

RoleEntity that establishes or maintains the group health plan on behalf of employees or members.

ExamplesEmployer, employee organization, association, committee, joint board of trustees, or similar representative group.