HIPAA Training for Health Plan Formulary Exception Teams

Which health plans must comply with HIPAA?

HIPAA applies to a health plan that meets the federal definition of a covered entity. This includes health insurers, HMOs, prescription drug plans, and many employer-sponsored and government health plans. A limited exception applies to a group health plan with fewer than 50 participants that is administered solely by the employer that established and maintains it. The employer and its health plan are also distinct: an employer is not automatically a HIPAA covered entity just because it sponsors a plan. See the HHS Summary of the HIPAA Privacy Rule and HHS guidance for employers sponsoring group health plans.

Formulary exception reviewers may work for a plan or for a vendor performing services on its behalf. When a vendor’s work involves protected health information (PHI), the parties should determine whether the vendor is a business associate and, where required, establish a written business associate arrangement. Apply the organization’s privacy and security policies to the team’s actual role and workflows.

What counts as a formulary exception request?

A formulary exception request asks a plan to cover a drug that is not on its formulary or, in some cases, to waive a utilization management requirement such as step therapy, prior authorization, or a quantity limit. It is different from a request showing that a member meets an existing prior-authorization requirement. The request should be routed and reviewed under the applicable plan’s coverage-determination process.

For Medicare Part D, an exception is a type of coverage determination, and CMS describes these requests as including requests for a non-formulary drug or to waive certain utilization management requirements. Procedures for other plans may differ, so use the governing benefit documents and applicable rules rather than assuming the Part D process applies. See CMS guidance on Part D exceptions.

Who may submit a request and supporting statement?

For Medicare Part D, an enrollee, the enrollee’s representative, or the enrollee’s prescriber may request an exception. The prescriber supplies a supporting statement explaining why the drug is medically necessary. A team should verify the requester’s role and follow the plan’s process for confirming representative authority and obtaining the clinical support needed to evaluate the request.

Do not confuse HIPAA permission to use or disclose PHI with the benefit rules governing who may file a request. HIPAA generally permits a covered entity to use or disclose PHI for payment activities without an individual’s authorization, but applicable plan procedures still determine how a request is submitted and supported. See HHS guidance on treatment, payment, and health care operations.

How should teams handle protected health information during review?

Reviewers handle PHI when they use identifiable member information—such as diagnoses, medication history, or clinical notes—to assess coverage. For payment and health care operations, covered entities must make reasonable efforts to limit PHI use, disclosure, and requests to the minimum necessary for the task. Establish role-based access so staff see information needed for their work, and request only relevant records or details rather than routinely seeking a complete medical record.

The minimum necessary standard is a reasonableness requirement, not a fixed checklist of data fields. HIPAA also makes an exception for disclosures to, or requests by, a health care provider for treatment purposes; that exception does not eliminate the standard for a plan’s own payment review. See HHS guidance on determining the minimum necessary information.

Use approved channels, follow access and authentication procedures, and avoid discussing a case where unauthorized people could hear or see PHI. If a vendor handles PHI for the plan, follow the applicable business associate arrangements and internal procedures for secure exchange and incident reporting.

When is a HIPAA authorization needed to disclose information?

A HIPAA authorization is generally not required when a covered health plan uses or discloses PHI for its own payment activities, which include coverage determinations, claims adjudication, medical-necessity review, and utilization review. A provider’s disclosure of relevant information to a health plan for payment may also be permitted without authorization. A plan should not request an authorization simply because a formulary exception file contains sensitive health information.

An authorization may be needed when a proposed use or disclosure is not otherwise permitted or required by the Privacy Rule—for example, when disclosing PHI to a third party for a purpose outside treatment, payment, or health care operations. A valid authorization identifies the information, the people or organizations involved, the purpose, and an expiration date or event, among other required elements. See HHS’s explanation of consent and authorization.

How does medical necessity affect exception decisions?

HIPAA governs privacy and permitted information handling; it does not decide whether a drug meets a plan’s medical-necessity criteria. Reviewers should apply the coverage rules that govern the specific plan, document the rationale, and use the prescriber’s supporting information in the determination.

For a Medicare Part D formulary exception, the prescriber’s supporting statement must explain why the requested drug is necessary—for example, because covered alternatives would not be as effective or could cause adverse effects, or because a dose restriction or step-therapy alternative would be less effective or could cause adverse effects. A supporting statement does not guarantee approval; the plan makes the determination under the applicable rules. See CMS’s Part D exception criteria and 42 CFR § 423.578.

What privacy and process limitations should teams know?

HIPAA compliance and coverage review are related but separate responsibilities. A privacy-compliant workflow does not replace the need to follow the plan’s benefit terms, applicable federal or state requirements, and required review and appeal procedures. Part D-specific rules, including CMS exception procedures, should not be treated as universal requirements for every commercial or employer plan.

Covered entities must train workforce members on PHI policies and procedures as necessary and appropriate for their functions. Training should reflect the team’s access, disclosures, review responsibilities, and employer-specific policies. HIPAA does not establish a universal annual training-certificate renewal requirement; a completion certificate documents training, not organizational compliance. See HHS’s HIPAA audit protocol on workforce training.

In practice, strong exception handling pairs the correct plan-specific decision process with careful PHI use: confirm who may submit the request, obtain the necessary clinical support, limit access and disclosures appropriately, and document the decision under the rules that apply to the plan.

FAQs

Does HIPAA apply to prescription drug plans?

Generally, yes. Prescription drug plans are health plans and are typically HIPAA covered entities, subject to the limited exceptions that apply to certain plans. See HHS’s list of health plans covered by HIPAA.

Who can request a formulary exception?

For Medicare Part D, the enrollee, the enrollee’s representative, or the prescriber may request an exception. Other plans may have different submission procedures, so check the applicable plan rules. The prescriber’s supporting statement is used to explain the medical-necessity basis for the request.

Can a prescriber provide supporting information verbally?

For Medicare Part D, a prescriber may submit a supporting statement verbally or in writing. A plan may require a written follow-up if the verbal statement does not sufficiently demonstrate medical necessity. Requirements for other plans may differ. See CMS guidance on submitting Part D supporting statements.

When is a HIPAA authorization form used?

An authorization form is used when a covered entity proposes a use or disclosure of PHI that HIPAA does not otherwise permit or require without authorization. It is generally not needed for a health plan’s own payment review or a provider’s permitted disclosure to a plan for payment. The form must meet HIPAA’s requirements for a valid authorization.