HIPAA Training for Pharmacy Benefit Manager Appeals Teams

Which HIPAA privacy rules apply to PBM appeals teams?

How HIPAA applies depends on the role a pharmacy benefit manager (PBM) performs. A PBM that handles appeals or other claims-administration services for a group health plan may be the plan’s business associate when that work involves protected health information (PHI). A PBM may also be a covered entity for separate functions if it meets HIPAA’s definition of one. The role and the information involved—not the “PBM” label alone—determine which requirements apply.

When a PBM acts as a business associate, its business associate agreement (BAA) should describe the services and permitted uses and disclosures of PHI. The PBM generally may use or disclose PHI only as the agreement permits or as required by law, and must protect the information as required by HIPAA. Review the HHS business associate agreement guidance for the required contract terms and examples.

The HIPAA Privacy Rule also requires covered entities to provide workforce training that is necessary and appropriate for employees’ duties. For appeals staff, training should address the organization’s applicable policies and procedures, including how to handle PHI while reviewing cases, communicating decisions, and sharing appeal information. A PBM’s specific responsibilities may also depend on its BAA and whether it acts as a covered entity for another function.

How should appeals staff limit the use and disclosure of protected health information?

Appeals personnel should use the information reasonably needed to investigate and resolve the specific dispute, and restrict access according to job responsibilities. Depending on the case, that may include the member’s identity and enrollment details, the prescription and claim at issue, relevant plan terms, and clinical information needed to evaluate the appeal. It does not automatically justify access to an entire medical record.

The minimum necessary standard generally requires reasonable efforts to limit PHI used, disclosed, or requested to what is needed for the intended purpose. Covered entities must establish role-based access policies and procedures; for non-routine disclosures, they must use reasonable criteria and review the disclosure individually. Some exceptions apply, including disclosures to the individual and uses or disclosures made pursuant to an authorization. See HHS guidance on the minimum necessary standard.

In practice, staff should verify the recipient before sending case information, use approved systems, avoid including unnecessary clinical details in email or routine reports, and follow the BAA’s rules for communications with the plan, its representatives, and any subcontractors.

What information may PBMs include in reports for group health plans?

A PBM may provide the group health plan with PHI needed to perform contracted plan-administration functions, subject to the BAA and applicable Privacy Rule requirements. Reports for people acting for the group health plan should be limited to those functions and should not be used for employment decisions or for another employee benefit plan.

Take care to distinguish the group health plan from the employer or other organization that sponsors it. The Privacy Rule permits a group health plan to share enrollment or disenrollment information with its plan sponsor. It also permits requested summary health information for specified purposes, such as obtaining premium bids or modifying, amending, or terminating the plan. Summary health information summarizes claims experience and removes the specified individual identifiers, although geographic information may remain aggregated to the five-digit ZIP code level. These disclosures are not a blanket permission to send identifiable appeal files to an employer.

Other PHI disclosures to a plan sponsor for plan administration require conditions that include plan-document restrictions and certification, along with limits on which sponsor personnel may access the information and how they may use it. Consult the HHS summary of the HIPAA Privacy Rule and the plan’s governing documents before preparing reports containing identifiable information.

How should teams investigate and document appeal disputes?

HIPAA does not prescribe a particular investigation template for every PBM appeal. Teams should follow the plan’s claims procedures, the BAA, applicable law, and their organization’s policies. A consistent case record can help staff apply those requirements and show how a dispute was handled.

As an operational practice, document the appeal received and its date, the claim or prescription at issue, the plan terms and relevant information reviewed, any additional records requested or considered, the reviewer and decision, and the communications sent. Record only the PHI needed to support the appeal and store it in authorized systems with access limited to staff who need it for their duties.

For ERISA group health plans, the U.S. Department of Labor’s claims-procedure guidance explains requirements for full and fair review, including consideration of information submitted by the claimant and access to relevant claim records upon request. See the Department of Labor’s group health plan claims procedure guidance.

What must denial notices explain and when should responses be sent?

A denial notice should clearly explain the reason for the adverse benefit determination and identify the applicable plan provisions. Depending on the rules that apply, it must also explain how to appeal, describe relevant review rights, and tell the claimant how to obtain relevant records. When a decision relies on an internal rule, guideline, protocol, or similar criterion, the notice must provide it or explain how the claimant can obtain it. The responsible plan or issuer should ensure the notice meets the applicable requirements; a PBM preparing notices should follow its contract and the plan’s approved procedures.

Deadlines depend on the type of claim, the plan, and the applicable federal and state requirements. For ERISA group health plans, the Department of Labor describes maximum appeal-decision periods of 72 hours for urgent-care appeals, 30 days for pre-service appeals, and 60 days for post-service appeals when the plan provides one appeal level. A plan with two appeal levels may have different maximum periods for each level. These are not universal deadlines for every PBM dispute, so staff should check the governing plan procedures and applicable requirements before calculating a due date.

See the Department of Labor’s claims-procedure guidance for ERISA group health plan rules and the Centers for Medicare & Medicaid Services’ overview of health plan appeals for information about Affordable Care Act appeal protections.

When should appeals personnel complete HIPAA training?

Under the Privacy Rule, a covered entity must train its workforce as necessary and appropriate for employees’ functions. It must train new workforce members within a reasonable period after they join and train affected staff within a reasonable period after a material change to relevant policies or procedures. The covered entity must document that the required training was provided. See the HHS OCR HIPAA Audit Protocol.

For a PBM acting as a business associate, training expectations may also come from its BAA, client requirements, internal policies, or its responsibilities under the Security Rule. The Security Rule requires a security awareness and training program for workforce members, including management, and calls for periodic security updates. The applicable requirements do not establish one universal federal annual schedule for every Privacy Rule training course.

Employers and plans may set annual or more frequent training as an internal policy. Appeals teams should also receive updated instruction when role-specific procedures change, and training records should show what was provided and when. A training completion certificate records participation; it does not by itself establish that the PBM or plan is HIPAA-compliant. See HHS’s summary of the HIPAA Security Rule.

What are the limitations of general training requirements for PBMs?

General HIPAA training cannot replace the policies, procedures, contracts, and safeguards that apply to a particular PBM, client, or group health plan. A broad course may explain the Privacy Rule, but staff also need instructions that match their actual duties, approved systems, escalation processes, and the terms of the applicable BAA and plan procedures.

HIPAA’s training rules also differ by role: the Privacy Rule’s workforce-training provision applies to covered entities, while a PBM acting as a business associate has obligations shaped by the HIPAA provisions that apply directly to business associates, its BAA, and applicable Security Rule requirements. No general training certificate substitutes for those responsibilities, and HIPAA does not impose a universal annual renewal requirement for every PBM appeals employee.

In short, effective preparation combines role-specific training, documented completion, minimum-necessary handling of PHI, and procedures that follow the applicable plan and legal requirements.

FAQs.

How does HIPAA apply to a PBM handling appeals for a group health plan?

A PBM handling appeals for a group health plan may be a business associate if it uses or receives PHI to perform services for the plan. Its BAA and applicable HIPAA requirements govern how it may use, disclose, and safeguard that information. A PBM may also have covered-entity responsibilities for separate functions if it meets HIPAA’s definition of a covered entity.

What PHI may an appeals team use to resolve a dispute?

The team may use PHI reasonably needed to review the appeal, such as relevant enrollment, prescription, claim, plan, and clinical information. Staff should limit access and use to what is appropriate for the appeal’s purpose and follow the applicable BAA and internal policies.

Can a PBM include identifiable health information in reports to a group health plan?

It may provide PHI to the group health plan when the disclosure is permitted by the BAA and needed for plan-administration functions. Disclosing identifiable information to the employer or other plan sponsor is different: that disclosure is subject to specific Privacy Rule conditions and is not generally authorized for employment decisions. Summary health information may be disclosed to the plan sponsor for certain specified purposes if it meets the applicable definition.

How often should PBM appeals personnel receive HIPAA training?

There is no universal federal rule requiring every PBM appeals employee to renew general HIPAA training annually. Covered entities must provide role-appropriate Privacy Rule training to new workforce members within a reasonable period and retrain affected staff after material policy or procedure changes. PBM training schedules may also be set by Security Rule obligations, the BAA, client requirements, and employer policy.