HIPAA TPO: when "we can't share that" is wrong

When they say no, think TPO.

Ever heard, “I can’t share that information because of HIPAA”?

This line is often used in the benefits industry as a barrier, preventing plan sponsors from accessing claims data. Whether it’s about aiding someone with a health challenge or improving plan design, this phrase often blocks transparency.

But here’s the truth: it’s mostly bogus.

The next time you hear, “I can’t because of HIPAA,” remember TPO—Treatment, Payment, Operations.

Treatment = Coordinating care between providers or a health plan.
Payment = Health plans processing funds, premiums, and reimbursements.
Operations = Running day-to-day activities like quality assessments, fraud detection, plan management, and customer service.

HIPAA’s own guidance (from the OCR) even says that health plans “may use Protected Health Information to provide customer service to its enrollees.”

So, if you’re hitting a “HIPAA wall,” ask yourself:
• Does TPO allow access to this info?
• Is the right entity asking? (Maybe the plan sponsor needs to inquire instead of the broker.)
• Got your BAA in place?

P.S. This isn’t new—the attached guidance is old enough to buy a drink.

Link to OCR guidance: https://lnkd.in/efsyhuJk