Summary health information and de-identified data: what an employer can see.
Employers ask carriers for reports to shop coverage or design the plan. HIPAA allows certain reports without authorization, but there are two different standards, summary health information and de-identified data, and they are not the same.
Two different standards.
Summary Health Information
HHS describes it as information that summarizes claims history, claims expenses or types of claims experience for the individuals covered, with all individual identifiers removed other than a five-digit zip code. Plan sponsors often ask for this type of report during a renewal because it shows trends without naming people. Ask the carrier or administrator what a given report contains before sharing it more widely inside the company.
What It Is For
A plan may give it to the sponsor on request to obtain premium bids or to modify, amend or terminate the plan. Employers use it to compare bids and consider plan changes. The report is meant to help with those decisions, not to track individual employees, so keep its use inside that purpose and check with counsel on how it is handled.
Not The Same As De-Identified
HHS notes summary health information need not qualify as de-identified protected health information. The two terms are related but not identical, and each has its own standard. Do not assume a report labeled summary is free of identifying details, and ask counsel to confirm how it should be handled.
The Safe Harbor Method
De-identification by safe harbor requires removing a list of identifiers of the individual and of relatives, employers and household members, including names, small geographic units, all date elements except year, phone numbers, email addresses, Social Security numbers and account numbers.
The two ways to de-identify health information.
The Standard
Information is not individually identifiable if it does not identify an individual and there is no reasonable basis to believe it can be used to identify one. The question is practical: could someone reasonably figure out who the information is about? For a small employer, a short list of conditions or a few high claims might point to a person even without a name.
Expert Determination
A qualified person applies accepted statistical and scientific methods, finds the risk of identifying anyone is very small, and documents the methods and results. This route relies on an outside expert instead of a fixed checklist. It can be useful for unusual data sets, but it takes time and documentation, so ask counsel and the expert how it would apply to your needs.
Safe Harbor
The entity removes 18 listed identifiers for the individual and for relatives, employers and household members, and has no actual knowledge that what remains could identify the person. This is a checklist approach, and every listed item has to be removed or generalized. A single missed field, such as a full date of service or a unique number, can keep the data from qualifying.
The Listed Identifiers
They include names, small geographic areas, dates other than year, contact details, Social Security and medical record numbers, health plan beneficiary numbers, account numbers, device and vehicle identifiers, web addresses, biometrics and full face photographs. Review any data set against the full list, not just the obvious fields like names and Social Security numbers. Smaller details, such as exact dates or vehicle numbers, are easy to overlook in spreadsheets and exports.
Ages Over 89
Ages over 89 and dates that would reveal them are among the date elements that must be removed under the safe harbor. Employers sometimes group older participants into a single category so the data stays useful for analysis. Ask counsel or your data team how age is handled before preparing any file that will be shared outside the plan.
Re-Identification Codes
An entity may attach a code that lets it re-identify the data only if the code is not derived from information about the individual and is not used or disclosed for any other purpose. A code is useful if someone needs to go back and match records, but it has to be kept apart from the data. Do not build it from names, birth dates or other personal details, and limit who can see the key.
Source: 45 CFR 164.514.
Using reports safely.
Ask For The Right Report
For renewal and benchmarking, summary or aggregated reports usually meet the need. Tell the carrier or administrator what the report is for, such as renewal pricing or plan design, and ask them to remove anything not needed. Less detail means less to protect and less risk if a file is forwarded.
Watch Small Groups
In a small group, even a summary can point to one person. Review with that in mind. With only a handful of covered employees, one large claim or one condition can be easy to connect to a person. Consider asking the carrier to combine categories or hold back details when the group is small.
Keep Detail With The Plan
Claims-level reports with identifiers belong with the people who administer the plan. Keep reports with names, dates of service and claim details with the people who run the plan, and not in a general file share. Limit access and use secure delivery whenever those files move between teams or vendors.
Check Plan Documents
Whether the sponsor may receive more than summary information depends on the plan documents and the sponsor’s role. Employers should review the plan documents, the privacy notice and any agreements that describe what the sponsor can receive. If the documents are unclear, ask counsel before requesting more than summary information.
Three questions to settle.
What Does Our Carrier Send
Ask for a sample of every recurring report and what identifiers it contains. List each recurring report, how often it arrives and who gets it. Then check each one for names, dates of birth, member numbers and diagnosis details, and ask the carrier to remove anything that is not needed.
Why Do We Need Detail
Tie each request to a purpose, such as a renewal or a stop-loss submission. Use the answer to decide whether the request is needed and how to describe it. If a summary report would do, ask for that, and keep a record of why a more detailed report was requested.
Who Receives It Internally
List the people who see the reports. Keep the list short, name each person, and note why they need access. Review it once a year and remove anyone whose role has changed, so that sensitive plan data reaches only the people who need it.
Common Questions About Summary And De-Identified Data
Can our carrier give us a claims summary?
HHS says a plan may give the sponsor summary health information to obtain premium bids or to modify or terminate the plan.
Is a five-digit zip code allowed?
In summary health information, yes. For safe harbor de-identification, geographic units smaller than a state are removed with a limited exception for the first three digits of a zip code.
What is the difference between summary and de-identified?
Summary health information has its own definition and need not meet the de-identification standard.
Can the sponsor get more than that?
Only through the routes the rules allow, such as plan documents that permit access for plan administration. Our plan sponsor page explains.
Does a very small group change anything?
Practically yes, since small numbers can identify people. Involve counsel.
Is this legal advice?
No. For your own plan, involve your counsel. We can help you decide what to request.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
Laws and rules referenced
45 C.F.R. § 164.504 — Plan sponsor requirements, business associate contracts and the summary health information definition.
This page is general information, not legal or tax advice. Rules change and facts matter, so confirm your situation with counsel or a qualified advisor.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.