For a group health plan to continue receiving member-specific information from Blue Cross Blue Shield of Michigan (BCBSM), such as monthly claims listings identifying the member and the procedure, the plan sponsor must provide BCBSM with certification that its plan documents have been amended to include the following provisions and that it agrees to:

  • Not use or further disclose protected health information other than as permitted or required by the plan documents or as required by law 
  • Ensure that any subcontractors to whom the plan sponsor provides PHI agree to the same restrictions 
  • Not use or disclose the PHI information for employment-related actions 
  • Report to the group health plan any use or disclosure that is inconsistent with the plan documents or this regulation 
  • Make protected health information accessible to individuals 
  • Allow individuals to amend their information 
  • Provide accounting of its disclosures 
  • Make its practices available to the Secretary of U.S. Health and Human Services for determining compliance 
  • Return and destroy all PHI when no longer needed. If this is not feasible, the PHI must be protected consistent with HIPAA provisions. 
  • Ensure adequate separation between the group health plan and the plan sponsor