The Commission will provide Protected Health Information to requesting entities as the Commission's Business Associates subject to the HIPAA Privacy Rule after each signs the Commission's Business Associate Agreement (BAA) as specified below. In the event that a Municipal Employer or a Public Employee Committee both request data in the same year, the Commission will supply data for the same time period to both entities.
Municipal Employers and Public Employee Committees that have requested these data will be required to designate a single person to handle these data, and such persons will be required to sign a BAA in which they agree not to share these data with other parties. Before receiving these data, the requesting entities agree to execute a BAA with the Commission in which they agree that only their single designated person shall handle these data, and that these data shall not be shared with anyone other than insurance brokers, benefits consultants, and health plans for the limited purpose of securing bids for the procurement of health insurance.
Requesting entities wanting Medicare HMO data or fully insured retiree dental coverage data should use the monthly premium as a substitute for actual cost. Administrative costs are not included in the data provided.
805 CMR, § 8.06