Healthways and HIPAA

We received letters last year which told us we had fibromyalgia and that Blue Cross had contracted with Healthways to provide support services. We were surprised to be given fibromyalgia by mail, as were many other people. This year we received similar letters which told us that we had other health problems and that CIGNA had contracted with Healthways to provide support services. From what we’ve been able to find out, a number of insurers contract with Healthways to offer support services for various ailments; the insurer periodically sends anonymized claims information to Healthways, Healthways decides what ailments anonymous you might have and tells the insurer, and the insurer un-anonymizes the results and tells Healthways your name, address, phone number, date of birth, and putative ailments. Healthways then contacts you to give you the good news. There are a few problems with this practice:

1. Your health information is supposed to be private. That’s what HIPAA is all about. The insurer is allowed to contract with others (called “business associates”) to perform some of their essential functions, but the support services offered by Healthways do not seem like essential functions, particularly if the patient does not use those services.
2. Your personal data such as date of birth or unlisted telephone number are supposed to be private.
3. The program is opt-out, rather than opt-in. And you can only opt out after your data has been forwarded to Healthways, so all you’re opting out of is harrassing phone calls. You can’t opt out of having your insurer give your personal data and health information to Healthways.
4. Healthways routinely lies about who they are, claiming over the phone that they are part of your insurance company. They aren’t.
5. Healthways refuses to provide a HIPAA notice or a privacy notice upon request.
6. Healthways refuses to remove your personal data from their computers upon request.
7. The insurer’s customer service department initially claims they have never heard of Healthways and would never give your personal information to another company without your permission.
8. The only way to have Healthways remove an erroneous diagnosis from your record is to give them additional medical information.
9. It’s very unclear which way the money flows. Information has value, so Healthways could be paying insurers for access to their subscribers. Services have value, so insurers may be paying Healthways to offer these support services. Healthways claims that the employer’s HR department pays for this program as part of the benefits package, but HR has denied any knowledge of this program (and they usually make sure to mention everything that could conceivably be called a benefit).
10. Oh, and one more thing. It’s really disconcerting to be diagnosed by mail. Especially when it’s a wrong diagnosis.

Perhaps the Office for Civil Rights of the US Department of Health and Human Services can sort some of this out, if I just fill out the correct sort of form.