The end of the COVID-19 public health emergency (PHE) has pushed government benefit programs to reassess the use of their data that will ultimately improve access to health care benefits and streamline their processes to provide health and social services. With the end of pandemic-era policies like continuous enrollment, beneficiaries have been losing coverage while states face challenges reviewing Medicaid eligibility and may benefit from data sharing across government programs. Prior to the end of the PHE, KFF estimated that between 8 million and 24 million beneficiaries would be disenrolled. As of August 23, close to 5.4 million Medicaid beneficiaries have been disenrolled; and 74% of disenrollees have had their coverage terminated due to procedural reasons (e.g. changed addresses, did not receive a form, or did not have enough information about the renewal process).[i] This means that individuals are disenrolled because they did not complete the renewal process within a specific time frame or the state has outdated contact information.

To address these issues, the Department of Health and Human Services (HHS) announced new Medicaid redetermination flexibilities to avoid tremendous coverage loss. On June 12, 2023, HHS Secretary Becerra released a letter announcing new Medicaid redetermination flexibilities to further avoid tremendous coverage loss. These flexibilities include: (1) allowing managed care plans to assist Medicaid beneficiaries to complete their renewal form including completing certain parts of the form on their behalf; (2) allowing states to delay plan termination for one month while they conduct additional outreach; and (3) allowing pharmacies and community-based organizations to reinstate coverage for beneficiaries who were disenrolled due to procedural reasons. As of August 15, 11 states paused their Medicaid terminations to conduct additional outreach. Becerra also encouraged states to work with local governments and more community-based organizations to help people understand the Medicaid and CHIP eligibility and renewal process. He adamantly stated that, “Nobody who is eligible for Medicaid or the Children’s Health Insurance Program should lose coverage simply because they changed addresses, didn’t receive a form, or didn’t have enough information about the renewal process.”

Since HHS is expecting state Medicaid agencies to work with health plans, community organizations, and health centers to enroll eligible beneficiaries, it is important to consider what the Health Insurance Portability and Accountability Act (or HIPAA) allows regarding sharing individually identifiable information and protected health information. HIPAA permits state programs to share eligibility data in many cases. HIPAA’s regulations apply to health care providers and health plans, including state health departments that implement the state Medicaid program. But, state government programs such as a state program implementing the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), education initiatives, or non-governmental community centers are not covered by HIPAA, since HIPAA only applies to government entities that are health care providers or health plans (or entities that may be business associates of providers or plans). Whereas a government agency that is not covered by HIPAA does not become subject to HIPAA by sharing data to determine eligibility for a HIPAA-covered program like Medicaid, where authorized by law to do so.

Where a government agency is subject to HIPAA, such as a state Medicaid program, HIPAA permits such programs to share enrollment or eligibility information with other government programs or state health oversight agencies under certain circumstances, such as if state statutes or regulations authorize such disclosure.  Specifically, HIPAA authorizes state health plans to share protected health information related to eligibility for, or enrollment in, the health plan with other government programs providing public benefits if a statute or regulation requires or expressly authorizes such sharing or the use of one combined data system. Additionally, HIPAA allows a government agency that administers a public benefits program, including Medicaid, to disclose health information to another agency as long as both programs serve similar populations. Lastly, HIPAA permits a state Medicaid program to disclose health information for case management and care coordination purposes to other recipients, which may include community-based organizations.

The pharmacies, community health organizations and managed care plans Becerra mentions in the new redetermination flexibilities may need eligibility and enrollment data from state Medicaid agencies in order to assist beneficiaries in completing their renewal form and reinstating their coverage. Medicaid agencies have Medicaid data which offers basic level identifiable information such as names, email addresses, zip codes, and phone numbers. State Medicaid programs may need to share identifiable information with other organizations to better reach and target enrollees and help them with coverage. Therefore, state Medicaid agencies need to ensure that disclosure of that data comply with federal and state regulations including HIPAA. But some organizations Becerra called on to help with Medicaid enrollment and coverage are not covered by HIPAA. And state Medicaid agencies will have to consider under what circumstances they can share this information. For more information on this topic, see States Shouldn’t Fear HIPAA When Improving Gov’t Services.

[i] Kaiser Family Foundation – Medicaid Enrollment and Unwinding Tracker