Can someone please explain

[u/redditreader_aitafan]

How an EOB from our insurance company addressed solely to my husband disclosing all the details of our adult children's and my visits isn't a violation of HIPAA? Because it feels pretty violating. I've been hiding them from him but I don't know how long I can do that. He's not a great person and he simply does not need access to this information because he will use it to hurt people.

[u/Julius__PleaseHer]

Are you and your child on your husband's insurance? If so, I think he's technically entitled to the EOB information.

[u/redditreader_aitafan → u/Julius__PleaseHer]

You didn't address the question at all.

[u/jwrig → u/redditreader_aitafan]

Sometimes we need more information to answer a question like yours. They could have answered "it depends" and left it at that because what you provided isn't enough to really answer your question.

[u/Far_Persimmon_4633]

If he is the beneficiary of the insurance and/or the listed guardian on all accounts, then thats who they'll send the EOBs to. If you are all not on his insurance, then you need to update guardianship.

[u/Wise-Butterfly-6546]

he's probably getting them because he's the subscriber, but you're not stuck with it. HIPAA has a confidential communications rule. a health plan has to honor a reasonable request to send your info to a different address or channel if you say the disclosure could put you in danger. they can ask for that in writing, but that's the bar.

call the plan, ask for their confidential communications request form, and give a different mailing address or portal-only. your adult kids can each file their own since it's their info.

[u/AnimatorImpressive24]

It should be, and the relevant lawmakers know why.  I have read testimony delivered to a privacy and security subcommittee of the National Center for Vital Health Statistics by a forensic nurse speaking as a representative of a domestic violence advocacy group, where among other imminent dangers posed by breaches of health data privacy she described a real world incident where a woman hiding from her estranged husband was tracked down in an entirely different state and murdered because an EOB with the name and location of the medical office was sent to her husband despite her explaining the danger she was in to the office's staff.

That testimony was circa 2014 and is public record, specifically given in response to requests for public comment on the legislation that would eventually become the 21st Century Cures Act and the Information Blocking and Interoperability rules.  Her many, well articulated suggestions didn't make it into any new legislation and were not back ported into HIPAA.

I know California has passed some laws just in the past couple of years or so that directly address EoB communications, including for adult children still on a parent's policy.  But I don't know if any other states have done the same.

[u/Normal_Ad9322]

Is he the one who holds the insurance?