Lawsuit Highlights Trend of States Forcing Employers to Disclose Confidential Employee Medical Data

ERISA Preemption and State Laws, Transparency, Quality and Cost Containment

The Liberty Mutual Insurance Company recently filed suit under the Employee Retirement Income Security Act (ERISA) seeking an injunction against the State of Vermont’s subpoena requesting that the company turn over confidential and sensitive information on individual participants enrolled in the company’s health plan.  As part of the state’s effort to create a “unified health care database,” Vermont wants the participants’ “name, gender, date of birth, city zip code, social security number, as well as the following information for all claims: diagnosis and procedure code, type of bill paid, amount charged, co-payment or coinsurance amount, and drug code,” among other items of information.  Liberty Mutual is challenging the action on the grounds that turning over such detailed and sensitive information would violate its fiduciary duty under ERISA, particularly since the state can release this sensitive claims data to third parties.  Moreover, the company argues that ERISA preemption prohibits states from imposing their own reporting and disclosure requirements on self-insured plans.  Meanwhile, dozens of other states have or are attempting to set up similar databases through providers, and there is a concern that such states may attempt to require employers to turn over similar sensitive and confidential plan participant information.  This trend, if left unchallenged, will likely continue and become even more aggressive as state health care exchanges are established under PPACA.