TheRealSteve72

Clarification on the last item: "Really expensive means coverage for which the EMPLOYEE PORTION of premiums FOR INDIVIDUAL, NOT FAMILY coverage would cost more than 9.5 percent of your income.

The amount deducted from your paycheck is the employee portion (not the total premium). However, you need to look at the cost for least expensive employee-only coverage option to determine whether the 9.5% threshhold is met. This should be available in your open enrollment materials (assuming you have a calendar-year policy)

TConfusing/DR: $77, if coverage for your wife isn't included in that $77.

What is the likelihood that any large employers will terminate employer-provided insurance coverage entirely, in favor of a defined contribution model (either through a private or public exchange)?

Not exactly. The HIPAA Notice you receive is not a consent for the provider to use your information. It is the provider telling you what it's going to use the information for. Their uses are governed by permissible uses under the law, not what uses you choose to allow them. Crossing out sections of the notice has no legal effect. Your alternative to accepting the notice as drafted is to leave.

The authorization is a separate issue. The way you describe it, that would be problematic if the limited information you describe could be classified as a "designated record set". If you believe there was a violation, you should contact HHS. They are becoming very active in enforcing this area of law.

EDIT: However, I should note that you say the information was used for "denying a claim". If this was a health care claim (i.e., a claim for medical benefits), no authorization is necessary, as PHI can be disclosed for that purpose without an authorization. If it's something like a disability claim, then that's different (although, if you refuse to authorize the disclosure of information, they can use that refusal as the basis for denial).

It is EXACTLY what the passage you quoted says. Look at the second paragraph:

"an “authorization” is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. "