• E-mail
• Print
• RSS

What constitute "health care operations?"

HIPAA Weekly Advisor, October 10, 2002

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: What constitute "health care operations?"

A: Health care operations include any of the following activities:

• Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities
• Population-based activities relating to improving health or reducing health care costs
• Protocol development
• Case management and care coordination
• Contacting of health care providers and patients with information about treatment alternatives
• Reviewing the competence or qualifications of health care professionals
• Evaluating practitioner, provider, and health plan performance
• Conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities
• Underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits
• Ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance), provided that the requirements of Section 164.514(g) of the privacy rule are met, if applicable
• Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs
• Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies
• Business management and general administrative activities of the entity, including, but not limited to:

  a) management activities relating to implementation of and compliance the regulations

  b) customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that protected health information is not disclosed to such policy holder, plan sponsor, or customer

  c) resolution of internal grievances

  d) due diligence in connection with the sale, transfer, merger, or consolidation of all or part of a covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity

  e) creating de-identified health information, fundraising for the benefit of the covered entity, and marketing activities

Editor's note: Brought to you by attorneys Marty Baxter and Gretchen McBeath at Bricker and Eckler, LLP (http://www.bricker.com) and The Quality Management Consulting Group, Ltd. (http://www.qmcg.com). E-mail: mbaxter@bricker.com or gmcbeath@bricker.com.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive