Health Information Management

For payment information, can we only disclose to covered entities?

HIPAA Weekly Advisor, August 14, 2003

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: When we are disclosing information for our own payment purposes, can we only disclose it to another covered entity?

A: No. The HHS commentary in the privacy rule makes it clear that covered entities may disclose PHI for payment purposes to any other entity, regardless of whether it is a covered entity. For example, a health care provider may disclose PHI to a financial institution in order to cash a check or to a health care clearinghouse to initiate electronic transactions.

The regulations define payment as the activities undertaken by

  • a health plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan
  • a health care provider or health plan to obtain or provide reimbursement for the provision of health care

    They further state that the activities of this definition relate to the individual to whom health care is provided. They include, but are not limited to, the following:

  • Determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims
  • Risk-adjusting amounts due based on enrollee health status and demographic characteristics
  • Billing, claims management, collection activities, obtaining payment under a contract for reinsurance (including stop-loss insurance and excess of loss insurance), and related health care data processing
  • Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges
  • Utilization review activities, including precertification and preauthorization of services, concurrent and retrospective review of services
  • Disclosure to consumer reporting agencies of any of the following PHI relating to collection of premiums or reimbursement: name and address; date of birth; social security number; payment history; account number; and name and address of the health care provider and/or health plan

    Payment activities include disclosures to collection agencies. The HHS commentary notes that a collection agency may require PHI to investigate and assess payment disputes for the covered entity. For example, the collection agency may need to know what services the covered entity rendered in order to resolve disputes about amounts due. The information necessary may vary, depending on the nature of the dispute. Such disclosures, however, are subject to the minimum necessary requirements, in that the covered entity must make reasonable efforts to limit disclosure to that information necessary to accomplish the purpose of the disclosure.

    Psychotherapy notes cannot be disclosed for payment purposes unless an authorization is obtained from the individual who is the subject of the notes.

    Accountings of disclosures do not need to include those made for treatment, payment, or health care operations.

    Editor's note: Brought to you by attorneys Marty Baxter and Gretchen McBeath at Bricker and Eckler, LLP and The Quality Management Consulting Group, Ltd.. E-mail: mbaxter@bricker.com or gmcbeath@bricker.com



    • Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

    • Briefings on APCs

      Worried about the complexities of the new rules under OPPS and APCs? Briefings on APCs helps you understand the new rules...

    • Medical Records Briefing

      Guiding Health Information Management professionals through the continuously changing field of medical records and toward a...

    • Briefings on Coding Compliance Strategies

      Submitting improper Medicare documentaion can lead to denial of fees, payback, fines, and increased diligence from payers...

    • Briefings on HIPAA

      How can you minimize the impact of HIPAA? Subscribe to Briefings on HIPAA, your health information management resource for...

    • APCs Weekly Monitor

      This HTML-based e-mail newsletter provides weekly tips and advice on the new ambulatory payment classifications regulations...

    Most Popular

    Related Articles