HIM 510 Module 6 HIPAA Short Paper Example

Only What Was Asked For: HIPAA in Payment, Payer Audits and Records Requests at Laurel Point

[Student Name]

Southern New Hampshire University

HIM 510: HIM Applications and Systems

Module Six Short Paper

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Only What Was Asked For: HIPAA in Payment, Payer Audits and Records Requests at Laurel Point

Every month, Laurel Point Regional Medical Center's release of information team answers about 1,900 requests for records from health plans, Medicare contractors and other auditors reviewing claims. Because these requests support payment, staff have treated them as routine and sent whatever the requester asked for, often the entire record. A sample of 150 fulfilled requests last quarter found that 22% included the complete record when the request concerned a single date of service. This paper explains what HIPAA requires for disclosures that support payment and recommends changes to the hospital's practice.

What HIPAA Permits for Payment

Under the HIPAA Privacy Rule, a hospital needs no patient signature to share information in order to treat the patient, get paid or run its business. Payment includes obtaining reimbursement, determining eligibility and coverage and responding to a health plan's review of whether a claim should be paid. Disclosures to a health plan to support a claim or an audit of that claim are therefore permitted. Permission is not unlimited, however, and routine treatment of payer requests as open-ended is where Laurel Point's practice went wrong.

Minimum Necessary Applies

Unlike disclosures to other providers for treatment, disclosures for payment are subject to the minimum necessary standard: the hospital must make reasonable efforts to limit what it discloses to the minimum needed for the purpose. For routine, recurring disclosures, the hospital may set standard protocols; for nonroutine requests, staff must review each one. A covered entity may rely on another covered entity's request as the minimum necessary when that reliance is reasonable, but a request for records related to one outpatient visit does not justify sending a patient's entire history, including unrelated visits, mental health notes and prior hospitalizations. The 22% of over-releases found in the sample were disclosures beyond what the request required.

Building Standard Protocols

The minimum necessary standard allows the hospital to create standard protocols for recurring requests instead of judging each one from scratch. The release team reviewed six months of payer requests and found that about 80% fell into five types: single-visit claim reviews, inpatient stay reviews, medical necessity reviews for imaging, readmission reviews and pre-payment reviews for high-cost drugs. For each type, the privacy officer and revenue integrity manager will define the default record set, such as the visit note, orders, results and discharge summary for an inpatient stay review, and exclude everything else unless the requester explains why more is needed. Requests outside these types, or asking for the complete record, will go to a supervisor for review. Standard protocols make the right disclosure faster, not slower, because staff no longer have to decide from scratch.

Why Over-Release Matters

Sending more than necessary increases the chance that sensitive information reaches people who do not need it and enlarges the harm if a recipient's systems are breached. The federal breach reports examined by Liu et al. (2015) involved many kinds of organizations and media, including business associates and paper records, which means information sent outside the hospital carries continuing risk. Cohen and Mello (2018) argue that HIPAA's protections weaken as information moves beyond covered entities and their business associates, and Price and Cohen (2019) describe how health data increasingly flow into large data sets outside traditional privacy protections. Each unnecessary page sent to a payer or vendor is a page the hospital no longer controls.

Patients' Right to Restrict Disclosures to a Health Plan

HIPAA, as amended by the HITECH Act, gives patients one absolute right in this area: if a patient pays in full out of pocket for a service and asks the hospital not to disclose information about it to the health plan, the hospital must honor the request, except where law requires disclosure. Laurel Point's registration and billing systems currently have no reliable way to flag such services, so the information could be sent to a plan in a later audit of a different claim. The hospital needs a restriction flag that follows the encounter into billing and release of information.

Specially Protected Records

Some records carry extra protection. Psychotherapy notes, kept separate from the medical record by the treating clinician, generally require patient authorization for disclosure even for payment, and payers may not condition payment on receiving them. Addiction treatment records from programs receiving federal assistance are governed by their own regulation, that requires patient consent for disclosure, although a single consent may now cover future payment disclosures. Michigan law adds protections for certain sensitive conditions. A release process that sends entire records by default is especially risky for these categories, because they can be swept into a disclosure without anyone deciding to send them.

Business Associates, Clearinghouses and Secure Submission

Laurel Point uses a contracted release of information vendor for some payer requests and a clearinghouse to process claims. The vendor is a business associate and must sign an agreement requiring safeguards and breach reporting; the clearinghouse is itself a covered entity under HIPAA. Records for Medicare audits can be submitted electronically through secure federal channels, which are safer and faster than paper or disc. Staff should use secure portals for every payer that offers them and track each submission in the release log so that disclosures can be reconstructed if a problem occurs.

Recommendations

Table 1 summarizes the recommended changes.

Table 1. Recommended Changes to Payer Release Practice

Note. Recommendations developed by the author with the privacy officer.

Conclusion

Disclosures that support payment are permitted, but they are not exempt from privacy duties. Applying the minimum necessary standard, honoring self-pay restrictions, protecting sensitive records and managing vendors and channels would bring Laurel Point's payer release practice into line with HIPAA without slowing the revenue it supports.

References

Cohen, I. G., & Mello, M. M. (2018). HIPAA and protecting health information in the 21st century. JAMA, 320(3), 231-232. https://doi.org/10.1001/jama.2018.5630

Liu, V., Musen, M. A., & Chou, T. (2015). Data breaches of protected health information in the United States. JAMA, 313(14), 1471-1473. https://doi.org/10.1001/jama.2015.2252

Price, W. N., & Cohen, I. G. (2019). Privacy in the age of medical big data. Nature Medicine, 25(1), 37-43. https://doi.org/10.1038/s41591-018-0272-7