This article marks our first in a series of articles pertaining to the new HIPAA Final Rules implementing the HITECH Act.
Before the Final Rule, covered entities were required under HIPAA to permit individuals to request that covered entities restrict the use or disclosure of protected health information (PHI) for treatment, payment and health care operations purposes. Covered entities were not, however, required to agree to any such requests. The Final Rule, which was released by HHS on January 17, 2013, eliminated covered entities’ discretion as to whether to comply with an individual’s request for restriction on disclosure of PHI to a health plan provided certain requirements are met. Under the Final Rule, a covered entity must agree to an individual’s request to restrict disclosure of PHI if: (a) the disclosure is for payment or health care operations and is not otherwise required by law, and (b) the PHI pertains solely to a health care item or service for which the individual or other person on behalf of the patient (other than a health plan) has paid the covered entity in full.
To ward off concern that providers would need to create separate medical records to segregate PHI subject to a restricted item or service, HHS commented that covered entities only need to employ some method to flag the restricted PHI or to make a notation in the record regarding the PHI that is restricted.
In cases where an individual requests a restriction with respect to only one of several health care items or services in a single patient encounter, HHS imposed upon providers the expectation that they counsel the patient on their ability to unbundle the items or services and the impact of doing so. For example, even if an item or service is unbundled, providers should warn the patient that it is possible that the context may allow the health plan to determine the service performed and that unbundling the service may cost the patient more.
HHS fell short of requiring providers to notify downstream providers of the fact that an individual has requested a restriction to a health plan, however it encouraged providers to counsel patients that it is the patient’s obligation to request a restriction and to pay out of pocket with other providers in order for the restriction to apply to the disclosures by such providers.
In addition, HHS encourages covered entities to engage in an “open dialogue” with patients to ensure they are aware that any previously restricted PHI may be disclosed to the patient’s health plan for follow-up care unless the patient requests an additional restriction and pays out of pocket for the follow-up care.
Please contact Carrie Soli if you have any questions about HIPAA’s requirements regarding individuals’ requests for restrictions on disclosure of PHI.
