St. David’s South Austin Medical Center (the “Hospital”) has received a letter from John Craven, an attorney representing former Hospital patient Ramona Reeves. Mr. Craven states that the Hospital’s entering into a Settlement Agreement with GEICO Insurance Company after the Hospital’s receipt of Ms. Reeves’ “HIPPA (sic) Revocation/Cancellation of Prior Authorization” constituted a wrongful disclosure of her individually identifiable health information (“PHI”). You have asked us to evaluate whether the provision of billing information and/or entering into the settlement agreement with GEICO violated HIPAA.
The answer is no. HIPAA expressly allows a covered entity, such as the Hospital, to disclose PHI for the purpose of obtaining reimbursement for the provision of health care without need of the patient’s authorization. Accordingly, we recommend that a letter be sent to Mr. Craven explaining why his complaint has no basis in law or fact. The goal of this letter will be to discourage him from making a frivolous complaint to the government.
I. The Hospital’s HIPAA-Compliant Use and Disclosure of PHI for Payment.
A. HIPAA permits
…show more content…
The term “payment” is clearly defined as “the activities undertaken by . . . a health care provider or health plan to obtain or provide reimbursement for the provision of health care.” The definition also provides examples of common payment activities that include, but are not limited to: (i) determining eligibility or coverage, and adjudicating or subrogating claims; and (ii) billing and collection and claims management activities. The Hospital’s provision of PHI necessary for billing and reimbursement to GEICO, such as a UB-04 or an Itemized Bill, and its execution of the Settlement Agreement appears to fall squarely within the HIPAA definition of “payment.” Accordingly, the Hospital did not require the patient’s authorization to disclose such