How to share patient information under the new rules

Doctors need to take extra care under the new regulations.

By Joel Finkelstein, amednews staff. Feb. 10, 2003.

HIPAA Minute
A series of brief explanations to help physicians prepare for the medical privacy rule, effective April 14, 2003.

The federal medical privacy rule aims to protect the confidentiality of patient records without interfering with physicians' ability to share information for routine purposes.

The regulation allows doctors to disclose individually identifiable information without obtaining prior patient consent for three purposes: treatment, payment and health care operations.

Treatment is defined as the provision of health care, and extends to coordination or management of care with the physician's colleagues and patients' caregivers. This includes consultations and referrals.

For example, a primary care physician can send a copy of a patient's medical record to a specialist who is going to treat the patient. The specialist can use the information to make appointments or schedule procedures. The rule also permits doctors to consult with other physicians on specific cases without getting patient consent.

The rule -- part of the federal Health Insurance Portability and Accountability Act -- also lets doctors disclose patient information in billing health plans for services.

Information sharing for payment purposes is allowed for several activities beyond billing and collection, including eligibility or coverage determination; risk adjustment; review of services for medical necessity, coverage or justification of charges; utilization reviews; and disclosures to consumer reporting agencies.

Patient information given to collection or credit reporting agencies must be limited to the minimum necessary for payment collection. Doctors may also share information with laboratories for billing purposes.

Several other reasons for information sharing fall under the definition of health care operations, which includes quality assessment, underwriting, medical reviews and business planning and management.

The rules give patients special rights to ask for confidentiality. Doctors do not have to agree to these requests, but if they do, they are bound by them. They must also comply with reasonable requests for confidential communications, such as only calling a patient at home or work, if the patients says doing otherwise would endanger them.

Doctors must obtain written permission from patients to share their information for any reason not covered by the rule. Physicians must also abide by state laws, which might have stricter patient consent provisions.