HIPAA Consult

Answers to your questions about . . .

By William S. Hubbartt

Requests for information

Q: We receive lots of requests for authorizations and other patient-related information. Without signed consents from patients, can we respond?

A: It depends on who's requesting the information and for what purpose. The HIPAA Privacy Rule permits disclosure of protected health information for the purposes of treatment, payment, or health care operations. So inquiries from other health care providers who are consulting about a patient's treatment are permitted without written authorization. So are inquiries from health plans about payments.

Generally, you should get the patient's written authorization for other kinds of disclosures. But even for such disclosures, limit the information you release to the minimum necessary. As with all HIPAA matters, put these policies and procedures in writing to guide your staff.

Mail-order pharmacies

Q:Mail-order pharmacies phone or fax us daily requesting diagnostic and other information. How should we respond?

A: Pharmacists are health care providers—whether they're down the street or operate by mail-order across the country. Under HIPAA, you can communicate with them about treatment without patient authorization.

But requests for information beyond the scope of treatment would not be permitted without authorization. For example, you'd need the patient's authorization if a pharmacist (mail-order or local) sought additional patient information for marketing purposes.

Postcard reminders

Q:Am I permitted under HIPAA to send postcard appointment reminders to patients?

A: HIPAA doesn't specifically prohibit the use of postcards. But it does require that your notice of privacy practices describe the ways you may use and disclose protected information. So if you use postcards as appointment reminders, you should spell that out in your notice. Second, the information on the postcards should be the minimum necessary for the purpose at hand—to remind patients of their appointments. And third, you should accommodate patients who request confidential communications, such as a sealed envelope.

Release of records

Q:What should we do if we get an inadequate release-of-records form from another practice?

A: Actually, HIPAA permits disclosures between offices for treatment purposes without a signed authorization.

If a practice uses its own form for enhanced protection, it should be HIPAA-compliant. If you're presented with an incomplete or inadequate authorization form, the safest strategy is to substitute your own in order to properly document your organization's compliance. What's important isn't which practice's form you use, but that you're following the rules when disclosing protected health information.

William S. Hubbartt is president of Hubbartt & Associates, a St. Charles, IL, consulting firm. He can be reached at wshubbartt@hubbartt.com. This department answers common HIPAA-related questions. It isn't intended to provide specific legal advice. If you have a question, please submit it via e-mail to mehipaa@medec.com, or by regular mail to Medical Economics, 5 Paragon Drive, Montvale, NJ 07645. ATTN: HIPAA CONSULT. If we select your query, we'll address it in an upcoming issue. Your name will not be used.

 

William Hubbartt. HIPAA Consult: Answers to your questions about . . .. Medical Economics Oct. 10, 2003;80:33.