HIPPA privacy law

[bruce s.]

What is the name of your state (only U.S. law)? California.
I recently had to put in a claim through my medical insurance carrier. They demanded that I sign an authorization form in order for them to process my claim. This authorization form was extremely broad and negates the protection I would have under the HIPPA act as I read it. Here is an example of what is on the authorization form.
EXAMPLE:
“REDISCLOSURE: Any personal information will be used or disclosed pursuant to this authorization may be subject to re-disclosure and no longer protected by federal privacy regulation.”
With the threat that “REFUSAL TO SIGN: I understand that I may refuse to sign this authorization. I realize that if I refuse to sign, the insurance benefits will not be payable.”

I have contacted the insurance company and informed them that I am willing to sign a authorization form so they might be able to obtain all relevant information to process my claim. Their response was I have to sign it the way it is or they will not process the claim. Can they deny the processing of the claim if I refuse to give up my protection under the HIPPA act? If they can so easily get around the HIPPA law what is the purpose of it!What is the name of your state (only U.S. law)?

[seniorjudge]

Q: Can they deny the processing of the claim if I refuse to give up my protection under the HIPPA act?

A: Yes.

[ecmst12]

You need to read the ENTIRE agreement to see under what circumstances they might disclose your information.

Sharing information between healthcare entities is ALWAYS LEGAL if it is necessary to pay a claim. And you can't waive your rights to not have your information IMPROPERLY disclosed. The form is of questionable enforceability in its current state, but they can require you to sign it before paying anything.

You can, however, contact the HIPAA board with your concerns, after you sign it.

[cbg]

Hot button here - IT'S HIPAA, NOT HIPPA.

You won't find it in a zoo.

[TIMMAAYY]

It's pretty common for administrators to require waiving of HIPAA. Otherwise they are not allowed to view your information and process your claim. They need to look up procedure codes, etc. in order to process it.

No biggee.


Should I mention 105 here just so everyone can have something to talk about?

[ecmst12]

You do not need to 'waive' HIPAA in order to get your claims processed, even if it was possible to waive it (I'm pretty sure it's not). Like I said, it is ALWAYS LEGAL for your doctor to share medical information with your health insurance company in order to get a claim paid. Specific authorization is not needed, nor is written consent (though they may request it if they like). Really, people who work in this business need to understand how this law works, it's only the most important law applying to healthcare in the past 20 years.

[TIMMAAYY]

You do if the TPA is not part of the carrier.

[ecmst12]

NO, YOU DO NOT. IT IS ALWAYS LEGAL FOR HEALTHCARE ENTITIES TO SHARE PATIENT INFORMATION FOR THE PURPOSE OF EITHER PAYMENT OR TREATMENT. It does not matter whether it is the actual insurance company paying the claim or a third party administrator. Claim payment is a permissible reason to share information under the law, NO special consent or authorization is required by the law before doing so. I don't know how much clearer I can make it. Please go READ THE LAW before arguing with me again.

[TIMMAAYY]

Keep in mind I have only worked with one particular TPA, which DOES require a waiver because of the mix. It's a fully insured plan in the background, therefore they are not included in the list for having PHI.

HIPAA Privacy Rules in Practice: Three Plan Sponsors
The compliance burden imposed on group health plans and their sponsors under the privacy rules varies depending upon the role of the plan sponsor in plan administration.

1. Fully-Insured Group Health Plan/Employer Is "Hands-Off" the PHI (Protected Health Information)

If a group health plan provides health benefits only through an insurance contract and does not create, maintain, or receive PHI, the vast majority of administrative burdens imposed by the privacy rules do not apply to the plan or the plan sponsor. By taking this approach, both the plan and the plan sponsor avoid having to:

* comply with the use and disclosure rules;
* provide individuals with the right to access, amend, and receive an accounting of PHI;
* prepare and provide a privacy notice; and
* comply with the administrative safeguards (other than the prohibitions against retaliatory acts and requiring a waiver of' HIPAA rights).

It's a fully insured product in the background, but the employee's benefits do not match the insurance plan as purchased. The benefits are administered separately from the insurance plan.

I'm not arguing with you, but in this case it is required due to the fact that a fully insured plan is in place, but PHI is still needed to administer benefits.