HIPAA Permits Some PHI Disclosures To Non-Beneficiaries

(Published April 6, 2006)

A common cause of consternation among plan sponsors is recognizing under what conditions they can disclose protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) to an individual who calls the plan on a beneficiary's behalf. 

The Department of Health and Human Service's (HHS's) Office of Civil Rights came to the rescue last month when it published a new FAQ on health plan disclosures.  According to the HHS, HIPAA's Privacy Rule permits a health plan (or other covered entity) to disclose to a family member, relative, or close personal friend of the individual the PHI directly relevant to that person's involvement with the individual's care or payment for care.

Disclosures may also be made to persons not falling under these three categories, provided the health plan has reasonable assurance that the person has been identified by the individual as being involved in his/her care or payment.

Disclosures of relevant PHI may only be made if the individual does not object, or the covered entity can reasonably infer from the circumstances that the individual does not object to the disclosure.  Note: When the individual is not present or is incapacitated, the covered entity can make the disclosure if, in the exercise of professional judgment, it believes the disclosure is in the best interests of the individual.

The HHS provided these examples.

• A health plan may disclose relevant PHI to a beneficiary's daughter who has called to assist her hospitalized, elderly mother in resolving a claim or other payment issue.
  
  
• A health plan may disclose relevant PHI to an HR rep who has called the plan with the beneficiary also on the line, or who could turn the phone over to the beneficiary, who could then confirm for the plan that the representative calling is assisting the beneficiary.
  
  
• A Medicare Part D plan may disclose relevant PHI to a staff person with the Centers for Medicare and Medicaid Services (CMS) who contacts the plan to assist an individual regarding the Part D benefit, if the information offered by the CMS staff person about the individual and the individual's concerns is sufficient to reasonably satisfy the plan that the individual has requested the CMS staff person's assistance.

Related Topic(s): Benefits/Health Insurance Portability and Accountability Act (HIPAA)