A patient requests you not disclose to her dental benefit plan information about a treatment for which she paid in full at time of treatment. Must you comply with her request? The answer may surprise you.
A health care provider, that is a covered entity under HIPAA, must comply with a patient's request to restrict the disclosure of protected health information to a health plan if (1) the disclosure is for the purposes of carrying out payment or health care operations (and is not for carrying out treatment or is required by law); and (2) the protected health information pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full. This patient right was created by the 2009 HITECH amendments (Section 13405) to HIPAA.
This new requirement supersedes a contractual requirement placed by a plan upon a health care provider to report to the plan all services rendered to a patient.
CDA has created a form that dental practices can use for patients who request this type of disclosure restriction. The form is titled, Request to Restrict Disclosure of Patient Health Information to a Dental Benefit or Health Care Plan, and may be found on this web site.
A patient also may request restriction of disclosure of protected health information in other circumstances, although the covered entity is not required to comply with the request. A separate form should be used for that request. (A sample form is provided in the ADA Practical Guide to HIPAA Compliance (2010) available by purchase from the ADA.)
The U.S. Department of Health and Human Services issued in July 2010 a Notice of Proposed Rulemaking that solicited comments on regulations that will further define requirements of the new law. The Notice also illustrated the department's thinking with regard to certain aspects of the law. The information provided below is from the Notice.
A provider who contracts with an HMO generally receives a fixed payment from an HMO based on the number of patients seen and not based on the treatment or service provided, and an individual patient of that provider pays a flat co-payment for every visit regardless of the treatment or service received. Therefore, it is our understanding that under the most current HMO contracts with providers an individual could not pay the provider for the treatment or service received. Thus, individuals who belong to an HMO may have to use and out-of-network provider if they wish to ensure that certain protected health information is not disclosed to the HMO.
Payment in Full:
. . . we emphasize that if an individual's out of pocket payment for a health care item or service to restrict disclosure of the information to a health plan is not honored (for example, the individual's check bounces), the covered entity may then submit the information to the health plan for payment as the individual has not fulfilled the requirements necessary to obtain a restriction. We do not believe that the statutory intent was to permit individuals to avoid payment to providers for the health care services they provide. Therefore, if an individual does not pay in full for the treatment or services provided to the individual, then the provider is under no obligation to restrict the information and may disclose the protected health information to the health plan to receive payment. However, we expect covered entities to make some attempt to resolve the payment issue with the individual prior to sending the protected health information to the health plan, such as by notifying the individual that his or her payment did not go through and to give the individual an opportunity to submit payment.
HHS solicited comments on the extent to which covered entities must make reasonable efforts to secure payment from the individual prior to submitting protected health information to the health plan for payment.