3

Suppose that in a US county the County Board of Commissioners wants to engage a retired physician to look into the county ambulance dispatch system to see what it takes to create proper records and successful billing. In the US, the HIPAA rules restrict to whom and under what conditions a health care provider or facility can disclose Protected Health Information (PHI). But such information can be disclosed provided the rules are complied with.

What do the HIPAA rule say needs to be done in such a case to allow such a person to look at protected health information (PHI), review records and billing/coding without violating privacy, and specifically to comply with the HIPAA privacy rule?

Improve this question
2
  • I don't know the rules but that looks like the kind of application where you can anonymize the data and remove all personal information before handing it over for analysis.
    – quarague
    Aug 7 at 9:07
  • @quarague Hypothetically yes, but in practice not really. To assess the completeness of a given claim for billing, one would need to know things like the date/time of service, the reason for the call, any additional health issues present at the time, some amount of the patient's medical history, what was done by EMTs, whether they were subsequently admitted to the ER and/or to inpatient care, the EMTs involved (for retraining), and so forth. Even stripped of name/DOB/etc this would not count as anonymized for the purpose of the Privacy Rule.
    – Michael
    Sep 22 at 16:44

1 Answer 1

Reset to default
1

What you are describing is effectively an audit—a fairly common practice among healthcare organizations of all sizes, who often use them for exactly the sort of purpose you describe. Under the scenario you are describing, the physician would be considered a business associate, which is a defined term under HIPAA. To comply with the Privacy Rule, the covered organization (ambulance company in your example) must obtain a signed business associate agreement; as well as "obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule."

Improve this answer
1
  • Information about patient service is shared by a provider with the payor when a bill is submitted and more information can be requested and transmitted. If I were doing an audit for a payor I don't think I would establish a business associate arrangement with the provider but more likely with the payor since the provider could restrict my communications with the payor.
    – David Smith
    Oct 23 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .