[healthcare, gov/law, US] HIPAA and Private Pay
Oh, huh. I just found this looking something up in HIPAA:
(a)
(1) Standard: Right of an individual to request restriction of uses and disclosures.
(i) A covered entity must permit an individual to request that the covered entity restrict:
(A) Uses or disclosures of protected health information about the individual to carry out treatment, payment, or health care operations; and
(B) Disclosures permitted under§ 164.510(b).
(ii) Except as provided in paragraph (a)(1)(vi) of this section, a covered entity is not required to agree to a restriction.
[...iii: if you do agree, you have to keep your promise, except in emergencies...]
(vi) A covered entity must agree to the request of an individual to restrict disclosure of protected health information about the individual to a health plan if:
(A) The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and
(B) The protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full.
In other words: if you pay for it out of pocket, you can require your healthcare provider keep it secret from your insurance - so long as disclosure is not mandated by law.
This is fascinating for a number of reasons.
For one, I've heard of pharmacists refusing to fill prescriptions for controlled substances if the patient's MassHealth won't cover it, even if they patient offers to pay full price out of pocket, on the grounds that MassHealth forbids it. I have no idea if that is true, though I have heard this story two or three times.
For another, it pertains to treatments not diagnoses, or anything else. So if you see a therapist, you could require the therapist not notify your insurance you are being seen by them. But say you have been seeing a therapist for a bit, and then one day reveal to the therapist you have a substance abuse problem. You can't get out of the therapist notifying your insurance that you now have a substance abuse diagnosis by offering to pay for that one session. The therapist is going to have to put your diagnosis into the ongoing paperwork. (I work for a clinic that has to function under some regulation that requires us to promote any substance abuse diagnosis to the primary spot for a patient that has one, and the primary is the one that's on all the paperwork that goes to the insurer.) The only way to really keep that from your insurer is by paying out-of-pocket (it's called "private pay") from there on out.
For another, I wonder what disclosures are mandated by law. I don't know if we have any of those here in MA.
For another, I am really dubious that anybody is building their EHR to support this. Is there a "DO NOT REVEAL THIS TO INSURANCE" flag to put on appointments and treatments? If not, what happens during audits?
Insurance companies audit medical records, yo. Simply saying, "Oh, well we just won't bill for that then they won't know" doesn't cut it if the insurer periodically drops by and demands to read the chart.
I sure as heck know that neither clinic I work for has any way to remove individual records of sessions from a paper chart before an audit.
I am trying to imagine what would happen if we told the MassHealth auditor, "Sorry, give us a moment, we have to remove a bunch of treatment records from those files before you can see them." Head spinning around and exploding is not beyond the realm of possibility. I suspect saying "HIPAA requires it" would not actually help, because they wouldn't believe us.
(a)
(1) Standard: Right of an individual to request restriction of uses and disclosures.
(i) A covered entity must permit an individual to request that the covered entity restrict:
(A) Uses or disclosures of protected health information about the individual to carry out treatment, payment, or health care operations; and
(B) Disclosures permitted under§ 164.510(b).
(ii) Except as provided in paragraph (a)(1)(vi) of this section, a covered entity is not required to agree to a restriction.
[...iii: if you do agree, you have to keep your promise, except in emergencies...]
(vi) A covered entity must agree to the request of an individual to restrict disclosure of protected health information about the individual to a health plan if:
(A) The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and
(B) The protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full.
In other words: if you pay for it out of pocket, you can require your healthcare provider keep it secret from your insurance - so long as disclosure is not mandated by law.
This is fascinating for a number of reasons.
For one, I've heard of pharmacists refusing to fill prescriptions for controlled substances if the patient's MassHealth won't cover it, even if they patient offers to pay full price out of pocket, on the grounds that MassHealth forbids it. I have no idea if that is true, though I have heard this story two or three times.
For another, it pertains to treatments not diagnoses, or anything else. So if you see a therapist, you could require the therapist not notify your insurance you are being seen by them. But say you have been seeing a therapist for a bit, and then one day reveal to the therapist you have a substance abuse problem. You can't get out of the therapist notifying your insurance that you now have a substance abuse diagnosis by offering to pay for that one session. The therapist is going to have to put your diagnosis into the ongoing paperwork. (I work for a clinic that has to function under some regulation that requires us to promote any substance abuse diagnosis to the primary spot for a patient that has one, and the primary is the one that's on all the paperwork that goes to the insurer.) The only way to really keep that from your insurer is by paying out-of-pocket (it's called "private pay") from there on out.
For another, I wonder what disclosures are mandated by law. I don't know if we have any of those here in MA.
For another, I am really dubious that anybody is building their EHR to support this. Is there a "DO NOT REVEAL THIS TO INSURANCE" flag to put on appointments and treatments? If not, what happens during audits?
Insurance companies audit medical records, yo. Simply saying, "Oh, well we just won't bill for that then they won't know" doesn't cut it if the insurer periodically drops by and demands to read the chart.
I sure as heck know that neither clinic I work for has any way to remove individual records of sessions from a paper chart before an audit.
I am trying to imagine what would happen if we told the MassHealth auditor, "Sorry, give us a moment, we have to remove a bunch of treatment records from those files before you can see them." Head spinning around and exploding is not beyond the realm of possibility. I suspect saying "HIPAA requires it" would not actually help, because they wouldn't believe us.