HIPAA Regulatory Alert: CMS: PHI can be disclosed for payment purposes
HIPAA Regulatory Alert
CMS: PHI can be disclosed for payment purposes
'Payment' includes determining eligibility
The Centers for Medicare & Medicaid Services (CMS) says a state Medicaid agency and Medicare Advantage plan may share protected health information to identify dually eligible enrollees. In a question and answer session posted at the Department of Health and Human Services web site, CMS said the HIPAA privacy rule permits a covered entity to disclose protected health information for its own payment purposes and for the payment purposes of another covered entity that receives the information.
The privacy rule defines payment to include activities to determine eligibility or enrollee coverage. Thus, the note says, a Medicaid state agency and Medicare Advantage plan may disclose to each other protected health information about their enrollees to identify those enrollees who are dually eligible under both plans.
In general, an electronic inquiry and response from one health plan to another to obtain information about an enrollee's eligibility to receive health care must be done using the HIPAA standard transaction for eligibility. While the disclosure between the state Medicaid agency and the Medicare Advantage plan are conducted using the standard, the privacy rule's minimum necessary requirements don't apply to disclosures of the data elements required or situationally required by the standard transaction. In contrast, where disclosures are made outside of a standard transaction, both the Medicare Advantage plan in its request for protected health information, as well as the state Medicaid agency in its response, must make reasonable efforts to limit the necessary protected health information for the purpose of identifying dually eligible enrollees.
Because the Medicare Advantage plan must limit its request to the minimum necessary protected health information to identify dually eligible enrollees, the state Medicaid agency may rely, if reasonable, on that request for protected health information as satisfying the minimum necessary requirement for these purposes, CMS said.
The Centers for Medicare and Medicaid Services (CMS) says a state Medicaid agency and Medicare Advantage plan may share protected health information to identify dually eligible enrollees.Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.