CMS offers clarification on HIPAA medical privacy rule

The Department of Health and Human Services (HHS) and the Centers for Medicare & Medicaid Services (CMS) have issued a clarification to better familiarize health care providers with the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HHS educational materials include examples that clarify the privacy rule:

• HIPAA does not require patients to sign consent forms before doctors, hospitals, or ambulances can share information for treatment purposes. Providers can freely share information with other providers where treatment is concerned without getting a signed patient authorization or jumping through other hoops. For frequently asked questions (FAQs) and more information, go to; for “Uses and Disclosures for Treatment, Payment, and Health Care Operations,” visit; and for a summary of the HIPAA privacy rule.

• HIPAA does not require providers to eliminate all incidental disclosures. HHS has adopted specific modifications to that privacy rule to clarify that incidental disclosures are not violations when providers and other covered entities have commonsense policies that reasonably safeguard and appropriately limit how protected health information is used and disclosed. HHS guidance explains how this applies to customary health care practices; for example, using patient sign-in sheets or nursing station whiteboards, or placing patient charts outside exam rooms. Review the fact sheet on “Incidental Disclosures” at

• HIPAA does not cut off all communications between providers and the families and friends of patients. Doctors and other providers covered by HIPAA can share needed information with family, friends, or with anyone else a patient identifies as involved in his or her care as long as the patient does not object. Even when the patient is incapacitated, a provider can share appropriate information for these purposes if he or she believes that doing so is in the best interest of the patient. See

• HIPAA does not stop calls or visits to hospitals by family, friends, clergy, or anyone else. Unless the patient objects, basic information about the patient can still appear in the hospital directory so that when people call or visit and ask for the patient, they can be given the patient’s phone and room number, and general health condition. Clergy, who can access religious affiliation if the patient provided it, do not have to ask for patients by name. See the FAQs on “Facility Directories” at

• HIPAA does not prevent child abuse reporting. Doctors may continue to report child abuse or neglect to appropriate government authorities. Search “child abuse” or review the fact sheet on “Public Health” at

• HIPAA is not anti-electronic. Doctors can continue to use e-mail, the telephone, or fax machines to communicate with patients, providers, and others using commonsense, appropriate safeguards to protect patient privacy, just as many were doing before the privacy rule went into effect. More on this topic can be found at


‘Medicare should cover care coordination services’

The Case Management Society of America (CMSA) is asking the Centers for Medicare & Medicaid Services (CMS) to revise a recent ruling and make care coordination services payable under CMS.

An interim final rule by CMS provided certain assessment and care coordination codes that were assigned Relative Value Units (RVUs) but were given “N” status, making those codes ineligible for Medicare reimbursement. CMSA is concerned that failure to provide financial reimbursement for these practices continues to misalign incentives and priorities that will negatively impact care delivery to patients.

“Currently, case managers work in a collaborative manner with physicians, pharmacists, and other care managers, such as social workers, to best coordinate patient care between different professionals and different practice settings,” says Teri Treiger, RN-C, MA, CCM, CCP, CPUR, CMSA director.

“Without the appropriate financial funding for these types of services, health care providers have less incentive to provide this type of coordination, and many cannot afford to fund such initiatives on their own,” says Treiger. “Poor coordination leads to poor transitions of care in our system, not only resulting in the patient receiving less than the best care possible, but possibly in very dangerous situations occurring, such as incorrect treatments, medication errors, and delay in diagnosis and treatment.”

In a letter to CMS, the CMSA board requests that CMS reconsider the interim payment rule on several Current Procedural Terminology (CPT) codes (99441, 99442, 99443, 98966, 98967, and 98968) and change these codes from “N” status to “Medicare payable” codes. These codes would encourage a variety of assessment and management services to beneficiaries, such as:

  • transition of care coordination;
  • medication reconciliation;
  • health literacy, patient medication knowledge, and patient readiness-to-change assessments;
  • motivational interviewing;
  • patient education;
  • medical home coordination.