HIPAA/HITECH Final Rule – Patient Disclosure Options
Under the final HIPAA/HITECH rule issued in January 2013 patients are given a right to obtain restrictions on the disclosure of health information in electronic or any other form to a health plan for payment or healthcare services with respect to specific items and services for which the patient has paid in full on a cash basis, out of their pocket. These requests for restrictions must be granted by the doctor unless disclosure of the treatment is specifically required by law. Note, the doctor must also include this right in his/her Notice of Privacy Practices.
Doctors are not required by this rule to maintain separate health records or segregate restricted health information, but they must “employ some method to flag or make a notation in the record” that their patient has requested that disclosure of certain information be restricted. Of special significance, Medicare beneficiaries will have a right to restrict disclosures if they elect to not file a claim with Medicare and pay for covered services out of pocket. Thus, DCs who are not enrolled in Medicare may be able to treat Medicare patients who request that disclosure of their records be restricted.
Where multiple services are to be paid by a patient as part of a bundled payment, the patient will still have the right to pay privately for certain of the services and obtain restrictions on those services. In this case doctors must do their best to unbundle the services to permit the private payment of specific items and services. Doctors credentialed with a managed care network may have to provide services out of network in order to permit individuals to pay privately and obtain restrictions – however, the managed care contracts must be carefully reviewed to ensure that the contract does not conflict with the new HIPAA/HITECH rule.