1. HIPAA Collaborative of Wisconsin PAYMENT, COLLECTIONS, AND ACCEPTED BENEFITS FURTHER DEFINITION OF THE PRIVACY RULE Copyright 2003 - HIPAA Collaborative of Wisconsin

3. EXAMPLES OF COMMON PAYMENT ACTIVITIES Plan eligibility or coverage determination Claims adjudication Risk adjustments Billing and collection Healthcare service review e.g. medical necessity Utilization Review Consumer Reporting Agency disclosures Copyright 2003 - HIPAA Collaborative of Wisconsin

4. USE OR DISCLOSURE OF PROTECTED HEALTH INFORMATION FOR PAYMENT A Provider’s disclosure of Protected Health Information (PHI) is part of the claim for payment. Copyright 2003 - HIPAA Collaborative of Wisconsin

5. DISCLOSURE OF PHI TO ANOTHER COVERED ENTITY (CE) FOR PAYMENT PURPOSES Providers disclose PHI to labs for billing purposes. Hospital emergency rooms disclose PHI to transporting ambulance company for billing purposes. Copyright 2003 - HIPAA Collaborative of Wisconsin

6. USE AND DISCLOSURE OF PSYCHOTHERAPY NOTES Authorizations are required for use and disclosure of psychotherapy notes. Copyright 2003 - HIPAA Collaborative of Wisconsin

7. MINIMUM NECESSARY REQUIREMENT COVERED ENTITIES SHOULD DEVELOP & IMPLEMENT: Minimum necessary policies and procedures for disclosures and requests for PHI. Role-based access policies and procedures regarding workforce access to PHI for payment purposes. Copyright 2003 - HIPAA Collaborative of Wisconsin

8. CONSENT The CE is not required to obtain individual consent for use and disclosure of PHI to obtain payment. The consent cannot replace an authorization. (See authorization requirements, CFR 164.508.) Copyright 2003 - HIPAA Collaborative of Wisconsin

9. RIGHT TO REQUEST RESTRICTIONS Individual right to request restrictions on CE’s use and disclosure of PHI for payment. The CE is not required to accept the individual's request. However, if the CE agrees to the restriction, it is bound to honor the individual’s request. Copyright 2003 - HIPAA Collaborative of Wisconsin

10. NOTICE OF PRIVACY PRACTICES The CE must use, access, or disclose PHI as described in the CE’s Notice of Privacy Practices. Copyright 2003 - HIPAA Collaborative of Wisconsin

11. DEFINITION OF PAYMENT 45 CFR 164.506 “Payment encompasses the various activities of health care providers to obtain payment or be reimbursed for their services and of a health plan to obtain premiums, to fulfill their coverage responsibilities and provide benefits under the plan, and to obtain or provide reimbursement for the provision of care.” Copyright 2003 - HIPAA Collaborative of Wisconsin

12. COLLECTION AGENCY COMMUNICATIONS The CE, or business associate operating on CE’s behalf (e.g. collection agency), is permitted to disclose PHI for payment purposes. There is no limit on recipients of such sources of information. Copyright 2003 - HIPAA Collaborative of Wisconsin

13. CONSUMER CREDIT REPORTING AGENCIES AND CONFLICTS WITH FAIR CREDIT REPORTING ACT (FCRA) The CE or CE’s business associate is permitted to use or disclose PHI, as required under the Fair Credit Reporting Act. Copyright 2003 - HIPAA Collaborative of Wisconsin

14. CONSUMER CREDIT REPORTING AGENCIES AND CONFLICTS WITH FAIR CREDIT REPORTING ACT (FCRA) Disclosures to consumer reporting agencies are part of HIPAA privacy rule’s definition of payment. Disclosures are limited to the specified individual PHI: name and address; date of birth, social security number, payment history and account number. Disclosure of the name and address of the health care provider or plan making the report are allowed. The CE can choose to perform payment activity directly or through a third party under the business associate agreement. Copyright 2003 - HIPAA Collaborative of Wisconsin

15. DEBT COLLECTION AGENCIES The CE is allowed to use debt collection agency services. Debt collection is recognized as payment activity within payment definition (45 CFR 164.501). Disclosures of PHI to collection agencies are defined by Business Associate Agreements, the Minimum Necessary Requirement and other privacy rule provisions. Copyright 2003 - HIPAA Collaborative of Wisconsin

16. COLLECTION AGENCY LOCATION INFORMATION SERVICES Acquisition of information on an individual’s location is considered a payment activity (45 CFR 164.501). Business Associates of the CE are required to comply with the Fair Debt Collection Practice Act limitations on location information services. Copyright 2003 - HIPAA Collaborative of Wisconsin

17. LONG/SHORT TERM DISABILITY, WORKERS COMPENSATON, SUBROGATION These policies are not considered health plans, as defined by the Privacy Rule. Such policies, plans or programs provide or pay for accepted benefits as listed in Section 2791 (1) of the Public Health Service Act, 42 U.S.C. 300gg-91 (1) See 45 CFR 160.103. Copyright 2003 - HIPAA Collaborative of Wisconsin

18. EXEMPT FROM HIPAA PROVISIONS Accident, disability income, or a combination of the two insurances. Liability insurance supplemental coverage. Workers compensation. Automobile medical payment insurance. Copyright 2003 - HIPAA Collaborative of Wisconsin

19. EXEMPT FROM HIPAA PROVISIONS - CONTINUED Credit-only insurance. Coverage for on-site medical clinics. Other similar insurance coverage, specified in regulations, under which medical care benefits are secondary or incidental to other insurance benefits.

20. Primary Author: Anthony Cooper, FHFMA, CFE Training Workgroup Reviewers: Karen Bauer Joan Benson, MBA William Jensen, MBA Tammy Kritz, MBA Jennifer Laughlin, RHIA Christine Lidbury Richard Reynolds, FHIMSS Beth Zallar, MS, RHIA