Examples of Disclosures of Part 2 Records for Payment and Health Care Operations

In regulations released in January of 2018, SAMHSA included a list of 17 specific types of payment and health care operations in the regulatory text that would be the basis for further disclosures by a lawful holder of patient identifying information. SAMHSA did not include this list of 17 items in the regulations.  Rather, these items were contained in the preamble reflecting that additional reasons for release for payment and health care operations may be permissible.  Examples of permissible activities under § 2.33(b) that SAMHSA considers to be payment and health care operations activities include:

• Billing, claims management, collections activities, obtaining payment under a contract for reinsurance, claims filing and related health care data processing;
• Clinical professional support services (e.g., quality assessment and improvement initiatives; utilization review and management services);
• Patient safety activities;
• Activities pertaining to:
• The training of student trainees and health care professionals;
• The assessment of practitioner competencies;
• The assessment of provider and/or health plan performance; and
• Training of non-health care professionals;
• Accreditation, certification, licensing, or credentialing activities;
• Underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care;
• Third-party liability coverage;
• Activities related to addressing fraud, waste and abuse;
• Conducting or arranging for medical review, legal services, and auditing functions;
• Business planning and development, such as conducting cost management and planning-related analyses related to managing and
  operating, including formulary development and administration, development or improvement of methods of payment or coverage
  policies;
• Business management and general administrative activities, including management activities relating to implementation of and compliance with the requirements of this or other statutes or regulations;
• Customer services, including the provision of data analyses for policy holders, plan sponsors, or other customers;
• Resolution of internal grievances;
• The sale, transfer, merger, consolidation, or dissolution of an organization;
• Determinations of eligibility or coverage (e.g. coordination of benefit services or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims;
• Risk adjusting amounts due based on enrollee health status and demographic characteristics;
• Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges.

SAMHSA believes it is important to maintain patient choice in disclosing information to health care providers with whom patients have direct contact. For this reason, the final provision in § 2.33(b) does not cover care coordination or case management and disclosures to contractors, subcontractors, and legal representatives to carry out such purposes are not permitted under this section. In addition, SAMHSA added language to the regulatory text in § 2.33(b) to clarify that disclosures to contractors, subcontractors and legal representatives are not permitted for activities related to a patient’s diagnosis, treatment, or referral for treatment.

linkscolor = “000000”; highlightscolor = “888888”; backgroundcolor = “FFFFFF”; channel = “none”;

Source: Health Law Blog