Health plan disclosure of PHI on behalf of beneficiaries

Health plans can disclose protected health information to someone acting on a beneficiary's behalf if the person is involved in the beneficiary's care or payment, the beneficiary has not objected, and the disclosure complies with HIPAA.

Can health plans disclose PHI to someone calling on a beneficiary's behalf?

The HHS FAQs section provides the following answer, “Yes, subject to the conditions set forth in 45 CFR 164.510(b) of the HIPAA Privacy Rule. The Privacy Rule at 45 CFR 164.510(b) permits a health plan (or other covered entity) to disclose to a family member, relative, or close personal friend of the individual, the protected health information (PHI) directly relevant to that person’s involvement with the individual’s care or payment for care.”

According to 45 CFR 164.510(b), a health plan may share PHI with family members, relatives, or close personal friends who are involved in the beneficiary's care or payment for care. This can also extend to others who are not family or close friends, provided that the individual has identified them as involved in their care or payment matters.

The health plan is allowed to disclose PHI to these individuals if the beneficiary has not objected or if it is reasonable to assume from the circumstances that there is no objection. In cases where the beneficiary is not present or is incapacitated, the health plan can still go ahead with the disclosure if, using professional judgment, it decides that the disclosure is in the best interest of the individual.

See also: What is PHI disclosure?

The legal requirements

1. Identification of relationship: The person requesting PHI should be identified as a family member, relative, close personal friend, or someone else involved in the individual's care or payment for care.
2. Relevance of information: The PHI disclosed must be directly relevant to the person’s involvement in the individual’s care or payment for care.
3. Beneficiary consent or no objection: The disclosure can proceed if the beneficiary has not objected to sharing their information with the person involved, or if it can reasonably be inferred from the circumstances that the beneficiary does not object.
4. Professional judgment in absence of beneficiary: If the beneficiary is not present or is incapacitated, the health plan may disclose PHI if, in the exercise of professional judgment, it determines that doing so is in the best interest of the individual.
5. Sufficient assurance of involvement: When the person contacting the health plan is not a family member, relative, or close friend, the health plan must have reasonable assurance, such as documentation or confirmation from the beneficiary, that this person is involved in the care or payment for the care of the beneficiary.
6. Emergency circumstances: In cases of emergency, where obtaining explicit consent is impractical, health plans may share PHI if they believe, based on professional judgment, that the disclosure is necessary and in the best interest of the patient.

See also: What are the permitted uses and disclosures of PHI?

FAQs

What is PHI?

PHI refers to any information in a medical record that can be used to identify an individual and that was created, used, or disclosed in the course of providing a healthcare service, such as diagnosis or treatment.

Who is considered a "covered entity" under HIPAA?

Under HIPAA, a covered entity includes health plans, healthcare clearinghouses, and healthcare providers who electronically transmit any health information in connection with transactions for which the Department of Health and Human Services has adopted standards.

Can a beneficiary access their own PHI records from a health plan?

Yes, beneficiaries have the right to access and obtain a copy of their PHI records from their health plan, with few exceptions, as stipulated by HIPAA.