HIPAA Privacy Regulations

The privacy rule establishes accountability and responsibility for the use or disclosure of any protected health information (PHI) for the purposes of treatment, payment or health care operations.  This includes all medical records and health information used or disclosed in any form, whether electronic, written or oral.

The HIPAA Privacy Rule (45 CFR 164.502 and .508) as well as the Federal Social Security Act 1902(a)27, 45 CFR 431.107, and the N.C. Medicaid provider enrollment agreements all allow providers to share information with the Division of Medical Assistance or its agents without additional patient authorization.  This includes information needed for payment of claims as well as additional information that may be requested for audits, investigations, and civil, criminal or administrative proceedings.

The privacy rule does require the disclosure must be limited to the minimum amount of information that is necessary to accomplish the intended purpose.  The complete medical record should not be sent to the Division of Medical Assistance or its agents unless it is specifically requested.

Related Links

• Federal Office of Civil Rights - HIPAA Privacy
• U.S. Department of Health and Human Services
• Centers for Medicare and Medicaid Services
• Workgroup for Electronic Data Interchange
• Strategic National Implementation Process
• Washington Publishing Company