[ Thursday, September 29, 2016 ]
Filing PHI in Court Documents:
Jeff [2:27 PM]
It's OK for providers to sue patients who don't pay their bills; providers don't have to work for free, and they aren't slaves of their patients. However, if you do so, make sure you don't include any PHI more than is necessary for the filing, and consider seeing a qualified protective order for any PHI you really need to disclose. The disclosure is permitted as a disclosure for payment or healthcare operations purposes, but the "minimum necessary" rule applies. So it's OK to state the debtor's name, and the name of the entity providing the care, but you probably don't need to include particular specifics such as the patient's social security number or birth date, the specific treatments provided, diagnosis, prognosis, or similar information that's not relevant to the debt.
WakeMed found out the hard way
. It wasn't a HIPAA ruling, but it was a $130,000 lesson. Of course, OCR could still weigh in on it, too . . . .
Blogger: HIPAA Blog - Edit your Template