Skip to main content
A Better Partnership


Aug 2010
August 12, 2010

Withholding Information from Health Plans -- What does HIPAA say?

If a patient asks you not to report treatment to his or her health plan, are you prepared to carry out that request?

HIPAA privacy regulations have always given individuals the right to request restrictions on how health care providers use or disclose their information, but until recently, health care providers have always had the discretion to say "no" to these requests.

If you are a health care provider, however, the HITECH amendments to HIPAA include a new right: When a patient receives treatment and pays for that treatment entirely out of his or her own pocket, the patient may request that you not share information about the treatment with the patient's health plan -- and you must honor that request.

Although the HITECH amendments to HIPAA went into effect on February 18, 2010, the Department of Health & Human Services (DHHS) only recently issued proposed regulations to implement this new rule. Under these proposed regulations:

  • The patient may request this restriction whether the patient pays entirely for the treatment, or someone else (other than the health plan) pays for the treatment.

  • Once the patient has made the request, you must agree not to share information about the treatment for payment or health care operations purposes unless required to do so by law. The restriction also prohibits you from sharing information with the health plan’s business associate.

  • You must give the patient the right to make this request for each treatment visit. For example, you may not require the patient to pay for all treatment out of pocket so that you can simply restrict all communications about that patient with the health plan. Rather, you will need to be able to track which treatments can be shared and which cannot.

  • You cannot unilaterally terminate this restriction, but will instead have to get the patient's permission.

These rules are not yet final and could still undergo some changes. In fact, DHHS is asking for feedback on a number of related issues, such as:

  • Should the restriction be included in the medical information that is shared with a specialist or another health care provider who is also treating the patient?

  • How do you implement this in connection with electronic prescribing, where the pharmacy receiving the electronic prescription may have already billed the health plan before the patient even arrives and has a chance to request the restriction?

  • How would this apply if you are participating in an HMO and have already received a payment from the HMO for treating the patient?

  • What happens if the patient seeks follow-up care and doesn’t pay the full cost of that care? Can you send the insurer information about the initial treatment in order to be paid for the follow-up care?

Depending on the feedback that DHHS receives, this rule could become quite burdensome. The Department is accepting comments through September 13, 2010, so if you have any opinions on these issues, you may want to consider submitting a comment.

If you have any questions about HIPAA compliance please contact a member of Warner Norcross & Judd's Health Law Practice Group.

NOTICE. Although we would like to hear from you, we cannot represent you until we know that doing so will not create a conflict of interest. Also, we cannot treat unsolicited information as confidential. Accordingly, please do not send us any information about any matter that may involve you until you receive a written statement from us that we represent you.

By clicking the ‘ACCEPT’ button, you agree that we may review any information you transmit to us. You recognize that our review of your information, even if you submitted it in a good faith effort to retain us, and even if you consider it confidential, does not preclude us from representing another client directly adverse to you, even in a matter where that information could and will be used against you.

Please click the ‘ACCEPT’ button if you understand and accept the foregoing statement and wish to proceed.



+ -