Also treatment disclosure, purpose of use, POU
HIPAA’s Privacy Rule lets a covered entity disclose protected health information without the patient’s written authorization for its own treatment, payment and health care operations, and, at 45 CFR 164.506(c)(2), “for treatment activities of a health care provider”. Treatment is defined at 164.501 as the provision, coordination or management of health care and related services by one or more providers, including consultation between providers and referral of a patient from one to another. That sentence is the legal basis for every discharge summary a hospital sends to a home health agency, every consult note a specialist returns, and every network query a treating provider makes.
Three consequences follow:
- No authorization is needed. A provider treating the patient does not collect a signed release to receive the records of another provider who treated the patient. The release of information process, with its forms and fees, is for the other routes: the patient’s own access and third parties such as attorneys and insurers.
- Minimum necessary does not apply. Under 164.502(b)(2)(i) the minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment. A treating provider may ask for the whole record.
- The networks answer treatment queries. On Carequality and the TEFCA QHINs, a query carries a purpose of use, and treatment is the one every responder is obliged to answer. The querying organization identifies itself as a provider, with an NPI, and a vendor acting for it does so as its business associate under a BAA.
Where it stops is as important as where it applies. An organization that is not treating the patient, however legitimate its need, is not making a treatment disclosure or a treatment query. A payer’s review, a disability determination, an attorney’s case and a Medicaid eligibility assessment are each a different purpose with its own rules, and on the networks they are different purposes with narrower response obligations. Vivlio serves treatment and the operations that support it, and says so.
