B. Uses and Disclosures for Treatment, Payment and Health Care Operations (TPO)
Unless the agency has received a specific written authorization from the consumer for, or applicable law otherwise requires or permits, a particular use or disclosure of protected health information, protected health information may only be used or disclosed for purposes of (i) our agency’s treatment activities, payment activities, and health care operations, and (ii) certain treatment activities, payment activities, and health care operations of other health care providers and of health plans.
Treatment For purposes of this policy, the term “treatment” means providing, coordinating or managing the consumer’s health care and any related services. Some examples of treatment activities involving the use or disclosure of protected health information are:
- using protected health information about a consumer’s disease or condition to diagnose or provide care to the consumer
- disclosures of protected health information to other health care providers who are involved in taking care of the consumer
- disclosures of protected health information to another health care provider in order to obtain advice about how best to diagnose or provide care to the consumer
- disclosures of protected health information to another health care provider to whom the consumer has been referred to ensure that this health care provider has the necessary information to diagnose or provide care to the consumer
Payment For purposes of this policy, the term “payment” generally means the activities undertaken by the agency to obtain or provide reimbursement for the provision of health care. Some examples of payment activities involving the use or disclosure of protected health information are:
- disclosing the consumer’s protected health information to a health insurance plan to determine whether it will provide coverage for the consumer’s treatment
- disclosing the consumer’s protected health information to obtain pre-approval before providing a treatment or service, such as admitting the consumer to the agency for a particular type of surgery
- disclosing the consumer’s protected health information to his or her health insurance plan to obtain reimbursement after the agency has treated the consumer
Uses and disclosures of protected health information for the agency’ payment purposes are subject to the HIPAA Privacy Regulations’ "minimum necessary" standard.
Health Care Operations For purposes of this policy, the term “health care operations” generally refers to those general business and administrative functions of the agency that are required in order to operate and perform its health care functions. Some examples of uses and disclosures of protected health information for health care operations are:
- uses and disclosures of protected health information for quality assurance and utilization review purposes
- uses and disclosures of protected health information for education and training of students and other trainees
- uses and disclosures of protected health information to recommend possible treatment options or alternatives, or health-related benefits or services, that may be of interest to the consumer
- uses and disclosures of protected health information for legal services, business planning, and other business management and general administrative activities
- uses and disclosures of protected health information to raise funds for the benefit of the agency
Uses and disclosures of protected health information for the agency’s health care operations are subject to the HIPAA Privacy Regulations’ "minimum necessary" standard.
Disclosure for Other Persons’ TPO Our agency also may disclose protected health information to others for their treatment, payment and health care operations as follows:
- Our agency may disclose protected health information to another health care provider for its treatment activities.
- Our agency may disclose protected health information to a health plan or another health care provider for its payment activities.
- Our agency may disclose protected health information to a health plan or another health care provider for its health care operations, but only if
- (i) both our agency and the other party have, or had, a relationship with the consumer whose information is being disclosed
- (ii) the protected health information being disclosed pertains to that current (or previous) relationship
- (iii) the disclosure is for certain limited health care operations activities, including conducting quality assurance and/or quality improvement activities, education or training of students and other staff, reviewing the competence or qualifications, or the performance, of health care professionals, accreditation, licensing, credentialing, and fraud and abuse detection or compliance activities
Disclosures of protected health information for others’ payment activities or health care operations are subject to the HIPAA Privacy Regulations’ minimum necessary standard.