Health Plan Requests for PHI

Q. When a commercial health plan requests protected health information (PHI) about one of our patients, are we safe in assuming this disclosure of PHI falls under HIPAA’s “TPO” exception, which says we are allowed to disclose PHI for reasons of  “treatment, payment, or health care operations”?

 A. Generally yes, but not always — the exception has some exceptions.

  • Under the “hide” rule, a patient who pays you for a service in full out of pocket can restrict you from disclosing to his or her insurance company the PHI related to this service. The patient must request the restriction in writing.
  • A payer may see identifiable PHI of its insured patients but not of patients it does not insure. If, for  example, you need to send a health plan a sampling of your medical records for initial credentialing, you must deidentify the records.

Your Notice of Privacy Practices tells patients about your possible disclosure of their PHI for purposes of treatment, payment, or health care operations. Is your notice posted where patients will see it? Do you collect patients’ signatures acknowledging they have seen it? HIPAA requires you to follow both of these practices.

Find out more about HIPAA and medical records privacy:

Have questions? Contact the TMA Knowledge Center at (800) 880-7955 or knowledge[at]texmed[dot]org.

Published Feb. 11, 2013

NOTICE: The Texas Medical Association provides this information with the express understanding that 1) no attorney-client relationship exists, 2) neither TMA nor its attorneys are engaged in providing legal advice and 3) that the information is of a general character. This is not a substitute for the advice of an attorney. While every effort is made to ensure that content is complete, accurate and timely, TMA cannot guarantee the accuracy and totality of the information contained in this publication and assumes no legal responsibility for loss or damages resulting from the use of this content. You should not rely on this information when dealing with personal legal matters; rather legal advice from retained legal counsel should be sought.


TMA Practice E-Tips main page


Last Updated On

November 08, 2016