The HIPAA Privacy Rule permits covered entities to use and disclose protected health information (PHI) for treatment, payment, and healthcare operations activities. HIPAA appointment reminders constitute the treatment of an individual, and therefore, can be made without an authorization.
HIPAA Appointment Reminders and the HIPAA Privacy Rule
The HIPAA Privacy Rule established a baseline of federal law protections for protected health information (PHI). As such, the rule generally prohibits covered entities from using or disclosing protected health information, unless authorized by patients, except where the prohibition would result in needless interference with access to quality healthcare or with certain other important benefits (e.g., Medicare and Medicaid) or with certain other important public benefits (e.g., social welfare programs) or national priorities (e.g., national security, national emergency).
Ready access to treatment and efficient payment for healthcare – both of which require use and disclosure of protected health information – are essential to our healthcare system’s ability to function.
Also, certain healthcare operations, such as administrative, financial, legal, and quality improvement activities, are conducted by or for healthcare providers and health plans; these operations are necessary for treatment.
Individuals have an expectation that their protected health information will be used and disclosed, as necessary, to:
- Render treatment;
- Bill for treatment; and
- Operate the covered entity’s healthcare business.
To avoid interfering with an individual’s access to quality healthcare or the efficient payment for such healthcare, the Privacy Rule permits covered entities to use and disclose protected health information, with certain limits and protections, for: treatment, payment, and healthcare operations.
“Treatment” generally means the provision, coordination, or management of healthcare and related services among healthcare providers or by a healthcare provider with a third party, consultation between healthcare providers regarding a patient, or the referral of a patient from one healthcare provider to another.
HIPAA appointment reminders are considered part of treatment of an individual and, therefore, can be made without an authorization.
In contrast to treatment, “payment” encompasses the various activities of healthcare providers to obtain payment or be reimbursed for their services and of a health plan to obtain premiums, to fulfill their coverage responsibilities and provide benefits under the plan, and to obtain or provide reimbursement for the provision of healthcare
“Healthcare operations” are certain administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business and to support the core functions of treatment and payment.
