Health plans must participate in care coordination to improve patient outcomes, protect patient information, and maintain an efficient line of communication throughout the care process. Methods of communication like HIPAA complaint email and efficient protocols surrounding the process allow for the secure sharing of this information.
HIPAA applies to health plans because they are considered covered entities. Covered entities, as defined by HIPAA, are individuals or organizations that are directly involved in handling and managing individuals' protected health information (PHI) within the healthcare system. CMS guidance provide, “For HIPAA purposes, health plans include:
Health plans handle vast amounts of sensitive PHI, including medical claims and enrollment data. Their role involves implementing policies and procedures to ensure the confidentiality, integrity, and availability of this information. This includes restricting unauthorized access, protecting against data breaches, and facilitating secure data sharing for authorized healthcare purposes. By fulfilling their responsibilities as covered entities, health plans help maintain patient trust in the healthcare system.
Health plans need to share patients' PHI for continuity of care because it ensures that individuals receive consistent, well-coordinated healthcare. Health plans often serve as intermediaries between patients and various healthcare providers. Sharing PHI among these entities is necessary to provide a complete picture of a patient's medical history, diagnoses, treatments, and medications. This enables healthcare professionals to make informed decisions, avoid duplicative tests or treatments, and tailor care plans to individual needs. Without PHI sharing, there's a risk of fragmented care, medical errors, and delayed treatment, which can disrupt patient care.
Minimum Necessary Standard: Health plans should only disclose the minimum amount of PHI necessary for the intended purpose of care coordination. This ensures that sensitive information is not unnecessarily shared.
Written Business Associate Agreements: When engaging third-party entities to assist with care coordination, health plans should establish written business associate agreements that outline the responsibilities and requirements for protecting PHI.
Use Continuity of Care Documents (CCDs): Leverage the standardized CCD format to transmit patient information securely between providers. CCDs include data for care coordination, such as demographics, medical history, medications, allergies, diagnoses, lab results, and more. Ensure that CCDs are shared electronically through secure channels.
Patient authorization: While HIPAA permits sharing PHI for care coordination without patient authorization, health plans should obtain patient consent or authorization when required by state law or if the individual requests it.
Secure communication: When electronically transmitting PHI for care coordination, health plans should use secure methods, such as HIPAA compliant email or secure file transfer, to protect data during transmission.
Data retention and disposal: Develop policies for the secure retention and disposal of PHI. Ensure that electronic and physical records containing PHI are securely managed and disposed of when no longer needed.
See also: Continuity of care
When engaging in care coordination communication under HIPAA's TPO exception, healthcare entities should adhere to the following best practices:
Case management and care coordination emails are tools for delivering holistic care. The underpinning framework of HIPAA's TPO exception recognizes the unique demands of patient care, allowing healthcare professionals to share pertinent information without explicit opt-in consent.
See also: Do you need opt-in for care coordination emails?
A business associate is a person or entity that performs certain functions or activities on behalf of, or provides services to, a covered entity that involve the use or disclosure of PHI.
PHI is any information about health status, provision of health care, or payment for health care that can be linked to an individual.
HIPAA's TPO exception allows covered entities to use or disclose PHI without patient authorization for treatment, payment, and healthcare operations purposes.