OCR Releases New HIPAA FAQs on Care Coordination

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) recently issued new guidance on its HIPAA FAQs webpage regarding permissible use and disclosures of protected health information (PHI) by health plans for purposes of care coordination and continuity of care. Health plans are covered entities under HIPAA.

The guidance explains that, under the HIPAA Privacy Rule, covered entities are permitted to disclose PHI to another covered entity for “health care operations” purposes without obtaining authorization from the individual who is the subject of the information. In order to share PHI for health care operations (which includes care coordination and case management), the covered entities must both have (or have had) a relationship with the individual and the PHI must pertain to such relationship. The guidance confirms that health plans may share information about individuals who receive care under both plans in order to improve care coordination.

The new guidance further explains that, under certain circumstances, HIPAA also permits a health plan to use and disclose PHI that is in its possession to inform individuals about other health plans that it offers that may be relevant to the individual’s health care. Generally, HIPAA prohibits covered entities from using or disclosing information for “marketing” purposes without the individual’s authorization. However, communications to individuals regarding replacement or enhancement of existing health plans is specifically excluded from the definition of “marketing.” In order to fall under this exclusion, the covered entity may not receive any financial remuneration for the communication. If this requirement is satisfied, a health plan could rely on information it receives from another health plan to inform an individual about replacements or enhancements that it offers and that are available for such individual.