HIPPA Violations - I need advice

sassyinaz · Nov 11, 2003

Re: Re: Re: HIPPA Violations - I need advice

Originally posted by slykens
I have posted this before but I just don't see HIPPA as any sort of tool to use against an unruly CA or OC unless there is blatant and irresponsible disclosure.

Please read the original post and clarifications provided subsequently -- this was nothing but a blatant and irresponsible disclosure.

HIPPA protects what is known as "Protected Health Information." It is typically personally identifiable information and generally covers your entire medical record.

The PHI that can be transmitted, IF a business associate contract is in place, AND for payment purposes is specifically defined and is not or ever an entire medical record.

The problem, however, is that HIPPA provides for use of PHI during collection of payment. That said it does require a "minimum necessary" disclosure but when you request validation that means they must provide to you a full accounting and that requires pretty substantial disclosure.

It provides for transmittal of PHI (specifically defined) for the purpose of payment, of which collection is a part of.

Validation is NOT a medical record.

Validation IS to address dunning the wrong person and/or the wrong dollar amount.

That is not a substantial disclosure and is defined in the Wollman FTC Staff Opinion letter as well as the purpose of validation.

Even IF you could make the argument that an entire medical record was required validation, the requirement is that is come from the OC to the alleged debtor through the CA. The OC certainly could have transmitted the medical chart portion of what it forwarded in a sealed envelope or something that would have preserved the privacy.

However, if you'd read again, you will see that the information was provided to the CA BEFORE enigma even requested validation, so it's moot anyway.

In any event a significant part of your medical record was provided to the insurance company to procure payment and this is not illegal.

What does this have to do with anything posted about????

As long as the CA has a "Business Associate Agreeement" with the hospital and takes steps to protect the PHI while it is in their posession they have no liability to you in this instance.

Please go read the definition of PHI for payment purposes!!!!!!!

You requested a full accounting of the bill and they provided it. The chain of custody is complete and as long as the appropriate agreements are in place no law was broken.

An itemized bill is not a medical chart and I can't conceive of how you are making it so.

The only argument you could make would be excessive disclosure.

That's a hipaa violation and a complaint in the making. However, you've skipped the requirements of the individual states as well which at minimum mimick the hipaa requirements and a lot are more restrictive.

It might not have been necessary to send your procedure notes and transcripts but at the same time the CA was attempting to comply with *your* request for full validation.

The CA isn't understanding validation and the FDCPA requirements, as you aren't.

As the CA is a covered entity and is part of the payment and collection process

The CA is NOT a covered entity, the hospital is.

The CA doesn't get to comply with one and not the other, they have to comply with both, and if reporting, the FCRA as well. And, throw the individual state requirements in there as well.

Hipaa doesn't conflict with the FCRA, it doesn't conflict with the FDCPA, it can't conflict with the state's requirements or the federal supremacy provisions would kick in.

Hipaa makes an exception for payment purposes. Payment purposes includes collection. PHI for this situation is specifically defined.

I don't see how it can be argued that they violated HIPAA by complying with your request for validation.

That's not what happened, read the original post, and again, they have no reason to have an entire medical record to effect payment -- it is specifically defined and is never a medical record.

They did everything BUT provide validation, which would have been copies of the admit/discharge forms with enigma's signature and agreement with any financial arrangements that was made and an itemized statement detailing how they came up with what they allege is owed.

I am sure the Courts or the Congress would not permit a situation where a CA cannot collect on a bill because they can't send validation because they would violate HIPPA. That is why HIPPA contains an explicit exemption for collection of payment.

They didn't, this just isn't it.

If there is an alleged debt, there is a payment purpose.

If there is collection, there is the FDCPA.

If there is a request for validation they have to be able to meet it.

If there is no debt or invalid debt, there is no longer a payment purpose. The CA wouldn't be able to get the information to provide the validation and they shouldn't because there is nothing to collect and no reason for collection activity, which is reporting and continued reporting -- seperate tangent sorry.

So, in this instance because enigma didn't deny the debt (money owed) only questioned the amount claimed due (validation) to meet the validation requirement and stay within the hipaa boundaries, ONCE validation was requested, not BEFORE, as occurred here, they should have contacted the OC, received an itemized statement adding up to the amount they allege due, and copies with enigma's signature as well as agreeing to any other financial terms, if any.

IMHO you are better off pursuing the CA with an FDCPA argument and to continue paying the hospital the $100 per month.

There is no cause of action with a hipaa complaint but there certainly should be one made nonetheless.

and the FDCPA

and the individual state's health privacy provisions

and the FCRA if reporting

Also keep on top of your insurance company and demand to know why they didn't pay the bill resulting in your going to collection.

And a complaint to whatever state departments oversee the insurance company in the related states.

You might be able to intimidate someone with a HIPPA argument but I doubt you'd win in Court.

This confirms that you've not done your homework on this matter.

Enigma won't be in court for a hipaa violation, none of us will, there is no cause of action for individuals under hipaa!!!!

We can only lodge the complaint that carries potentially severe penalties for the covered entity.

That's why the state's have their own health privacy laws, at minimum, mimicking hipaa.

And, there's still the violations of the FDCPA and FCRA, as well as the state versions of those laws as well.

Then there's the matter of the breach of patient-physician confidentiality as detailed and dictated by the AMA and sworn to.

Sassy
Click to expand...

enigma · Nov 11, 2003

Re: Re: Re: HIPPA Violations - I need advice

Thanks Sassy for sticking up for me on this.

All through out HIPPA you will see the word "reasonable". In this case both the CA and the hopsital did not act in a reasonable fashion.

There are some things I would like to say and some ideas to pass on, but my attorney has asked me not until he has had time to gather information from all parties. Then I'll be free to post.

I did made a mistake on my Demand for Validation letter, I was not specific enough. More on that later.

A couple of people have asked the CA's name, it is Attention LLC out of TX. I found out yesterday that they are licensed and bonded in TX, but until yesterday it did not show in the TX website.

The parent company is out of GA, and they share the same address as Sherman Associates.

Now Attention is not licensed in FL, big no-no.

I have them on several FDCPA violations, plus my state's version of the FDCPA.

Cannot get them on HIPPA can only go after hospital on HIPPA. But as it has been pointed out here several times, a consumer has NO PRIVATE RIGHT OF ACTION under HIPPA.

In my case the hospital was not "REASONABLE" in the informaiton they released.

But we can take action on my state's prvivacy laws.

FL has a "Patient's Bill of Rights and Responsibilities".

One of those "responsibilities" is that "A patient is responsable for assuring that the financial obligations of his or her healthcare is fulfilled as promptly as possible".

That being said, I was making $100 per month payments on what I was told was my portion of the bill. Not an "un-reasonable" amount. Now insurer decides to muck things up and starts demanding refunds for what they claim are "not covered" and "un-customary" charges. Well, insurer has a contract with hospital. Hospital billed on those contracted amounts.

Now attorney says we have a cause of action against insurer. But my state does not allow a consumer to sue an HMO, but we will not do that. We will go after insurer on the fact they violated terms of their contract, to which I am a party.

This is getting real messy real fast.

sassyinaz · Nov 11, 2003

Re: Re: Re: HIPPA Violations - I need advice

yw enigma,

and nodding with you!!!!!!

Curious about this and understanding you may not be at liberty to say:

I did made a mistake on my Demand for Validation letter, I was not specific enough. More on that later.
Click to expand...

What validation letter did you send?

Additionally, if it helps any, they are required to give you the mini-miranda, advising of your right to dispute.

We only have to say in writing that we dispute the debt or some portion of it to trigger the requirement for verification (validation).

The FDCPA applies to abusive collectors, not to you.

They've the burden of knowing what verification is and isn't, and why they're required to give you the mini-miranda.

All we have to do is write "disputed" so I'm not following why you needed to be specific.

Sassy

Log in / Register

Forums

HIPPA Violations - I need advice

sassyinaz Well-Known Member

enigma Well-Known Member

sassyinaz Well-Known Member

Share This Page

Log in / Register

Useful Searches

HIPPA Violations - I need advice

sassyinaz Well-Known Member

enigma Well-Known Member

sassyinaz Well-Known Member

Share This Page