Patient’s Guide to HIPAA – Uses and Disclosures: Are Disclosures for Treatment, Payment and Health Care Operations Okay?





You are reading the Patient’s Guide to HIPAA, FAQ 56

HIPAA Guide Quick Links:



FAQ 56: Are Disclosures for Treatment, Payment and Health Care Operations Okay?  

At one level, yes. Health care is a complex enterprise that represents a large chunk of America’s economy. There are hundreds of thousands of health care providers and probably as many support organizations. Daily transactions measure in the millions. If you think about it, you may realize that major health care treatment and payment institutions are big businesses that engage in a wide variety of activities just like other businesses. Management and internal controls require access to some records. If we spent the time to list the comparable data-intensive activities engaged in by banks or governments, we would also find a long list of uses and disclosures of personal information that are, for better or worse, a routine part of those functions.

At one level, then, treatment, payment and health care operations (TPO) disclosures are routine. Just about all of the functions supported by TPO uses and disclosures went on before HIPAA, although few health professionals paid attention to them. Before HIPAA, if your consent was sought for the sharing of your records for these purposes – and it frequently was not sought – you weren’t told any of the specifics. Doctors, hospitals, and insurers typically asked patients to consent to “any and all disclosures” without telling patients what that meant. Physicians and other providers didn’t know themselves how widely patient information was shared.

HIPAA eliminated the need for consent for TPO disclosures. A covered entity may still seek your consent, but this seems to happen rarely. It is easier to rely on the authority provided by the rule to justify use and disclosure. Some privacy advocates see the lack of consent as a great gap in privacy protection because it removes any pretense of patient control over records. We doubt that asking everyone for consent all the time would achieve a better result, and the extra expense and bother would be considerable.



Roadmap: Patient’s Guide to HIPAA: Part 3: What You Should Know about Uses and Disclosures (FAQ 56 of 65)

Jump to list of FAQs 1-65 | See all of Part 3