Health Information Compliance Alert

You Be The Security Expert:

Can Insurance Companies Disclose PHI?

Read the question below and decide how you would handle it before you compare it to our expert's advice.

Question: Are health insurance companies allowed to disclose protected health information to someone who contacts the organization on behalf of the beneficiary?

Answer: Yes. According to the U.S. Department of Health and Human Services, a covered entity is permitted to disclose health information to a patient's close friend, family member, or relative, as long as the covered entity is reasonably sure that the person requesting this information is directly involved in the patient's care and/or payment for patient care. The health care provider must also determine that the PHI is relevant to that person's involvement with the patient's health care needs.

HHS also says that covered entities may disclose certain PHI to a person who is not a close friend, family member or relative, as long as the representative of the covered entity receives "reasonable assurance" that the patient has identified this person as someone who is involved in his/her care or payment for his/her care.

Finally, when the patient is absent or somehow incapacitated (for example, if she is in a coma or mentally incapacitated), representatives of a covered entity are allowed to use their professional judgment to determine if PHI disclosure is in the best interests of the patient.