Wiki Medical record release to RA & HEDIS

[Metroderm]

I attended the Washington conference last spring and took a class with a speaker named Karlene Dittrich.
She advised the attendee that CIOX, Inovolan, should request patients' records with the patient's authorization. They also inform the patient how their records are used.

This Summer, I attended another AAPC conference in Denver, and received the opposite information.
All of the speakers I asked told me that a third party could request the records because they have signed BAA with payers.

Does anyone have the correct information about the RA and HEDIS record release to the third party?

 

[sls314]

Those requests fall under the scope of Healthcare Operations and can be disclosed to the part with the signed BAA.

Here's a citation from the Department of Health and Human Services (risk adjustment and HEDIS are specifically mentioned in the links):

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html

https://www.hhs.gov/hipaa/for-professionals/faq/265/may-a-health-care-provider-disclose-protected-health-information-to-a-health-plan/index.html

As far as the presentation you mentioned from Healthcon, I didn't listen to that session. However, I suspect it could be that the speaker was talking about her personal opinion on what should happen vs stating it as an actual legal requirement?

HHS makes it very clear that those functions are considered healthcare operations.

 

[Metroderm]

Thank you so much for reply and sharing the information.