Permitted Use/Disclosure of PHI for Medical Treatment, Paying Bills, Healthcare Operations (Without Authorization)

Medical Treatment — the covered entity is entitled for using/disclosing PHI for treatment that is being conducted at his own establishment, the related payments and other complementary healthcare activities.

If the covered entities are interrelated, i.e. they share a professional relationship with the individual and contents of the PHI contain information regarding this relationship then such information can be disclosed by either of the covered entities for treating the individual or providing any other healthcare facilities.

PHI can also be shared among the two covered entities for issues related to the quality of services rendered at healthcare facilities and competency-related issues that concern either of the covered entities, for issues related to fraud or abuse, investigations and legal compliance-related concerns. This also entails matters related to:

• Management of healthcare-related services that have been provided by a healthcare provider or facility
• Consultations that are held between healthcare providers, including referrals from referring physicians

Payment — all financial activities that are related to premiums, various forms of payments related to maintaining health insurance coverage, receiving medical benefits and seeking reimbursement for treatment are covered under Payment. Basically, it includes all financial transactions and related activities required for rendering or receiving healthcare-related services.

Healthcare Operations — the realm of such operations can include any or all of the activities:
• Assessment and improvement of healthcare services, including patient care management
• Competency-related and compliance issues including those related to healthcare provider, medical/health plan, credentialing processes and accreditation services along with execution of medical reviews, audits and legal services concerned to cases of fraud or abuse
• Specific functions like insurance underwriting, risk rating for insurance plans and reinsurance of already-insured risk factors
• Business administration and management related to covered entities including de-identification of PHI and associated activities like fundraising

Authorization for Psychotherapy-based Information — any disclosure that is related to notes recorded as a part of psychotherapy-related treatment, payment for the same or healthcare operations related to it require an Authorization. The authorization is sought in the form of Consent that is essentially a written permission from the concerned individual to allow the disclosure of his PHI for healthcare operations, treatment and payment. This written consent is sought by the covered entity on a Consent Form. The format and the extent of details sought in the Form are decided by the covered entity.