Background

HIPAA modernized the flow of healthcare information. It changed how providers and patients access records, especially health information stored and shared electronically. An unintended consequence of HIPAA’s privacy restrictions is information blocking, a result of the reluctance of providers to exchange PHI with other providers for treatment purposes. In 2015, the ONC’s Report to Congress defined information blocking as “knowingly and unreasonably interfer[ing] with the exchange or use of electronic health information.”^[3] The ONC stated that the secure, efficient, and effective sharing and use of electronic health information (EHI) is a key component of healthcare delivery system reform. Nonetheless, in the era of the Affordable Care Act, where billions of dollars of incentives have been given to providers to implement systems of managing electronic health records (EHRs), “challenges continue to limit the widespread and effective sharing of [EHI] across the health care continuum.”

HIPAA and important exceptions

One objective of HIPAA was to permit secure electronic exchange of information for treatment purposes. Despite this objective, some providers have instituted practices that frustrate this goal, such as requiring outside treatment providers to obtain patients’ authorization to access PHI, which is unnecessary and can constitute information blocking. Covered entities may disclose PHI to other providers for treatment purposes without patient authorization.^[4] This is one of the clearest exceptions to HIPAA’s rules, which otherwise prohibit a covered entity from using or disclosing PHI, unless authorized by patients.

Any healthcare provider transmitting health information in connection with certain transactions is a covered entity under HIPAA and subject to the HIPAA Privacy Rule.^[5] The HIPAA Privacy Rule standards dictate how providers may use and disclose PHI. A major goal of the Privacy Rule is to assure PHI is protected, while still allowing for the necessary flow of information to promote high-quality healthcare and protect the public. The Privacy Rule states, “A covered entity may not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing.”^[6]

Ask yourself, “What steps can I take to ensure that my organization is disclosing PHI in a timely manner to all authorized providers that request PHI for treatment purposes?”

The U.S. Department of Health and Human Services (HHS) provides guidance to covered entities, stating that they may rely on professional ethics and best judgments in deciding which disclosures to make. HHS also maintains that a healthcare provider’s primary responsibility under HIPAA is to disclose PHI in a secure, permitted manner. A covered entity may use and disclose PHI for its own treatment, payment, and healthcare operations activities. Additionally, a covered entity is also permitted to disclose PHI for the treatment or payment activities of any other covered entity.^[7]

Treatment is defined as “provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.”^[8] Patients expect their health information to be disclosed, as necessary, for treatment, billing, and the operations of the covered entity’s healthcare business; such transactions are permitted under HIPAA. Providers seem to understand that they may disclose PHI for treatment purposes to outside providers; however, recurring information blocking demonstrates that providers may be unwilling to do so for various reasons, including an intent to keep the information from perceived or actual competitors in the healthcare field.