HIPAA and Authorizations

GEHA takes the privacy of your patients and our members very seriously.

The HIPAA Privacy Rule gives covered entities, including providers and health plans, the ability to share information with each other for the purposes of treatment, "payment" and health care operations allowed under HIPAA. This permits providers and health plans to exchange any information necessary for the health plan to process the provider's claims, including, but not limited to, paper or electronic claims, treatment plans and X-rays.

When a provider calls to confirm coverage for a patient, he or she can provide any information needed by the insurance company to obtain verification of the coverage. HIPAA places no restrictions on the exchange of related information between a provider and a health plan in discussions/contacts regarding the coverage or processing of a claim. The exchange of information can be by telephone, mail or fax, and these "payment" activities do not require an authorization, consent or other agreement by the patient in order for a provider and health plan to share the information. The free flow of information between providers and health plans gives health plans the information necessary to pay a provider's claim. Any information requested by GEHA is for the express purpose of processing a provider's claim for the patient, and will not be used for any other purpose.

Even if a provider is not covered by the HIPAA Privacy Rule, the Privacy Rule sets a government standard that allows for the exchange of information between providers and health plans for the purpose of payment of the provider's claims. The Privacy Rule states in the preamble that non-covered entities can follow the federal standards on a voluntary basis, other than when state law sets a standard.

Note: All providers must follow state laws when the state law is more stringent than the federal HIPAA Privacy Rule, or when state law provides greater protection to health information than HIPAA.

The website of the Office of Civil Rights under the Department of Health and Human Services (HHS) that contains the Privacy Rule information is hhs.gov/ocr/privacy/index.html.

The above is not advice, but rather, represents GEHA's implementation determined by research of the HIPAA privacy regulations.