Question

HMO Revises Process to Obtain Valid Authorizations Covered Entity: Health Plans / HMOs Issue: Impermissible Uses and Disclosures; Authorizations A complaint alleged that an HMO impermissibly disclosed a member’s PHI, when it sent her entire medical record to a disability insurance company without her authorization. An OCR investigation indicated that the form the HMO relied on to make the disclosure was not a valid authorization under the Privacy Rule. Among other corrective actions to resolve the specific issues in the case, the HMO created a new HIPAA-compliant authorization form and implemented a new policy that directs staff to obtain patient signatures on these forms before responding to any disclosure requests, even if patients bring in their own “authorization” form. The new authorization specifies what records and/or portions of the files will be disclosed and the respective authorization will be kept in the patient’s record, together with the disclosed information. The group shall examine the case and write a case study analysis addressing the following:

Introduction (10 points) Identify the key problems and issues in the case.

Answer 1

The key problems and issues in the case are :-

- HMO impermissibly disclosed the patient health information to disability insurance company

- patient health information was disclosed without patients authorisation.

- the form used by HMO to make the disclosure was not a valid authorisation under the privacy rule.

The corrective actions taken by HMO are:-

- a new HIPAA compliant authorisation form is introduced ,which mentions what all information will be shared.

- an add on to the policy that all staff should take authorisation before responding to any disclosure request.

- This new form mentioned what all data will be shared and also a copy of authorisation will be kept in patient record with the disclosed information.