All covered entities (which include medical billing companies as well as physicians) need to understand exactly what Protected Health Information (PHI) is.

PHI is considered:

“Individually identifiable health information held or transmitted by a covered entity or its business associate.”

This includes any health information (which extends to demographic data) that is related to:

• Past, present or future physical or mental health condition

• The health care provision

• Past, present or future payments of health care by the person

The Privacy Rule

The privacy rule contains national standards for the protection of individually identifiable health information. The rule, established in 2000, tries to make sure the individual information is appropriately protected. At the same time it has to allow the proper flow of health information necessary to ensure high quality health care and protect the health and well being of the general public.

The rule requires privacy protection safeguards, sets limits on the uses of the information (if done without patient authorization) and implements patient rights concerning their health information.

The Privacy Rule and How it Affects PHI

There are three main situations when PHI can be disclosed according to the privacy rule:

• As the Privacy Rule allows

• If it is authorized in writing by the individual

• As part of HHS compliance investigation, review or enforcement action

Permitted Use and Disclosure

Following are some ways PHI can be used without an individual’s authorization:

• For treatment payment and health care operations

• In an incident to an otherwise permitted use. This could happen if a hospital visitor overhears two doctors discussing an individual’s healthcare while they are deciding on treatment.

• Public interest as required by court order, FDA, law enforcement or because of a legal issue

• A limited data set is allowed for the purpose of research with a data use agreement

Covered Entities Notice of Policy Practice

Covered entities must provide notices of their privacy practice to include: PHI use and disclosure permitted and used; duties to protect privacy; a privacy practice notice; a rights and grievance process if those rights have been violated; and a point of contact for more information and to receive complaints.

The Notice of Privacy Practice must be distributed to each individual no later than the first service encounter. It needs to be done with a prompt mailing and posted on the website of the covered entity.

When selecting a medical billing company, make sure that they are well versed in the privacy rule and PHI.

McLaughlin founded RMK ( http://www.rmk123.com ) in 1980. With two employees and a few small accounts, he developed the business that has collected and processed more than $100 million in debt collections since its inception.

The business focuses on medical billing, revenue management, accounts receivable management, collections, subrogation, revenue enhancement reviews, and billing office-staffing analysis in addition to its full collection agency service programs. RMK clients include major hospitals, medical clinics and providers from all over the US.