Is This Allowed?

 

If:

• The request is for health care operations (e.g., quality improvement, compliance audits, risk adjustment) or payment-related audits

• It complies with HIPAA’s Minimum Necessary Standard (45 CFR §164.502(b))

• The entity requesting the records is a business associate or subcontractor with a valid BAA in place

 

Problems to Watch Out For

 

1. Request for Entire Medical Record

   • Violation if the audit is only for one claim or diagnosis as this violates HIPAA’s minimum necessary rule

2. No Specific Audit Target Given

   • They must tell you what they’re reviewing: date of service, CPT/ICD code, or HCC category

3. Mental Health, Substance Use, HIV, or Sensitive Records

   • Requires special protections, redaction, or separate patient authorization (42 CFR Part 2, state laws)

4. “Fishing Expeditions”

   • They ask for records not tied to any claim.  This is often inappropriate and possibly abusive.

 

What You Should Do

 

Respond Narrowly and Log Disclosure

 

• Only send relevant sections

• Redact unrelated or protected content

• Keep a copy and log the date and scope of your disclosure

 

Request Clarification If Needed

 

To ensure compliance with HIPAA’s Minimum Necessary Standard, please specify which diagnoses, dates of service, or HCC codes are under review so we may limit disclosure appropriately.

​

POINT TO PONDER on BUSINESS ASSOCIATE AGREEMENTS

​

Just because someone has a Business Associate Agreement with a health plan doesn’t mean they’re authorized to receive your patients’ records.

​

HIPAA holds you, the provider, responsible for ensuring that any disclosure meets federal law including verification of the recipient and the presence of required agreements.