A prepayment review is a permissible reason to disclose PHI without patient consent.

 

BUT

 

Minimum Necessary Rule STILL Applies

 

Under 45 CFR §164.502(b), you are legally obligated to:

 

“Make reasonable efforts to limit the disclosure of PHI to the minimum necessary to accomplish the intended purpose.”

 

Prepayment review of a single claim, they can only request documentation that supports that claim, not the entire chart, full history, or unrelated diagnoses.

 

You should provide only documentation that supports:

 

• The billed diagnosis and procedure codes on the claim under review

• Pertinent portions of the encounter note, including:

  • HPI, ROS (if relevant), assessment, plan

  • Lab/imaging results if directly supporting medical necessity

  • Vitals/clinical indicators related to the billed codes

• Redact unrelated diagnoses or narrative portions (e.g., mental health content) unless directly tied to the claim

• Keep a copy of what you send

• Log the disclosure for your HIPAA records

• Push back on overly broad requests using legal language, you are not required to violate HIPAA to get paid

We received your request for medical records in support of the claim dated [insert DOS] for [Patient Name].

 

In accordance with 45 CFR §164.506(c), we understand that prepayment review falls under permitted uses of PHI for payment activities. However, under 45 CFR §164.502(b), we are obligated to limit disclosures to the minimum necessary to fulfill this request.

 

Therefore, we are providing only the documentation directly related to the billed services and diagnoses on this claim. If further clarification or targeted documentation is required, please specify.