SIU Today Summer 2021 - 7

Record retrieval is the process of legally obtaining patient records
from a facility/custodian of records. Record retrieval companies
work with the insurance carriers, claims adjusters and law firms
to obtain records on their behalf.
* Depending on the circumstances, record retrieval involves
either obtaining records via Patient Authorization, signed
by the patient and directed to the specific facility/custodian;
or Subpoena, using the subpoena power of the court to
direct the facility to release the records.
* Patient Authorizations are associated with either prelitigated
or litigated matters, while Subpoenas are associated
with litigated matters.
Covered entities and business associates.
HIPAA is applicable to medical canvassing
and record retrieval services, but only in
the context that covered entities are the
facilities from which medical canvassing
providers are seeking information.
WHERE DOES HIPAA COME INTO PLAY?
Covered entities and business associates.
The Health Insurance Portability and Accountability Act
of 1996 (HIPAA) is a set of federal privacy protections for
individually identifiable health information, commonly
referred to as Protected Health Information (PHI). As a result
of the enactment of HIPAA, the U.S. Department of Health
and Human Services (HHS) over the course of several years
published the following rules:
* Privacy Rule to set national standards for the use and
disclosure of PHI
* Security Rule to set national standards for protecting the
confidentiality, integrity and availability of electronic PHI
* Final Omnibus Rule to strengthen the privacy and security
protections and to finalize the Breach Notification Rule1
These rules collectively apply only to covered entities, a
term narrowly defined to mean health plans, health care
clearinghouses, and health care providers who conduct the
standard health care transactions electronically. The Business
Associates of covered entities, defined as a person or entity
that performs certain functions or activities that involve the
use or disclosure of PHI on behalf of, or provides services to, a
covered entity also must comply with the Rules.
Medical canvassing companies and record retrieval partners
work on behalf of insurance carriers and law firms, who in
general are not covered entities. Medical canvassing companies
1
https://www.hhs.gov/hipaa/for-professionals/index.html
and record retrieval partners are therefore neither covered
entities nor business associates. HIPAA is still applicable to the
medical canvassing and record retrieval services, but only in
the context that covered entities are the facilities from which
the canvassing provider and record retrieval company are
seeking information.
The Privacy Rule
Covered entities are permitted to use and
disclose PHI without an authorization from the
patient as part of their " Treatment, Payment,
and Health Care Operations. " Under that
umbrella, a covered entity can release PHI
without an authorization in order to facilitate
payment or reimbursement for services.
The Privacy Rule
The Privacy Rule defines and limits the circumstances in
which an individual's PHI may be used or disclosed by covered
entities. The rule is that a covered entity " may not use or
disclose protected health information, except either: (1) as
the Privacy Rule permits or requires; or (2) as the individual
who is the subject of the information (or the individual's
personal representative) authorizes in writing. " A covered
entity therefore does not need a Patient Authorization to
release PHI so long as the Privacy Rule permits the disclosure.
covered entities are permitted to use and disclose PHI without
an authorization from the patient as part of their " Treatment,
Payment and Health Care Operations. " Under that umbrella,
a covered entity can release PHI without an authorization in
order to facilitate payment or reimbursement for services.
Covered entities are also permitted to use and disclose PHI without
a Patient Authorization for twelve national priority purposes:
* Required by Law (statute, regulation, court order)
* Public Health Activities
* Victims of Abuse, Neglect or Domestic Violence
* Health Oversight Activities
* Judicial and Administrative Proceedings
* Law Enforcement Purposes
* Decedents
* Cadaveric Organ, Eye or Tissue Donation
* Research
* Serious Threat to Health or Safety
* Essential Government Functions
* Workers' Compensation
SUMMER 2021 | SIU TODAY 7
https://www.hhs.gov/hipaa/for-professionals/index.html
SIU Today Summer 2021

Table of Contents for the Digital Edition of SIU Today Summer 2021
