claim: patients can circumvent insurance company claim denials by requesting a specific form of documentation, as the insurance company will opt to simply cover the cost rather than provide the paperwork.
question: does a hipaa ‘medical hack’ avoid insurance claim denials?
origin: on 11 december 2015, a facebook user published the above-reproduced image advising:
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  medical hack:
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  so, your doctor ordered a medical test or treatment and your insurance company denied it. that is a typical cost saving method.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  ok, here is what you do:
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  the user indicated that the image was back by “popular demand,” but it didn’t begin appearing in our inbox until december 2015. at that time, its spread on facebook, and the ease with which it promised patients might navigate universally unpleasant medical insurance company morasses, led many to question whether its claims were accurate.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  the image, which appeared with a photograph of a medical professional in scrubs to imply authority on the matter, appeared to convey a simple strategy not exclusive to dealings with insurance companies. by simply overwhelming your adversary with onerous or difficult to attain requests, you might encourage their compliance on a separate, smaller request. the tactic is common and often invoked to beat bureaucratic entities at their own game, often with mixed results.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  while the meme appears concise, it carries a number of specific legal, medical, and insurance-related claims. it began by referencing “cost saving” denials made by insurance companies irrespective of medical necessity; an example of such a practice was rescission, since banned under the provisions of the patient protection and affordable care act of 2012, most commonly known as “obamacare.”
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  in its first point, the meme directs patients to call their insurance companies (department or division unspecified) and request to speak with the “hipaa compliance/privacy officer,” a position it asserts is required by federal law of all insurance companies, presumably under the health insurance portability and accountability act of 1996, or hipaa. however, while it’s true that insurers are required to have someone on hand who can explain hipaa-related issues to customers, they aren’t required to dedicate people solely or specifically to that task, nor identify them as “”hipaa compliance/privacy officers.”
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  pdf]. whether calling any individual insurer and requesting to speak with an agent of that description would benefit patients was unclear; calling all insurers to check for access to a hipaa compliance officer would be difficult for any party.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  -->
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  once a patient makes contact with an insurance company’s “hipaa compliance officer,” step two claims that that person is obligated to supply the “names as well as credentials of every person accessing your record” in order to have reached the initial decision of denial.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  again, it’s true that hipaa regulations mandate that patients be able to obtain information about who has accessed their medical records, those regulations don’t require insurers to provide the credentials of every such person.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  an individual’s right of access generally applies to the information that exists within a covered entity’s designated record set(s), including: (1) a health care provider’s medical and billing records, (2) a health plan’s enrollment, payment, claims adjudication, and case or medical management record systems, and (3) any information used, in whole or in part, by or for the covered entity to make decisions about individuals. a record is any item, collection, or grouping of information that includes phi and is maintained, collected, used, or disseminated by or for the covered entity. see 45 c.f.r. § 164.501 (definition of “designated record set”).
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  also of note was a provision of the aca pertaining to rights of access to medical records. under that law, insurers maintained the right to demand such requests be submitted in writing, complicating the balance of advice provided in the meme:
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  the covered entity must permit an individual to request access to inspect or to obtain a copy of the protected health information about the individual that is maintained in a designated record set. the covered entity may require individuals to make requests for access in writing, provided that it informs individuals of such a requirement.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  the meme's second point specifically stated that individuals were entitled to the names and credentials of every person who had accessed their health record in the course of an insurer's decision to deny coverage. however, those terms weren't as clearly laid out in hipaa's "right of access" documentation [pdf]. moreover, sufficient flexibility existed for insurance companies under hipaa specifically to skirt compliance, allowing for broad discretionary denial of access:
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  a covered entity may decide, for example, to categorically deny access to certain types of information to which no access right exists, such as psychotherapy notes. the privacy rule would permit denial without review, and a case-by-case judgment would not be necessary. similarly, the covered entity may make such a system-wide decision with respect to other types of protected health information where the privacy rule permits an unreviewable denial of access. in contrast, reviewable grounds for denial of access require decisions be made on a case-by-case basis through the professional judgment of licensed health care providers. professional judgment also would be required if individuals exercise their right to appeal a denial of access made on reviewable grounds. as computer logic cannot be a substitute for professional judgment in these cases, these types of activities cannot be carried out categorically or in an automated way. neither could these decisions be delegated to a health information organization (hio), unless a licensed health care professional at the hio were assigned the task of making the access determinations.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  in short, hipaa expanded an individual's right to healthcare records (including information used to deny coverage of a service or drug), but broad and ambiguous exemptions existed, rendering that protection of limited value. as with step one of the meme, step two could conceivably work -- but the number of variables (such as type of treatment, criteria on which the decision was based, or a company's unique pattern of adherence to hipaa) made it impossible to definitively declare the tactic universally applicable.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  -->
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  step three of the meme assumes that steps one and two can be achieved without question. it holds that under the conditions described, health insurers will almost always opt to reverse the decision rather than provide information to which the patient is entitled under federal law. whether such an entitlement existed is debatable (and likely variable) and whether the insurance company would indeed choose a path of ostensible least resistance is again impossible to predict. the third section further claims denials of coverage were invariably made by “low paid hs graduates,” not medical doctors of a relevant specialty.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  this portion appeared to suggest that insurance companies are bound by law to base decisions to deny coverage of services or medications on the decision of not just a doctor, but a doctor that is board certified in the specialty under which that treatment fell. we were unable to substantiate that assertion. in the large number of provisions attached to both hipaa and obamacare, none appeared to mandate that denial of coverage decisions be based on a doctor’s review. similarly, we found no evidence that should such a convention be widely observed, documenting it would be difficult: if the law required physician supervision in compliance with hipaa, insurance companies more than likely provided for that in the structure under which they issued coverage denials.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  ultimately, information on how such decisions were reached didn’t appear to be widely available (the image tacked on an assertion that “they” don’t “want you to know” the process), but the basic underlying assertion didn’t seem to be supported by existing laws. as such, the opacity of the process may be less deliberate obfuscation, and more a simple absence of related legal structure — if insurance companies are entitled to deny coverage on a discretionary basis without the say-so of a doctor, there’s no reason a non-mandated process would be outlined through any plan resource or hhs guideline. asking for such documentation would make as much sense as someone demanding a receipt for a donut you didn’t buy. consistent across the board in all healthcare law was a mandatory stipulation all denials must be issued to patients in writing; no language specified such denial decisions must be reached by a doctor or specialist.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  finally, in step four the meme instructs patients to report any refusal (presumably with respect to the requested information) to the office of civil rights (ocr) as a hipaa violation. according to the u.s. department of health and human services (hhr), that is correct — suspected hipaa violations can be reported by anyone to that agency. however, whether the documentation listed constituted a hipaa violation remained unclear; doing so would perhaps result in outside review of a patient’s appeal, but not likely in a timely fashion.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  armed with a freshly issued prescription coverage denial from our own health insurer, we contacted them on 15 december 2015 to see if following the steps in the meme worked. the customer service agent with whom we spoke repeatedly stated she was unaware of any such entity within the company titled “hipaa compliance [or] privacy officer.” we asked whether there was a broader department with whom we could lodge such a request; she indicated that our only recourse involved officially appealing the decision. when we asked whether we could obtain a list of names and credentials for the individuals on the panel responsible for the decision, she indicated that fulfilling such a request was not possible, adding that the panel was made up of “medical professionals and pharmacists familiar with the relevant treatment.”
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  unlike most partially correct advice memes, the shakeout of the “medical hack” meme wasn’t necessarily of limited value. anyone who has navigated the complex intersection of hipaa, obamacare, insurance companies, and authorizations is likely familiar with how truly arbitrary such decisions and reversals often can seem. utilizing the advice as presented in the meme is unlikely to worsen a patient’s experience after they’ve been denied a test or treatment, but the cumulative presented advice was no guarantee of success in securing a successful appeal of denial. the largest risk appeared to be wasting time on the phone attempting to elicit such a decision, but similarly, it wouldn’t hurt to try before exploring other options. given all available information, however, insurance companies routinely made every attempt to follow the letter of the law (if not its spirit) and remained largely compliant; hoping for a chink in that armor could well be a long shot.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  we have big plans. we need your help.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  © 1995 - 2020 by snopes media group inc.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  this material may not be reproduced without permission.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  snopes and the snopes.com logo are registered service marks of snopes.com
comment: a "hipaa medical hack" likely won't help you circumvent a denial of coverage notice issued by your health insurer.
summary: a facebook meme advised patients to call their insurance companies and ask to speak with a "hipaa compliance/privacy officer" while it’s true that insurers are required to have someone on hand who can explain hipaa-related issues to customers, they aren't required. the meme also claimed that individuals were entitled to the names and credentials of every person who had accessed their health information.