Certified Medical Assistant (CMA AAMA)Communication and Legal/EthicalMedium
A medical assistant receives a phone call from an insurance company requesting detailed information about a patient's recent visit, including diagnosis and treatment plan. The patient has not signed an authorization for this specific disclosure. Which of the following actions should the medical assistant take?
- ATell the insurance company to call the physician directly.
- BProvide the requested information, as it is an insurance company.
- CInform the insurance company that a signed patient authorization is required.
- DProvide only the patient's name and date of service.
Show answer & explanationAnswer & explanation
Correct answer: C. Inform the insurance company that a signed patient authorization is required.
Under HIPAA, detailed protected health information (PHI) can only be disclosed to third parties like insurance companies for purposes beyond treatment, payment, or healthcare operations with a specific patient authorization. Without it, the medical assistant must inform the requester that authorization is needed.
Why the other options are wrong
- A. While the physician may eventually be involved, the initial responsibility of the MA is to ensure HIPAA compliance for PHI disclosure.
- B. Disclosing detailed PHI without proper authorization violates HIPAA regulations.
- D. While disclosing minimal information might seem safer, detailed diagnosis and treatment plan information cannot be released without authorization, even in part, unless it falls under TPO or other permitted uses.
HIPAA Authorization for Disclosure
A HIPAA authorization is a detailed document signed by a patient that permits a covered entity to use or disclose the patient's protected health information (PHI) for purposes other than treatment, payment, or healthcare operations (TPO).
- Must be in plain language.
- Must specify the information to be disclosed, who can disclose it, and to whom.
- Must include an expiration date or event.
- Patient has the right to revoke the authorization in writing.
Memory trick: PHI needs Patient's Permission, not just a phone call.