[divemedic]

I was referred here from the Credit Info Center Forums. My screen name there is divemedic.

I have a question that no one there could answer, and I have searched here and could not locate an answer, so I hope we can put our collective heads together to find the answer.

Midland Funding has been buying receivables from the Orlando Regional Healthcare system and farming them out to various CA's. It is my opinion that the sale of medical records is a HIPPA violation, but I have not been able to find back up for that opinion. I hope someone here can.

I understand that disclosure of PHI is permitted for certain purposes, but I think that the outright SALE of PHI is not in the spirit of HIPPA.

Opinions?

[jlynn]

Enigma can probably help you. He has extensive knowledge/experience with Hipaa, especially in Florida.

[JayinGR]

Ok I am no expert on this by any means but DW has worked in the Medical feild for 1 years now and I am often not agreed with on this subject on DB so I mainly stay out of it.

By records what exactly do you mean?

DW says "When you go to a physicians office or hospital or even the dentist [have to ask aunt on that one] they give you their hipaa policy and you are supposed to read it and sign a copy that you have reviewed it. In that hipaa policy it says who that they will make disclosures to and some of them maybee the majority of them include whatever it involves to collect on the bill".

DW says it is not a violation of HIPAA to disclose to a CA "Patient name, demographics, insurance ID number, procedure date, procedure code, diagnosis code and the amount charged".

DW says "They can also disclose information to the county health dept if someone has a communical disease or if it involves criminal activity"

I hope this helps.

[Lucy]

This may not help you any but it is interesting reading nontheless.

http://www.privacyrights.org/fs/fs8a-hipaa.htm#9

[spinn]

I hope you can find something there.....

If you look on page 23 of this report: http://www.federalreserve.gov/pubs/b...3/0203lead.pdf

You will see that more than half of all collection activity is for medical debt.

Soooooooo Doctors charge 4 times as much as any other profession, rarely cure anyone of anything and then poison your credit report. Sorry about the negativity but they really are hurting us.

[divemedic]

Originally Posted by JayinGR

DW says "When you go to a physicians office or hospital or even the dentist [have to ask aunt on that one] they give you their hipaa policy and you are supposed to read it and sign a copy that you have reviewed it. In that hipaa policy it says who that they will make disclosures to and some of them maybee the majority of them include whatever it involves to collect on the bill".

I understand billing. What I am talking about is that the medical provider has SOLD the account, along with the PHI attached to it, and no longer has control over that PHI. This is not billing, as the account and the PHI has been sold.

I am hoping to see if someone knows if I am correct, or if I am barking up the wrong tree.

Thanks all of you- keep up the good fight!!

[Enigma]

It is not a HIPAA violation and there is no private right of action in HIPAA. It was written that way.

Now it is a violation of FL law for a medical provider to disclose your PHI to anyone without your consent. It is written in the state statutes and there is case law.

If you provide me your email address I can send you my working file on FL medical debt.

[Enigma]

Have a look at these:

[Enigma]

and this:

[hannah]

I remember this from AoC...but the question is not whether a med bill can be sent for collection to a CA as the law doesn't allow for it, but can it be sold to a JDB? Since you must consent, wouldn't the selling of a medical bill be a violation of Florida law? Or is there a way for a JDB to collect without knowing squat about an account other than name and amount? They could never validate so I don't see the point in them buying a medical account in Florida. Must not have done their due diligence before deciding to buy those accounts...

This is an interesting case Divemedic...I sort of hope they sue so you can set caselaw...please keep us updated.

[Enigma]

There is case law, further a well known TX CA paid me a very handsome sum to settle a lawsuit. NDA in force.

[divemedic]

I know that HIPPA does not have a private right of action. My point here is that IF you can prove that selling and purchasing PHI is a violation of HIPPA, then everything that comes after (collection activity) is an FDCPA violation, as the collection itself is illegal. This would also allow you to pursue administrative remedies against the medical provider for selling your PHI.

The JDB does have some PHI, as they have a detailed bill that they sent me during the DV process.

In my case, they cannot sue, as the SOL has run on this 6 1/2 year old debt. The funny thing is, this debt has already been passed through two other CA's, and both have written me checks.

Just a thought.

[drivel]

Your'e name is considered PHI under federal law. Enigma and I have been around the block on this one. My opinion is that Florida Law prohibits Medical records and medical conditions from being disclosed for collection. (this is the wording of the statute), I don't believe you can make the leap to what Enigma says, that you cant be sent to collections in florida. HIPAA, like every statute is eaten up by the exceptions. PHI, your name, dates of service and balance, can be disclosed for payment purposes without your permission as they are not considered medical records.

Also, hospitals and providers are REQUIRED under federal law to make efforts to collect Medicare co-pays and deductibles, If what Enigma says is true, we have a good conflict of law situation. Also, given the age of HIPAA, wouldn't there be definitive caselaw interpreting the plain language of the statue holding that you can't be sent to collections for medical bills in Florida.

As for whether medical accounts can be sold, until I hear otherwise, i assume this falls under the payment exception to HIPAA although since the provider is ultimately responsible for the use and disclosure of PHI, I dont' think this is a wise move.

[mtnair]

I thought you could revoke authorization in writing (to doctor) to stop any future use and disclosure of your information.

[Enigma]

I did not use HIPAA as a COA, I used FL statutes and won. Medicare and Medicade are different animals all together.

The hospital in my case sent my entire medical file to the CA when I DV'd them.

And yes, under FL law payment and name is considered PHI and is non-disclosable per statute and now case law.

Even though I settled in my casem we asked the judge on she would have ruled and she would have ruled in our favor.

[Enigma]

Originally Posted by mtnair

I thought you could revoke authorization in writing (to doctor) to stop any future use and disclosure of your information.

You can under HIPAA, but FL law trumps HIPAA, that is how HIPAA is written.

[drivel]

Originally Posted by Enigma

I did not use HIPAA as a COA, I used FL statutes and won. Medicare and Medicade are different animals all together.

The hospital in my case sent my entire medical file to the CA when I DV'd them.

And yes, under FL law payment and name is considered PHI and is non-disclosable per statute and now case law.

cites please.

Even though I settled in my casem we asked the judge on she would have ruled and she would have ruled in our favor.

[Enigma]

UNITED STATES, ex rel. SCOTT POGUE Plaintiffs, v. DIABETES TREATMENT CENTERS OF AMERICA, et al. Defendants. 2004 U.S. Dist. LEXIS 21830, 2004 U.S. Dist. LEXIS 21830

From the cite:

While generally preempting contrary state law, HIPAA does not preempt state law that is "more stringent" than the requirements that it mandates. See 42. U.S.C. §§ 1320d-2, 1320d-7.

Specifically, state law is not preempted where: (1) state law is contrary to HIPAA; (2) relates to matters of individually [*11] identifiable health information; and (3) is more stringent than the HIPAA requirements. See 45 C.F.R. § 160.202. For the following reasons, the Court finds that Florida law is not preempted by HIPAA, and, therefore, any discovery of the medical records of Florida patients must comply with Florida law governing such disclosures.

First, Florida laws governing patients' privacy rights in medical information are contrary to HIPAA. HN2 A state regulation is contrary to HIPAA when: (1) it would be impossible for a covered entity to comply with both state and federal law; or (2) compliance with state law would preclude full execution of the purpose and objectives of HIPAA. See 45 C.F.R. § 160.203. Here, whereas HIPAA permits a covered entity to disclose patient information subject to an appropriate protective order, HN4 Florida law only permits disclosure pursuant to court order after reasonable notice to non-party patients, thus imposing additional requirements upon the party seeking the disclosure and the covered entity attempting to comply with the disclosure requirements. See Fla. Stat. Ann. 395.3025(4)(d) [*12] . As such it would be impossible for DTCA to comply with Florida law, which requires the additional step of notification, and HIPAA simultaneously.

Second, the parties do not dispute that this matter involves state law that relates to the privacy of individual identifiable health information, which HN5 HIPAA defines as information that has the purpose of protecting the privacy of health information, or affects the privacy of health information in a direct, clear, and substantial way. See 45 C.F.R. § 160.202. Here, the requested disclosures reveal specific and explicit information about patients identified by name, birth date, social security number and the like and are, in important part, for the purpose of attempting to establish a pattern of improper medical treatment and billing practices, clearly satisfying definition provided for in § 160.202 by invading patient privacy rights in a direct, clear and substantial way.

Third, Florida law is also more stringent than HIPAA. Contrary to Relator Pogue's assertion, HN6 only one of the criteria in § 160.202 need be met in order to find that a state law is more stringent than the requirements of HIPAA. See [*13] HN7 45 C.F.R. § 160.202 (stating that "more stringent means, in the context of a comparison of a provision of State law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, a State law that meets one or more of the following criteria: . . . "). As relevant to the instant case, HN8 a state law is deemed more stringent than HIPAA when it "prohibits or restricts a use or disclosure otherwise permitted" under HIPAA. See 45 C.F.R. § 160.202. Here, whereas HIPAA would allow disclosure without non-party patient notice, Florida law requires such notice, and thus prohibits or restricts a use or disclosure that would be permissible under HIPAA.

Therefore, because Florida law is contrary to HIPAA, relates to matters of individually identifiable health information, and is more stringent than HIPAA, it is not preempted by HIPAA and DTCA must comply with the law governing Florida patient privacy. HN9 Florida law requires, in relevant part, that:

(4) Patient records are confidential and must not be disclosed without the consent of the person to whom they pertain, but appropriate [*14] disclosure may be made without such consent to:

(d) In any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice by the party seeking such records to the patient or his or her legal representative.

Therefore, HN10 pursuant to Florida law, medical records originating from this state may only be disclosed if: (1) redactions are sufficient to prevent disclosure of private patient health information orprotect the privacy of health information in a direct, clear, or substantial way; (2) with patient consent; or (3) upon proper notice to the non-patient party so that he/she may obtain legal representation
on be heard on the issue of disclosure. Therefore, Relator Pogue's motion to compel the un-redacted disclosure of Florida medical patient information is denied, and the 2002 Protective Order, is hereby amended accordingly.

It is a violation of FL law for a FL medical provider to disclose the name, address, SSN or other information of a patient without his/her or his/her legal representative knowledge.

On a broader note, Midland is not a registered collection agency or debt collector in the State of FL. Midland was spanked in several recent small claims cases for that very violation. From what I understand the Office of Financial Regulation and the SAO are currently investigating Midland.

So if Midland buys FL debt, that is a violation of Chapter 559 FS, it is another violation if it is medical. It is another two violations (medical and Midland not registered) if they farm it out, another two violations (medical and Midland not registered) if a third party hired by Midland tries to collect and it is a violation if the report it to a CRA.