Existing Wording: Some payers create a complete clinical record for each of their members to facilitate data exchange with providers. Payers use this clinical record to give providers the adequate information to execute care coordination decisions.

They also use clinical information gathered from providers to support the HEDIS/Stars quality program. For example, by examining the record for care coordination information they may improve performance on the HEDIS TRC- Transitions of Care measure which looks at 1) notification of inpatient admission, 2) receipt of discharge information, 3) patient engagement after inpatient discharge and 4) medication reconciliation post-discharge.

Proposed Wording: Under HIPAA Operations purpose of use, payers may create a complete clinical record for each of their members to facilitate data exchange with providers. Payers use this clinical record to give providers the adequate information to execute care coordination decisions. Such records must be labeled with HL7 security label tag for Operations so that providers and downstream users understand that this record is shared for HIPAA Operations purpose of use and not for payment or treatment as these purposes require specific relationships between senders and receivers. See https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html

Comment:

While increasing the authorized flow of information among providers and payers is critical for improving care coordination and efficacy, retaining the trust of patients that these flows will adhere to applicable laws is equally important.

Recipients of information under HIPAA Operations must not be mislead into thinking that this information is intended for treatment purposes.

Even with thorough Provenance Records for this information, providers should be cautioned about relying on this information for clinical purposes.

For this reason, please include information about how HL7 security labels for purposes of use can be used by implementers to ensure that senders and receivers are able to comply with applicable policies.

Summary:

While increasing the authorized flow of information among providers and payers is critical for improving care coordination and efficacy, retaining the trust of patients that these flows will adhere to applicable laws is equally important.