Must a health insurance in the United States provide a listing of procedure and diagnosis codes that are covered upon request? I wonder whether a health insurance in the United States must provide a listing of procedure and diagnosis codes that are covered, if requested by a policyholder? In my opinion, the listing of procedure codes that are covered should be part of the health insurance contract, and subsequently be made available to the policyholder, but the health insurance I am in discussion with (namely Blue Cross Blue Shield of Massachusetts) seems unwilling to provide such a list (see below for the exact message they sent me). I am mostly interested in the following locations: California, United States Massachusetts, United States Here is the message I received from my health insurance, Blue Cross Blue Shield of Massachusetts, when I asked them "Where can I find the list of all procedure codes, marked as covered or not covered by my insurance plan?": We do not have a listing of procedure codes that are covered or not covered that we can provide you with. We can check on certain procedure codes when they are provided to us, to see if they are covered based on medical policy guidelines. If you have codes from your provider you can contact us to check on them for you, however, the best way to find out is for the doctor to call provider services to confirm coverage. More details after further insisting: The procedure code alone is not what determines if a service will be covered, it is just one piece of the puzzle. Claims are billed with a procedure code and a diagnosis code. The procedure code is what tells us what service is done, and the diagnosis code tells us why. Not only does the procedure code need to be related to a covered service, but the reason for the service (the diagnosis) needs to indicate that the service was medically necessary. We do not have a list of all covered procedures and the related diagnosis codes and we are not clinically trained to determine medical necessity. Typically, it is the doctor’s responsibility to verify if the services are covered and that they are medically necessary. We can research the procedure code that the doctor plans to bill with to see if it is a service that we would potentially cover, but we cannot advise you if it is medically necessary. ADDITIONAL EXAMPLE To illustrate that this same problem goes beyond California and Massachusetts, here is an additional example from North Carolina where the insurance company attempting to excuse itself from providing procedure codes. The excuse is that the codes are "PHI" (protected health information). Of course the entire contents of the EOB, not just the codes, are "PHI", so the reasoning is laughable. And the letter is coming from UnitedHealthcare's "Regulatory Consumer Advocate"!
The health insurance contract should set forth what is and is not covered in detail (in addition, there would be a short summary version). They probably don't have to provide procedure codes that are covered or not covered because no such one to one correspondence exists because the language of the insurance contract is controlling and does not exactly correspond to procedure codes. For example, one of the basic eligibility questions is whether a procedure is medically necessary. A procedure may be medically necessary for one person, but not for another, and usually a denial based upon medical necessity is subject to appeal to other medical professionals engaged by the insurance company. Unless the insurance contract provides that an EOB must contain procedure codes, it probably doesn't have an affirmative obligation to do so, because there is no general principle of law that would require them to disclose their internal classification of services provided outside of a litigation context. And, in a litigation context, you probably could obtain procedure codes in discovery from the insurance company, as the code assigned to a procedure on an EOB would almost surely not be privileged or a legally protected secret. It may very well be that the company has an in house set of procedures for certain common diagnosis codes that are routinely allowed or are flagged for review by an insurance company bureaucrat. But, that would ordinarily be considered something of a trade secret of the company and is not a statement of what is or is not allowed under the actual health insurance contract. However, the privilege against disclosing the information in that context would flow from trade secret law and not from the fact that they are PHI. I don't agree that PHI is the correct reason for failing to disclose that information (unless some case law of which I am not aware has interpreted it differently). The federal law definition of PHI is at 45 CFR 160.103: Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years. The cross reference to 20 U.S.c. 1232g(a)(4)(B)(iv) reads as follows: (iv) records on a student who is eighteen years of age or older, or is attending an institution of postsecondary education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice. In short, it is B.S. that you are being given an illegitimate reason for not complying with your request, but it is probably still within the company's rights for other legitimate reasons to deny your request.
As a short answer, guidance from the Department of Health and Human Services has clarified that HIPAA does not require hospitals to provide separate rooms. As a longer answer, HIPAA is very deeply misunderstood. It does not prohibit "leaking" patient information; it prohibits unreasonable and unpermitted disclosures of protected health information (PHI). Among the PHI disclosures that are permitted are uses that are for the purpose of delivering medical treatment. Of course, the covered entity (in this case, the hospital) is required to take reasonable measures to safeguard that information. One of the areas that trips people up is figuring out exactly what it is we're safeguarding that information from. A lot people assume that the HIPAA imposes an absolute rule against disclosure of PHI, but it's more accurate to say that HIPAA requires reasonable safeguards against the unauthorized use of PHI. With that standard in mind, it becomes easier to see why you don't need to universally separate patients. In all likelihood, neither you nor your roommate is likely to use the other's PHI in any way not allowed under HIPAA. We can look at your question as proof: You've disclosed a person's health condition and medical history, but you were a reasonable person and omitted the man's name, birth date, record number, and anything else that might allow us to link that information to an individual. Hospitals -- and the law -- recognize that most people have no interest in a random strangers' medical information, let alone plans to do something nefarious with it. Because there isn't much of a threat there, the hospital isn't required to take exhaustive measures to protect the information. But when you put all that information for every patient for every doctor for every department for every hospital into a single database, the information starts getting a lot more valuable. That's why there are much tighter regulations surrounding protection of electronic records. Of course, the roommate situation might be different if the hospital had a patient that they somehow knew had a history of identity theft or even a history of disclosing PHI. I've never heard of this happening, but I'd imagine that that knowledge would require the hospital to either segregate that patient or otherwise take extra care to avoid disclosing any information about a roommate.
Employees of an employer aren't governed by a fault based liability regime in the United States (subject to some usually quite narrow exceptions that vary from state to state, which sometimes also limit tort liability). Instead, employers are required to have worker's compensation insurance policies in place, in exchange for not having any tort liability whatsoever to employees. (An employer who doesn't have worker's compensation in place is strictly liable to the worker for all injuries suffered by an employee whatsoever at work, without the prohibition of a worker's compensation insurance policy plan on paying things like pain and suffering damages as well.) Worker's compensation insurance provides coverage (in principle) for all medical costs incurred, all lost wages, and in the event of a death support for dependents if any and a modest death benefit sufficient to provide a funeral if there are no dependents. Often, in practice, worker's compensation insurance payments tend to be rather stingy. One of the most common big worker's compensation claims these days, especially in office and retail workplaces, is for employees who are seriously injured or killed in crimes at work. Often, a worker's compensation insurer will give an employer a discount if they have a "gun free" zone, because, statistically, doing so greatly reduces the average amount of harm experienced by employees at work. The presence of employees with guns in the workplace, as an actuarial matter, greatly increases the insurance company's risk of having to pay claims.
http://www.healthinfoprivacybc.ca/confidentiality/when-can-and-cant-they-tell-others is a pretty good summary. Different rules apply to private practices than public clinics and hospitals. I will assume that the clinic on campus is private. This is a summary of the summary about who your information can be shared with: Health care professionals can share information within your "circle of care". Specifically, they are allowed to assume your consent to this but you can explicitly withdraw that consent. This would include doctors within the same practice. Admin staff can access your information for administrative purposes. Anyone you have authorised them to share it with e.g. relatives, friends etc. The Medical Services Plan for billing and admin If you are unable to drive If there is suspected of child abuse If you are wounded by a gun or a knife If you are a danger to others For your specific questions: I asked about it and they said it's confidential, but confidential to the clinic. Correct, unless you explicitly revoke this. the counselling department can share information with the doctors This is tricker, these people may be either within your "circle of care" or they may be part of the same organisation. Notwithstanding, councillors are not doctors and are governed by the everyday laws related to confidentiality i.e. information given in confidence is confidential and everything else isn't. If you are told the limits of the confidentiality i.e. they tell the doctor, then those are the limits unless you renegotiate them. he would know I only have one kidney? Well you said "the counselling department can share information with the doctors" and this would require the information going the other way i.e. the doctor sharing with the councillor. Even if this type of sharing was OK in general (and I'm not sure it is, see above); the information shared should only be what is required for the councillor to do their job - the number of kidneys you have is probably irrelevant to this. What laws apply to situations like this where confidential information in one entity (medical office) decides to share it without the consent of the patients to another entity (the counselling dept.)? Well, we are not sure there are 2 entities: legally there may only be 1 - the university. Anyway, the laws are the Personal Information Protection Act and common law (Smith v. Jones, [1999] 1 SCR 455)
HIPAA imposes obligations on some people, but not all people. In the case of security and privacy questions, you would consult 45 CFR Part 164. A patient's actions are not subject to government sanctions, so a patient can provide or decline to provide email addresses following their own judgment. A healthcare or insurance provider would be required to securely keep PII under wraps. The regulations also do not impose obligations on unknowing potentially involved third-parties, i.e. no obligation is imposed on Google to know that an individual is using a Gmail account to transmit PII-related information. The medical provider has an obligation to store and transmit such information securely, which would mean for example that they do not send insecure plain text emails saying &quot;Sally Jones at 12345 67th Ave SW was treated for a loathsome disease, we're coding that as 0102, and we want $500&quot;. That obligation is passed on to employees via employment-contractual obligations, for example that may dictate what computer or software you can use to do the job. If the provider passes the buck to the employee (and I assume that the employee is just an employee), they have violated the security rule. In that case, they may be attempting to mitigate the consequences of their actions or at least check if there were identifiable violations of the privacy rule. In the scenario where SmithMed provides all of the infrastructure needed to bill insurance companies, it is not a HIPAA violation to inspect computer logs, email etc. to verify that the employee has been complying with security and privacy policies. It would likewise not be a HIPAA violation to inspect third-party accounts (Gmail etc) to determine whether there has been a security / privacy rule violation. That is as far as HIPAA takes you. Whether or not the ex-employee has an obligation to turn over their email account information is mostly determined by the employment contract, but it is highly unlikely that any such contract has a &quot;gimme your personal email on termination&quot; clause. It is not inconceivable that the employee negligently used their personal account rather than opening a new billing-job only account. Also depending on the email service provider, it may well be a violation of the terms of service to hand over your account information. (Instead, for a certain email provider, the company is expected to set up and pay for a company account). Those are considerations bearing on possible legal impediments to turning over the email information. Needless to say, don't share passwords etc. because that exposes you legally, but that is not about HIPAA.
Can people with low incomes qualify for free medical care (Medi-Cal) in California regardless of their assets? For some programs, but not others. The main exception, discussed below, is the Medicaid expansion component of Obamacare (a.k.a. the Affordable Care Act). One of the exceptions to the general rule considering property is as follows: The Affordable Care Act introduced a new methodology – Modified Adjusted Gross Income (MAGI) – to define a family’s size and count income in order to determine eligibility for insurance affordability programs. 42 U.S.C. § 1396a(e)(14). As a result, household determination and income counting rules are largely aligned among Medi-Cal, the Medi-Cal Access Program (MCAP, the low-cost health insurance for moderate income pregnant women), and Covered California, with some exceptions. For Medi-Cal, the MAGI rules apply to the following programs: Expansion Adults (adults aged 19 through 64); Parents and Caretaker Relatives; Pregnant Women; and Children. Medi-Cal’s Tuberculosis Program and the Refugee Medical Assistance program also now use the MAGI income methodology. See Welf. &amp; Inst. Code 14005.20(b)(2) and ACWD 15-16 (Mar. 20, 2015), http://www.dhcs.ca.gov/services/medi-cal/eligibility/Documents/ACWDL2015/ACWDL15-16.pdf. These programs, however, are not considered MAGI Medi-Cal in the Medi-Cal hierarchy because they are limited in scope or duration and should only be used when an individual is not eligible for any other form of free Medi-Cal. In general, unless an individual gets Medi-Cal through a linked program such as SSI or CalWORKs, or due to former foster youth status, Medi-Cal eligibility is reviewed for the MAGI programs before looking to the Non-MAGI programs. Outside that Obamacare program, someone can have significant assets of types that are exempt from consideration (e.g. in the Medicaid nursing home program), but they cannot qualify regardless of their assets. The exact extent to which assets are disqualifying varies by subprogram, with ordinary Medi-Cal, the nursing home program, and the CHIP program for children, having different requirements. The key language is &quot;countable asset levels&quot;. This is defined in a combination of state statutes and regulations which in turn are enacted in order to comply with federal Medicaid program requirements. Only some assets count for purposes of Medi-Cal eligibility. In particular, a personal residence, a single motor vehicle, certain household goods, certain retirement assets, certain cash value in life insurance policies, and investment assets that don't generate current cash income and are impracticable so sell in a timely manner at anything approaching their true value because they are illiquid for some reason or other, don't count. Exactly what does and does not count as a countable asset for purposes of Medi-Cal eligibility is a rather technical and detailed matter because there are some many different kinds of assets out there and the rules address them on a type by type basis. The most common exemptions are set forth here: The main regulations for the Department of Health Services that govern this are found here and here. More legal sources are found here. These primary sources, alas, aren't organized in a very user friendly way. In part, this is because the Medicaid Rules incorporate by reference (with modifications) the rules for the Aid To Families With Dependent Children (AFDC) and Supplemental Security Income (SSI) rules, rather than restating them with the modifications include in full. So the chart on the form is assembled from a mishmash of state and federal regulations in multiple locations. I didn't find a chapter and verse citation for a few kinds of non-countable assets but know they exist from continuing education classes and practicing in the area.
In the US, people are generally allowed to charge arbitrary amounts for services, as long as they do not violate various anti-discrimination laws in doing for. For example it would be illegal to charge people of one race less than they charge people of another race, because of federal and state anti-discrimination laws. Three primary factors govern the legality of a particular form of discrimination. One is the type of interaction, for example "voting rights", "public accommodation", "employment", "housing" – medical treatment would generally fall under "public accommodation". The second is jurisdiction – there can be federal, state, and municipal laws governing a particular kind of discrimination (the lower in the hierarchy you go, the stricter the laws tend to be). Finally there is the "protected class", that is, the basis for discrimination. Protected class is extremely variable, given the preceding two factors. Age discrimination is legal in ways that race discrimination is not. "Has insurance" is not a protected class anywhere, so this does not violate any discrimination laws (per se). There are numerous legal forms of discrimination which are analogous, for example to shop at Costco at all, you have to be a member; there are numerous businesses that offer "member discounts"; some doctors work on a "subscription" basis where they don't treat you unless you are a (paid) service subscriber. The idea that a service has to treat all comers identically is legally incorrect. Co-pay rates are dictated by insurance companies, and can vary depending on the specific insurance carrier that you have. To the extent that there are no specific laws saying otherwise, a service provider is legally entitled to charge less to a person who does not make a claims for coverage by medical insurance – or they could charge more. Indeed, the "without insurance" cost of medical services is typically higher, and the insurance company insists on doctors accepting lower compensation. A "practical" but somewhat risky solution is that if you know that the copay is higher than the street price, you can simply not reveal that you have insurance. However, sometimes an office visit results in a finding that some treatment is needed, and the street price for that treatment may be substantially higher than the insured price. At any rate, contractually-determined co-pays are legal. I should mention a remote possibility for applying anti-discrimination laws, owing to sec. 1557 of ACA. See this article on health care discrimination litigation, where the law enabled "private right of action for disparate impact claims opens the door to class-based claims challenging facially neutral health care policies, treatment decisions, and insurance coverage on the basis that they disproportionately affect members of protected classes". Under this regime, if a policy effectively discriminates on the basis of a protected class, without explicitly mentioning the class, the policy could still be found illegal. If there is a strong enough correlation between race and having health insurance, then "having health insurance" could be found to be a substitute for discrimination on prohibited grounds. There isn't enough case law on this issue, that we can clearly say that such an argument would or would not work.
There is not enough detail on the plan to say anything yet. But it is important to understand that the Canada Health Act is not an obligatory law but outlines conditions for provinces to receive significant federal contributions to their budget. Even if the conditions are breached, the federal government would be the only one who has the power to do anything, unlike a Charter violation that gives individuala a cause of action. It likely does not breach the prohibition of user charges: 2 [...] user charge means any charge for an insured health service that is authorized or permitted by a provincial health care insurance plan that is not payable, directly or indirectly, by a provincial health care insurance plan, but does not include any charge imposed by extra-billing. [...] 19 (1) In order that a province may qualify for a full cash contribution referred to in section 5 for a fiscal year, user charges must not be permitted by the province for that fiscal year under the health care insurance plan of the province. [...] since the plan is to impose a financial charge on all vaccinated and such charge is not tied to their access to or actual usage of the public healthcare system. The accessibility criterion may be another ground of breach: 12 (1) In order to satisfy the criterion respecting accessibility, the health care insurance plan of a province (a) must provide for insured health services on uniform terms and conditions and on a basis that does not impede or preclude, either directly or indirectly whether by charges made to insured persons or otherwise, reasonable access to those services by insured persons; [...] But again, it is the access or the provision of services that matters, the other side of equation is not directly touched except that any charge or other measures, if there is any, should not impede or preclude reasonable access to healthcare. However, even if it does not violate the letters of the law, it violates, in my opinion and when framed like a tax on unvaccinated, the spirits of a universal, accessible health system underpinned by the Act, which is one of the political arguments against the plan. It would be much harder to argue against the fiscal equivalent, though. A bonus for vaccination would likely be much more politically and legally acceptable and less controversial.