HIPAA PROCESS and Medical Collection Agency

[defbright]

I just received a letter from a Medical Collection Agency that has supplied me with a list of medical bills that have not been paid by my insurance company. 

This list of bills is actually a summary of what dr's i had seen and the services provided.  And I do mean DETAILED on the services I have provided.

It is important to note that the medical collection company does work for the hospital i had recieved services at, but isnt it a HIPAA violation for any of my medical information to be released to a person at a collection agency, even if the collection agency is run by the hospital?

Thanks

A Little Distressed at this.

[llecs]

Did they send these out of the blue, or what it part of a request, like a DV?

[defbright]

They just sent them out of the blue. I did not request them.  I had disputed them on the CRA's, they removed them about 4 months ago.  Then all of a sudden I get this big fat envelope last month with all my medical bills on them with descriptive medical information.

[DaBears]

To my knowledge CA's are not allowed to have those medical services listed or have possesion of them, if in face what your stating is true they indeed violated HIPPA Law. 

[guiness56]

1) To the Individual.

A covered entity may disclose protected health information to

the individual who is the subject of the information

[defbright]

Could you elaborate on your response a little bit? I am not sure I am following your response, which I am interested in. Thanks

[defbright]

That is what I thought also.  Thank you for your response

[guiness56]

http://www.hipaasurvivalguide.com/hipaa-regulations/164-502.php

[RobertEG]

As I view the post, it appears to be a HIPAA violation unrelated to and apart from the so-called HIPAA process, and worth pursuing.

HIPAA makes it a violation to disclose specific medical information except to the consumer and necessary health care providers. 

HIPAA does grant a limited permissible purpose for the disclosure of medical information to a debt collector for the purpose of collecting on a debt, but the degree of information they can be provided is still limited by the overall HIPAA prohibition against disclosure of detailed medical information..

The so-called HIPAA process then asserts that once the debt is paid, and thus that permissible purpose no longer applies, the parties in possession of any information, including the debt collector and CRA, must delete that information from their records.   That is down the road, and is not, as I read the post, the issue currently at hand,  which is their prohibited possession of detailed medical info not covered under the debt collection permissible purpose exception.

[guiness56]

It isn't a HIPAA violation as it was sent to the consumer, which is allowed.  It is also from the hospital collections department which is different than a 3rd party CA.

Covered entities include CAs.