24-1094m Safeguard Patient Privacy When Sharing Medical Records

Date: 10/11/24

Essential tips for securely sharing patient information

Health Net requires participating physicians and other providers to have a written policy in place that provides for the protection of confidential protected health information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA). The policy must be kept in hard copy or electronic format and must include a functioning mechanism designed to safeguard records and information against loss, destruction, tampering, unauthorized access or use, and verbal discussions about Health Net member information to maintain confidentiality.

Physicians and other providers must agree that all health information, including that related to patient conditions, medical utilization and pharmacy utilization, available through the portal or any other means, will be used exclusively for patient care and other related purposes as permitted by the HIPAA Privacy Rule.

Confidentiality of medical information 

Sensitive services are defined as all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence. It includes services described in Sections 6924-6930 of the Family Code, and Sections 121020 and 124260 of the California Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the services.

Steps to safeguard privacy include:

• Not require a protected individual (member) to obtain the primary subscriber or other enrollee’s authorization to receive sensitive services or to submit a claim for sensitive services if the member has the right to consent to care.
• Not disclose a member’s medical information related to sensitive health care services to the primary subscriber or other enrollees unless the member’s authorization is present.
• Notify the subscriber and enrollees that they may request confidential communications and how to make the request. This information must be provided to enrollees at initial enrollment and annually.
• Respond to confidential communications requests within:
  • 7 calendar days of receipt via electronic or phone request, or
  • 14 calendar days of receipt by first-class mail
• Direct communications (written, verbal or electronic) regarding a member’s receipt of sensitive services to the member’s designated mailing address, email address, or phone number. For protected individuals who may not have designated an alternative mailing address, the provider and/or Plan is required to send the communications to the address or phone number on file in the name of the protected individual.

Confidential communication includes:

• Bills and attempts to collect payment.
• A notice of adverse benefits determinations.
• An explanation of benefits notice.
• A plan’s request for additional information regarding a claim.
• A notice of a contested claim.
• The name and address of a provider, description of services provided, and other information related to a visit.
• Any written, oral, or electronic communication from a plan that contains protected health information.

Access to electronic medical records (EMR)

When Health Net requests access to EMR, the physician or other provider will grant Health Net access to the physician or other provider’s EMR in order to effectively case manage members and capture medical record data for risk adjustment and quality reporting. There will be no other fees charged to Health Net for this access.

Additional information

If you have questions regarding the information contained in this update, contact the Health Net Provider Services Center by email, by telephone or through the Health Net provider portal.
Behavioral health providers can call 844-966-0298.
 

This information applies to Physicians, Participating Physician Groups (PPGs), Hospitals, Ancillary Providers, Community Supports (CS) Providers, Enhanced Care Management (ECM) Providers, and Behavioral Health Providers.

For Medi-Cal, this information applies to Amador, Calaveras, Inyo, Los Angeles, Molina, Mono, Sacramento, San Joaquin, Stanislaus, Tulare and Tuolumne counties.