Health Information Compliance Alert

Question: Are a Medicaid state agency and a Medicare Advantage plan allowed to share protected health information (PHI) to identify dually eligible enrollees? 

Answer: Yes.  Covered entities may disclose PHI for their own payment purposes and/or for the payment purposes of another covered entity. 

Important: The Privacy Rule's definition of "payment" covers any activities designed to determine eligibility or coverage of enrollees, so a Medicaid state agency and a Medicare Advantage plan may disclose PHI about their enrollees to each other in order to identify dually eligible enrollees.

According to the U.S. Department of Health and Human Services (HHS) Web site, electronic inquiries and responses between health plans on enrollee eligibility must be conducted using the HIPAA standard transaction for eligibility. When entities use the standard for disclosures, the Privacy Rule's minimum necessary requirements do not apply to information that is required for the standard transaction to take place.

When entities make disclosures outside of a standard transaction, however, both covered entities--in the inquiry and the response--must make "reasonable efforts" to limit the PHI requested and disclosed to the minimum necessary to identify dually eligible enrollees.