It’s Friday afternoon. You receive a letter from an attorney. His new client obtained a blood test from your office. This now-former patient initiated a chargeback. He wanted his money back.

But, wait, you performed the test. You have the evidence.

The credit card company wants your side of the story. If you remain silent, it will consummate the chargeback. Then, the patient will have received the service for no cost.

Doesn’t seem fair.

So, you send the credit card company a brief note stating the patient authorized receiving this test and paid the $450 with his Visa card. Please see Exhibit A authorizing the payment. Also, please see Exhibit showing the results of that test.

The credit card company is satisfied you honored your end of the bargain. No refund is tendered.

Now for the attorney.

He writes that “you violated HIPPA.” And he wants $100k to settle this dispute.

Three problems with his line of reasoning.

First, HIPAA is not spelled “HIPPA.” It’s hard to take the attorney seriously if he cannot spell the acronym correctly. HIPAA is short for the Health Insurance Portability and Accountability Act.

Next, HIPAA does not provide an aggrieved party with a private right of action. They can’t collect a check from you. They can file a complaint from the Office of Civil Rights (OCR) for Health and Human Services. And OCR may even fine you. But that does not equate to this patient being paid off.

Finally, you do not need the patient’s advanced signed authorization in certain circumstances. Resolving a financial dispute is one such circumstance. Under the Treatment, Payment, and Operations exception for HIPAA (45 CFR 164.506), a covered entity may, without the individual’s authorization: disclose protected health information for some payment activities. “Payment encompasses the various activities of health care providers to obtain payment or be reimbursed for their services and of a health plan to obtain premiums, to fulfill their coverage responsibilities and provide benefits under the plan, and to obtain or provide reimbursement for the provision of health care.” 

This includes:

• • Determining eligibility or coverage under a plan and adjudicating claims;
  • Billing and collection activities

Payment includes activities undertaken to reimburse healthcare providers for treatment provided to individuals.

“Claims management” also includes auditing payments, investigating and resolving payment disputes, and responding to customer inquiries regarding payments.

The main caveat is to disclose the minimum protected health information necessary to adjudicate the dispute. In this example, sending the bare minimum makes sense. The bare minimum means the credit card slip that the patient authorized the blood test. Next, it includes the documentation the lab test was performed on a specific date and the result was X. You did what you said you were going to do.

Minimum protected health information necessary to resolve a financial dispute does not include sending irrelevant information. So, in the example above, there’s no reason to send the entire chart. This is even more important if the chart includes sensitive information such as history of a sexually transmitted disease, psychiatric disorder, history of substance abuse, and so on.

Now for the tricky part.

Individuals have the right to request restrictions on how a covered entity will use and disclose protected health information about them for treatment, payment, and health care operations. A covered entity is not required to agree to an individual’s request for a restriction but is bound by any restrictions to which it agrees. See 45 CFR 164.522(a). 

If a patient demands, upfront, as a condition of using his/her credit card that you agree not to disclose anything to the credit card company other than the date and amount of transaction, you are bound to honor your word. So, if this patient later files a chargeback, you cannot deliver the test result to the credit card company to demonstrate that you actually performed the test. In this example, you’d be screwed.

But this is Talmudic sophistry. If such a patient makes an upfront demand, just politely say no. You have to reserve your right to adjudicate a dispute. If the patient draws a line in the sand, politely show him or her the door. Such behavior is likely an ominous red flag for future mischief.

Some offices include in their patient intake forms that the patient gives advance authorization to disclose protected health information to resolve a credit card dispute. Is this helpful? Not sure. A patient can always revoke their signed HIPAA authorization. Will such a patient be aware they can revoke their previously signed authorization? Probably not. But if they do, it creates an unnecessary hiccup. It’s easier to just rely on the payment exception afforded under HIPAA.

In sum, there are some reasonable exceptions to HIPAA requirements for receiving a patient’s advanced signed authorization to disclose protected health information. Addressing a chargeback is one of them.

What do you think?

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

Jeffrey Segal, MD, JD

Chief Executive Officer and Founder

Dr. Jeffrey Segal, Chief Executive Officer and Founder of Medical Justice, is a board-certified neurosurgeon. Dr. Segal is a Fellow of the American College of Surgeons; the American College of Legal Medicine; and the American Association of Neurological Surgeons. He is also a member of the North American Spine Society. In the process of conceiving, funding, developing, and growing Medical Justice, Dr. Segal has established himself as one of the country’s leading authorities on medical malpractice issues, counterclaims, and internet-based assaults on reputation.

Dr. Segal was a practicing neurosurgeon for approximately ten years, during which time he also played an active role as a participant on various state-sanctioned medical review panels designed to decrease the incidence of meritless medical malpractice cases.

Dr. Segal holds a M.D. from Baylor College of Medicine, where he also completed a neurosurgical residency. Dr. Segal served as a Spinal Surgery Fellow at The University of South Florida Medical School. He is a member of Phi Beta Kappa as well as the AOA Medical Honor Society. Dr. Segal received his B.A. from the University of Texas and graduated with a J.D. from Concord Law School with highest honors.

In 2000, he co-founded and served as CEO of DarPharma, Inc, a biotechnology company in Chapel Hill, NC, focused on the discovery and development of first-of-class pharmaceuticals for neuropsychiatric disorders.

Dr. Segal is also a partner at Byrd Adatto, a national business and health care law firm. Byrd Adatto was selected as a Best Law Firm in the 2023 edition of the “Best Law Firms” list by U.S. News – Best Lawyers. With over 50 combined years of experience in serving doctors, dentists, and other providers, Byrd Adatto has a national pedigree to address most legal issues that arise in the business and practice of medicine.