Q: If I help my patients get into patient assistance programs with drug companies by sending in their records, am I violating HIPAA?
A: Logically, it would seem that releasing PHI for this purpose would be a disclosure for treatment purposes as the “coordination or management of healthcare by a healthcare provider with a third party” and so would not need an authorization from the patient under the Treatment exception in the Privacy Rule, but logic does not always win the argument, particularly with regulatory statutes.
Since this is not a situation under which you could get a Business Associates Agreement from the drug company that says that they will handle any PHI that you give to them properly (ie, you being a prescriber is not a business association with them), you have no way to insure that they will handle any PHI that you send them appropriately.
Since you also cannot be certain that it will be covered under the Treatment exception, make sure that your good deed goes unpunished and get an authorization from the patient.
This article was written by Dr. Medlaw, a physician and medical malpractice attorney. It originally appeared on SERMO, which retains all rights to it.
