“What do I do if a patient tells me I cannot bill their health plan for a cholesterol test and any prescription for cholesterol lowering medication?” the frustrated primary care physician asked.

“Well, that depends,” the lawyerly health care lawyer responded.

Back in 2009, when the federal government was trying to stimulate the economy with its Stimulus Bill, Congress included a large update to the health information privacy and security provisions of the Health Insurance Portability and Accountability Act (HIPAA). That statutory update was known as the Health Information Technology for Economic and Clinical Health Act (HITECH). In short, HITECH was a game changer for HIPAA compliance because it turned HIPAA into a penalty driven law that created enormous legal risk for health care providers.

One minor piece of HITECH was a provision that permitted a patient to pay in full for a health care service or item and, in turn, forbid a health care provider from billing the patient’s health plan. A lot of confusion erupted over this restriction including questions such as what happens if the patient fails to pay the provider in full? Or, how does this affect a provider’s contractual obligation with a health plan to not bill patients directly for covered services? What if the patient is a Medicare patient? What happens if the provider submits an electronic prescription to a pharmacy that immediately bills the health plan? And, what is the potential liability for disclosing information to a health plan in violation of the restriction?

In January 2013, final regulatory rules (also known as the Omnibus HIPAA Rulemaking) were released that shed some light on a few of the larger questions. The basic rule says that a patient may make a request that a provider restrict disclosure of protected health information to a health plan if the disclosure is for payment or health care operations and the information is solely related to an item or service for which the patient has paid the provider in full. Compliance with the rule is expected by September 2013.

The Department of Health and Human Services (HHS) also commented on some of the confusing issues. To obtain the benefit of their privacy right under this restriction, patients must pay providers in full. Providers would be permitted to require payment in full at the time of the request for a restriction. With respect to payor contracts preventing providers from accepting payments directly from covered patients under those contracts, HHS viewed this rule as trumping those contracts and suggested those be amended to permit providers to fully comply with the rule. On Medicare’s restriction that providers not bill beneficiaries for covered services, HHS noted that Medicare law does have an exception when a beneficiary refuses to authorize a provider to submit a bill to Medicare. In that situation, HHS said a provide may accept an out of pocket payment from the beneficiary. As far as prescriptions go, HHS did seem to go backward in time here and advised that providers give patients paper prescriptions to avoid situations where an electronic prescription goes to the pharmacy and the pharmacy fills and bills for it before the patient arrives. And, with liability issues, HHS took the gloves off by stating that a provider who discloses restricted patient information to a health plan is subject to possible criminal or civil penalties, or corrective action.

So what should the frustrated physician do?

Be clear with patients about their rights under this new rule regarding HITECH’s restriction process, get payment in full from the patient or a family member (preferably ahead of time), and train office staff to flag the information that is not to be shared with the patient’s health plan.

If the patient asks that any disclosure about a prescription also be restricted, be firm with the patient that it is their responsibility to communicate the restriction to the pharmacy. A proactive office might offer the patient an old school written prescription or recommend a pharmacy that will confirm acceptance of the restriction for an electronically submitted prescription.

Finally, where gray areas still exist such as what are obligations under state-run Medicaid plans, providers should ask their trade associations to get clear answers for them about compliance, and keep up to date on agency guidance as this new rule gets tested in practice.