A burgeoning issue in no-fault insurance litigation has been the applicability of HIPAA and the Privacy Rule to actions brought for recovery of monies for services rendered pursuant to no-fault insurance policies. In particular, issue has been raised whether a medical provider who has treated an individual involved in a motor vehicle accident must comply with HIPAA and the Privacy Rule in order to sustain its action. The issue typically arises in two scenarios: The court sua sponte demands that the medical provider, to proceed, produce a “HIPAA authorization”; or the court sua sponte demands that the medical provider prove the patient was given notice of his/her HIPAA rights.
This article serves as an examination of HIPAA and the Privacy Rule as it relates to no-fault litigation. Specific attention is paid to how to identify who is a “covered entity” under HIPAA, and examined are the permissive uses of protected health information even where a party is a “covered entity.”
Background and Provisions
