8.1 HIPAA Privacy and TPO
Key Takeaways
- HIPAA Privacy Rule protects PHI held by covered entities and their business associates; case managers routinely create, use, and disclose PHI in hospital practice
- Minimum necessary limits most uses and disclosures to the least PHI needed for the purpose — but treatment-related disclosures among providers are generally not constrained by minimum necessary
- TPO (Treatment, Payment, and Health Care Operations) permits many CM disclosures without patient authorization when they fall within those three pathways
- Uses outside TPO — marketing, most research without a waiver, and sharing with employers or attorneys not involved in care — typically require a valid HIPAA authorization
- ACM candidates must distinguish lawful CM coordination under TPO from unauthorized curiosity, hallway gossip, or oversharing with family without a personal representative relationship
8.1 HIPAA Privacy and TPO
Quick Answer: Case managers may use and disclose protected health information (PHI) for Treatment, Payment, and Health Care Operations (TPO) without a patient authorization when the disclosure fits those pathways. Apply minimum necessary for most non-treatment uses, confirm identity and role before sharing, and obtain a valid authorization (or work through a personal representative) when the purpose falls outside TPO.
Hospital case management lives inside the HIPAA Privacy Rule. Nearly every screen you open, note you write, and phone call you make involves protected health information (PHI) — individually identifiable health information transmitted or maintained by a covered entity. Acute-care hospitals and most health systems are covered entities. Vendors that create, receive, maintain, or transmit PHI on their behalf (electronic health record hosts, utilization-review contractors, transcription services) are typically business associates and must have a business associate agreement.
For the ACM exam, blueprint domain 2E expects you to apply privacy rules in realistic care-coordination scenarios — not recite statute numbers. Focus on who may receive information, for what purpose, and how much is appropriate.
What Counts as PHI in Case Management
PHI includes clinical data (diagnoses, labs, medications, functional status) and demographics that identify the patient (name, address, medical record number, dates of service). A discharge plan that names the patient and lists a skilled nursing facility is PHI. An anonymized quality dashboard with no identifiers is generally not. When in doubt, treat the information as PHI and follow your organization’s privacy policies.
Common CM touchpoints that create or move PHI:
- Interdisciplinary rounds notes and care-plan documentation
- Payer authorization packets and clinical reviews
- Referrals to post-acute providers, home health, dialysis, and durable medical equipment vendors
- Conversations with family members, surrogates, and community agencies
- Quality, denials, and readmission reviews
Minimum Necessary
The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI uses, disclosures, and requests to the minimum needed to accomplish the purpose. Practical CM implications:
| Situation | Minimum necessary expectation |
|---|---|
| Sending clinicals to a SNF for placement | Share relevant history, therapies, wounds, meds, and skilled needs — not the entire chart by default |
| Answering a payer UM nurse | Provide criteria-aligned clinical facts for the review; avoid unrelated behavioral or social detail unless it affects medical necessity |
| Quality peer review of delays | Limit identifiers and clinical detail to what the review requires |
| Hallway question from a coworker not on the case | Do not share; curiosity is not a permitted purpose |
Important exception: Minimum necessary generally does not apply to disclosures for treatment among health care providers, disclosures to the individual, uses/disclosures required by law, and certain other listed exceptions. When you call the accepting hospitalist at a receiving facility to hand off an unstable transfer, you may share what is clinically needed for continuing care without artificially truncating the story.
TPO: Treatment, Payment, and Health Care Operations
TPO is the everyday legal pathway for case management. Under the Privacy Rule, covered entities may use and disclose PHI for these purposes without an authorization (subject to other limits such as psychotherapy notes and state law that is more protective).
Treatment
Treatment means providing, coordinating, or managing health care — including consultation between providers and referral. Case management care coordination with the attending physician, consulting specialists, the ED team, and receiving clinicians is treatment-related. Educating a patient about the post-acute plan while discussing clinical needs is part of coordinating care.
Payment
Payment activities include eligibility and coverage determinations, billing, claims management, medical necessity reviews, and utilization review tied to reimbursement. Submitting clinical information to obtain inpatient authorization, answering a concurrent review request, or clarifying observation versus inpatient status for a payer are classic payment uses.
Health Care Operations
Health Care Operations cover quality assessment, care management, case management, training, accreditation, business planning, and customer service related to health care. Hospital CM programs themselves are often framed as operations as well as treatment coordination. Internal UM committees, avoidable-day reviews, and transitions-of-care improvement projects typically fall here.
Exam tip: If a vignette shows a CM sharing clinical information with a payer for concurrent review, or with a SNF admissions nurse to arrange a safe discharge, look first for a TPO fit before assuming an authorization is required.
When Authorization Is Required
Uses and disclosures outside TPO generally need a valid HIPAA authorization. Examples that trip case managers:
- Releasing records to an employer for fitness-for-duty (unless another legal pathway applies)
- Sharing detailed PHI with an attorney who does not represent the covered entity and is not part of treatment/payment/operations
- Marketing communications that use PHI beyond limited exceptions
- Most research disclosures that lack an IRB/privacy-board waiver or limited-data-set pathway
Family and friends: HIPAA permits sharing relevant information with family members, friends, or others involved in the patient’s care or payment when the patient agrees, does not object after opportunity, or when professional judgment supports sharing in the patient’s best interest (for example, an incapacitated patient). This is not a blank check to discuss the full chart with every visitor. Confirm involvement in care, limit content to what the person needs to support the patient, and honor known objections.
Personal representatives (health care agents, guardians, parents of unemancipated minors in many situations) generally may exercise the individual’s rights and receive PHI as the patient would. Verify documentation per hospital policy before treating someone as a personal representative.
Psychotherapy Notes and Heightened Protections
Psychotherapy notes (as defined by HIPAA — notes of a mental health professional documenting or analyzing counseling conversation, kept separate from the medical record) have stricter authorization rules and are generally excluded from TPO uses by others. Hospital case managers usually work from the designated medical record, not psychotherapy notes. If a vignette involves separate psychotherapy notes, do not assume routine TPO sharing applies.
State laws, 42 CFR Part 2 (certain substance-use disorder records), and specialized privacy rules may be more protective than HIPAA. Follow the stricter applicable standard and your facility’s release-of-information workflows.
Case Manager Habits That Keep You Compliant
- Verify identity and role before discussing PHI by phone (call-back numbers on file, MRN confirmation, payer ID).
- State the purpose silently before sharing: treatment, payment, operations — or stop and seek authorization/ROI.
- Share the least PHI that still achieves a safe, accurate handoff when minimum necessary applies.
- Document disclosures when policy requires (especially external releases).
- Escalate unusual requests to privacy/compliance rather than improvising.
- Never access a celebrity, coworker, or neighbor chart without a job-related need — unauthorized access is a classic HIPAA violation even with no external disclosure.
ACM Practice Bottom Line
On core items and simulations, HIPAA questions usually test judgment: Can the CM fax relevant clinicals to the accepting SNF without a new authorization? Yes — treatment/care coordination (and often operations). Should the CM discuss the patient’s HIV status with a coworker who is only curious? No. May the CM give a full diagnosis list to an adult child the patient asked to exclude from discussions? No — honor the patient’s objection. Regulatory fluency here protects patients and keeps transitions moving without illegal shortcuts.
A hospital case manager prepares a referral packet for a skilled nursing facility that has accepted a Medicare patient for post-acute placement. Which HIPAA approach best fits this disclosure?
Which situation most clearly falls outside routine TPO and typically requires a valid HIPAA authorization before disclosure?
How should a case manager apply the minimum necessary standard when answering a payer utilization-management nurse’s request for clinicals supporting continued stay?