August 20, 2008, 4:11 AM

White Paper: HIPAA's Impact on Banks - An Emerging Policy Debate
* This item is inlcuded in MBProject membership

Table of Contents

  • The Opportunity

  • Sensitive Policy Issues - Will We Derail Progress?

  • The Market Speaks

  • Macro Policy Concerns

  • A Sustainable Business Model

  • Conclusion

  • Exhibits
Background

In 2001, the nation’s first HIPAA readiness survey for banks, administered by the Medical Banking Project, heralded an emerging story widely covered in the media. In a nutshell, banks often have access to personal health information but many were unsure of HIPAA’s impact on their operations. Under HIPAA, these banks are considered “business associates” and so must implement procedures to protect sensitive health information. Further, some banks may be directly regulated under HIPAA, because they perform HIPAA-defined clearinghouse functions. While these issues became increasingly clear to industry experts and HHS regulators after the survey was broadcast, banking associations and regulators aren't so sure.

These groups are seeking to make a case for 100% exempt from HIPAA based on Section 1179 of the statute. Yet the framers of the statute argue that this exemption was exclusively granted to permit consumer-conducted financial transactions, (i.e., credit cards, personal checks, etc), allowing the consumer to decide when to use a card or check that could link them with sensitive treatment information (i.e., AIDs clinic, rehab center, etc). These experts indicate that the exemption does not cover individually identifiable health data (i.e., remittance information) that accompanies health insurer payments through our banking system.

Privacy groups, banks, clearinghouses and regulators are lining up on this issue. Privacy groups demand tight control of PHI that flows through banks. Large banks, noting that HIPAA is a catalyst for electronic payments, see a multi-billion dollar industry in the making for reducing the “paper payment chase” to a streamlined, digital system. Community banks, that can’t afford to offer digital payment systems, are finding ways to align with those that can to protect market share.

In the meantime, AFEHCT, a national clearinghouse association, drafted a letter to HHS Secretary Thompson objecting to special treatment for banks under HIPAA, and heightening the debate among regulators. Finally, the National Committee on Vital and Health Statistics held hearings in February 2004 related to the issues. These dynamics suggest that the once obscure notion of "medical banking" has arrived into the mainline of healthcare policy formation and product development.
Additional Publications
The 2001/2 HIPAA Readiness Survey Report (includes 2002/03 follow-up survey)