Treatment, Payment, and Health Care Operations (TPO)

TPO stands for treatment, payment and health care operations. These are the three purposes for which the HIPAA Privacy Rule lets a covered entity use and disclose protected health information (PHI) without patient authorization.

Asking patients for consent to TPO uses is optional. Consent never replaces an authorization when one is required. To see what counts as PHI, read the 18 HIPAA identifiers.

What counts as treatment

Treatment is providing, coordinating or managing health care. It includes consultations between providers and referrals from one provider to another. Examples:

• A primary care doctor refers a patient to a cardiologist and sends the chart.
• Two physicians consult about a patient's test results.
• A clinic coordinates follow-up care with a home health agency.

What counts as payment

Payment covers what a provider or health plan does to get or give reimbursement for care. For a health plan, it also covers collecting premiums and deciding coverage. Examples:

• Billing, claims management and collections.
• Checking a patient's eligibility or coverage.
• Preauthorization and medical necessity reviews.

A provider may also give a consumer reporting agency limited details, such as name and payment history, for collections.

What counts as health care operations

Health care operations are a covered entity's business and quality activities that relate to its covered functions. Examples:

• Quality assessment and improvement, including case management and care coordination.
• Reviewing staff competence, supervised training programs and credentialing.
• Medical review, legal services and audits, including fraud and abuse detection and compliance programs.
• Business planning and administration, such as customer service and resolving internal grievances.

One limit: most health plans may not use or disclose genetic information for underwriting.

What TPO lets you do without authorization

Under 45 CFR 164.506, a covered entity may:

• Use or disclose PHI for its own treatment, payment and health care operations.
• Disclose PHI for the treatment activities of a health care provider.
• Disclose PHI to another covered entity or provider for that recipient's payment activities.
• Disclose PHI to another covered entity for its operations, in narrower cases.

That last case has three conditions. Both entities must have, or have had, a relationship with the patient. The PHI must relate to that relationship. The purpose must be a quality or competence activity, or fraud and abuse detection or compliance.

What still needs patient authorization

Outside TPO and the rule's other permissions, a use or disclosure generally needs a valid authorization. The TPO permission itself carves out three cases:

• Psychotherapy notes. These are a mental health professional's notes on counseling sessions, kept apart from the rest of the record. Most uses and disclosures need authorization. Exceptions include use by the note's author for treatment and defending a legal action the patient brings.
• Marketing. Using PHI to encourage someone to buy or use a product or service needs authorization. Face-to-face communications and promotional gifts of nominal value are exempt. Refill reminders and messages about your own health-related services are usually not marketing. That can change if a third party pays you to send them.
• Sale of PHI. Any disclosure that is a sale of PHI needs authorization. The authorization must say the covered entity will receive remuneration.

Psychotherapy notes exclude medication prescriptions, session times, clinical test results and summaries of a diagnosis or treatment plan.

Minimum necessary still applies

For payment and operations, you must make reasonable efforts to limit PHI to the minimum necessary for the purpose. The rule does not apply to disclosures to, or requests by, a health care provider for treatment.

The out-of-pocket restriction right

Patients can ask a covered entity to restrict TPO uses and disclosures. In most cases the entity may say no. Paying in full out of pocket for an item or service changes that. The entity must then agree not to send PHI about that item or service to the health plan for payment or operations. Disclosures the law requires are not affected.

How TPO relates to hosting

A hosting company that stores PHI for you is a business associate. You may give it PHI only if it gives satisfactory assurances that it will safeguard the data. Those assurances must be in writing, usually a business associate agreement. TPO does not remove the need for one.