The short answer
Before sharing protected health information on a call, verify the caller's identity, and their authority to receive it, if they aren't already known to you (45 CFR 164.514(h)). Then share only the minimum necessary for the purpose of the call (45 CFR 164.502(b)). Personal representatives are treated as the patient for relevant information, and family or friends involved in the patient's care or payment can be told what is directly relevant, under set conditions.
Who this applies to
The HIPAA Privacy Rule applies to covered entities (health plans, healthcare clearinghouses and most healthcare providers) and to their business associates, which include contact centres and billing companies that handle protected health information (PHI) for them. Billing and payment information that identifies a patient is PHI.
Verify before you share
The Privacy Rule requires covered entities to verify the identity of a person asking for PHI, and their authority to have it, if that person isn't already known to them (45 CFR 164.514(h)). It doesn't prescribe a script, so each client sets its own verification policy.
Identify the caller's role
Is this the patient, a parent, a spouse, a personal representative, a provider's office or someone else? The answer decides what can be shared.
Verify identity
Ask for the identifiers in the client's policy, such as name, date of birth, address and member or account number. Have the caller give them, rather than reading them out for the caller to confirm.
Check authority if they aren't the patient
Look for a personal representative or an authorisation on file, or confirm the patient's agreement to this person's involvement.
Only then discuss the account
If verification fails, don't confirm or deny details, including whether the person is a patient at all. Explain what is needed and how to provide it.
Share only the minimum necessary
Once a caller is verified, uses and disclosures of PHI must still be limited to the minimum necessary for the purpose (45 CFR 164.502(b), 164.514(d)). Disclosures to the patient themselves are an exception. Other callers, including family members and providers' billing offices, should get only what the call needs.
| Caller | Share | Don't volunteer |
|---|---|---|
| Spouse helping pay a bill, with the patient's agreement | Balance, due date and payment options for that bill | Diagnoses, procedures or unrelated bills |
| Personal representative, such as a legal guardian | What is relevant to the representation, as you would with the patient | Anything outside the scope of their authority |
| Provider's billing office calling about a claim | Claim status and the payer's reason for the denial | The patient's other claims or history |
| Caller who fails verification | How to verify, or how the patient can authorise them | Anything about the account, including that it exists |
Minimum necessary applies inside the centre too: QA reviewers, analysts and vendors should see only what they need. Masking health details in transcripts and limiting who can play recordings help apply the standard to QA and analytics.
Family members and personal representatives
- Personal representatives, such as a legal guardian or someone holding a healthcare power of attorney, are treated as the patient for the PHI relevant to that representation (45 CFR 164.502(g)). There are exceptions, including some situations involving minors and concerns about abuse.
- Family members and friends involved in the patient's care or payment may be told PHI directly relevant to that involvement, under the conditions in 45 CFR 164.510(b). For example, when the patient is present and agrees or does not object.
- Other callers generally need the patient's authorisation on file, unless another permission in the Privacy Rule applies.
What QA should check on healthcare calls
- Was the caller verified, to the client's policy, before any PHI was shared?
- Were the caller's role and authority checked when they weren't the patient?
- Was the information shared limited to what the call needed?
- Were identifiers asked for, rather than read out?
- Were notes kept to what the record needs, without extra health details in free text?
Verification failures are rare but serious, which makes them hard to catch by sampling. Score verification on every call. See how to QA every call.
Where Orian fits
How Orian helps on healthcare calls
- Guides identity checks as the call opens, sharing only what is needed.
- When the caller is not the patient, prompts an authorised-representative check before any detail is shared.
- Explains denial reasons in plain language, with the payer rule.
- Every call is checked for verification before details are shared.
- Health data is masked by default. Recordings and transcripts never leave your network, and the whole install runs in the region you choose.
This guide is general information about running contact-centre programmes, not legal advice. Rules change and vary by state, country and client contract, so confirm your requirements with your compliance team or counsel.