HIPAA Training for Health Plan Utilization Management Nurse Teams

How HIPAA applies to utilization review and payment activities

When you review a request for coverage or medical necessity, you handle protected health information (PHI) as part of a health plan’s payment activities. The HIPAA Privacy Rule includes utilization review, medical-necessity review, claims adjudication, and coverage decisions in its definition of payment. A health plan may generally use or disclose PHI for these activities without obtaining an individual’s authorization, subject to HIPAA’s other requirements and the plan’s privacy practices. See HHS guidance on payment under the Privacy Rule.

For a UM nurse, this can include reviewing relevant clinical records, requesting additional information from a provider, documenting a coverage determination, or communicating with colleagues involved in the review. It does not make every use of PHI permissible: follow your plan’s policies, confirm that the information is needed for your assigned work, and use approved systems and communication channels.

When utilization management nurses may use PHI without authorization

As a workforce member performing assigned work for a health plan, you may generally use PHI for the plan’s payment activities without getting individual authorization. A provider may also generally disclose PHI to a health plan for payment purposes without individual authorization. The Privacy Rule’s payment category specifically includes utilization review and review of services for medical necessity or coverage. See HHS’s explanation of permitted payment uses and disclosures.

This permission is not unlimited. Use PHI only for a permitted purpose and in line with the plan’s policies and procedures. Psychotherapy notes receive special protection and generally require authorization for use or disclosure, even for payment, unless a specific exception applies. See HHS guidance on mental health information and psychotherapy notes.

Apply the minimum necessary standard to UM tasks

For payment activities, the minimum necessary standard requires covered entities to take reasonable steps to limit PHI used, disclosed, or requested to what is needed for the intended purpose. It does not mean choosing the smallest possible number of records regardless of context; it means assessing what information is reasonably necessary for the specific UM task. The standard generally applies to payment-related uses, requests, and disclosures, but not to disclosures to or requests by a health care provider for treatment. See HHS guidance on the minimum necessary standard.

• For a routine review, use the plan’s approved criteria and request the clinical information relevant to the service under review.
• For a non-routine request, follow the plan’s review process to assess what information is reasonably needed and limit the request accordingly.
• Before sharing records internally, confirm that the recipient has a work-related need for the information.
• Avoid downloading, copying, or forwarding an entire record when the task can be completed with relevant portions.

Covered entities must develop policies and procedures that reasonably limit payment-related PHI use, disclosure, and requests. For recurring requests, those policies may use standard protocols; non-routine requests require individual review under the entity’s criteria.

Use role-based access and security safeguards

Role-based access controls help ensure that you can access the PHI needed for your UM responsibilities without granting unnecessary access to other information. The Privacy Rule calls for role-based policies that limit workforce access according to job duties, and the Security Rule requires appropriate safeguards for electronic PHI. HHS explains that access should be appropriate to a workforce member’s role or function in its Security Rule guidance on technical safeguards.

Use your own account, protect credentials, secure your screen and workspace, and access only the systems and records authorized for your role. Report misdirected records, suspicious access, or possible disclosures through your organization’s incident-reporting process. The Security Rule also requires a security awareness and training program for the workforce. The Privacy Rule requires training on relevant PHI policies and procedures as necessary and appropriate to workforce duties. A training completion certificate documents an individual’s training; it does not certify that the health plan is HIPAA compliant. See HHS’s Security Rule summary and the HHS HIPAA Audit Protocol.

Recognize when written authorization is required

HIPAA generally requires a valid authorization for a use or disclosure of PHI that the Privacy Rule does not otherwise permit or require. One important UM exception is psychotherapy notes: in most cases, a covered entity must obtain the individual’s authorization to use or disclose these notes, including for payment activities. Limited regulatory exceptions apply, so follow your plan’s process and consult the privacy officer when the record or proposed use is unclear.

Psychotherapy notes are a narrowly defined category: a mental health professional’s notes documenting or analyzing the contents of a counseling conversation, kept separate from the rest of the medical record. They are not the same as ordinary clinical information such as a diagnosis, medication list, treatment plan, symptoms, or progress notes maintained in the medical record. See HHS’s explanation of psychotherapy notes.

Handle restrictions and confidential communication requests

An individual may ask a health plan to restrict certain uses or disclosures of PHI. A plan generally does not have to agree to a restriction, but it must follow restrictions it accepts. There is an important exception: a health plan must agree to a restriction on disclosure for payment or health care operations when the information relates solely to a health care item or service the individual, or someone other than the plan on the individual’s behalf, has paid for in full, unless disclosure is otherwise required by law. Follow plan procedures to identify and honor applicable restrictions. See HHS’s summary of the HIPAA Privacy Rule.

An individual may also request that a health plan send PHI communications by an alternative means or to an alternative location. The plan must accommodate a reasonable request when the individual clearly states that disclosure of all or part of the information could endanger them. A plan may require the request to identify the alternative address or contact method and explain how payment will be handled, when applicable. Route requests to the team responsible for confidential communications, and follow the plan’s instructions when sending UM-related notices or other communications. See HHS guidance on payment activities and confidential communications.

Apply HIPAA policies to utilization review scenarios

• Routine medical-necessity review: Use the clinical records and information reasonably needed to evaluate the service. If more information is necessary, request it through approved channels and explain what is needed under plan procedures.
• Psychotherapy notes included in a submission: Do not assume that the plan’s general permission to use PHI for payment covers these notes. Pause and follow the authorization and escalation process; ordinary mental health information in the medical record is not automatically a psychotherapy note.
• A member requests confidential communications: Verify that the request has been routed and recorded according to plan procedure. Use the designated contact method for communications covered by the request.
• A member has paid in full for an item or service: Check whether a restriction applies before disclosing related PHI to the plan for payment or operations, and escalate uncertainty rather than making an assumption.
• A colleague requests a complete record: Confirm the colleague’s role and the task’s purpose, then share only what is reasonably necessary under the plan’s policies.

In short, HIPAA generally permits UM work without individual authorization when it supports payment activities, but the permission has limits. Apply the minimum necessary standard, respect role-based access, protect psychotherapy notes, and route restrictions or confidential communication requests through the plan’s established process.

FAQs

Can a health plan use PHI for utilization review without individual authorization?

Generally, yes. The HIPAA Privacy Rule includes utilization review within payment activities, for which a health plan may generally use or disclose PHI without individual authorization. Other requirements still apply, including the minimum necessary standard where applicable. Psychotherapy notes are subject to special authorization rules.

What does the minimum necessary standard require of utilization management nurses?

It requires you to use, request, or disclose only the PHI reasonably needed for the payment-related task, consistent with your plan’s policies. Routine tasks may follow standard protocols; non-routine requests should be assessed individually under the plan’s criteria. The standard does not apply to disclosures to or requests by health care providers for treatment.

Are psychotherapy notes covered by the same payment authorization rules?

No. Psychotherapy notes generally require an individual’s authorization for use or disclosure, including for payment, unless a specific exception applies. This special rule does not apply to all mental health information; ordinary clinical information in the medical record is not necessarily a psychotherapy note.

Must health plans accommodate confidential communication requests?

Yes, when the request is reasonable and the individual clearly states that disclosure of all or part of the PHI could endanger them. The plan may require an alternative address or contact method and, when applicable, information about how payment will be handled.