Medicaid Estate Recovery Unit HIPAA Audit Readiness Guide

A Medicaid estate recovery unit may handle protected health information (PHI) while identifying recoverable services, reviewing claims, and responding to estate-related inquiries. Audit readiness means being able to show both why information was used or disclosed and how recovery amounts were calculated under applicable federal and state rules.

Use this guide to organize privacy, security, request-routing, and cost-verification practices. It provides general information, not legal advice; confirm requirements with your agency’s privacy officer and counsel.

Which HIPAA requirements apply to Medicaid estate recovery units

State Medicaid programs are generally covered entities because Medicaid is a government program that pays for health care. Whether an estate recovery unit is directly within the covered health care component of a particular state agency can depend on the agency’s structure and any hybrid-entity designation. Check the agency’s HIPAA policies and designation documents. The HHS explanation of HIPAA coverage for state agencies specifically identifies state Medicaid programs as covered entities.

The HIPAA Privacy Rule governs permitted uses and disclosures of PHI. The HIPAA Security Rule applies to electronic protected health information (ePHI) and requires safeguards that protect its confidentiality, integrity, and availability. Medicaid-specific confidentiality rules also apply: 42 CFR § 431.306 requires agency criteria for releasing beneficiary information and restricts access to people subject to comparable confidentiality standards.

For routine access, apply the minimum necessary standard: limit workforce access and disclosures to what is reasonably needed for the permitted purpose, unless a regulatory exception applies. The HIPAA minimum-necessary provisions describe the standard and its exceptions. HIPAA does not itself set the state’s estate-recovery calculation; recovery authority, scope, and protections also depend on Medicaid law, the state plan, and state law.

How should estate-related requests be routed and documented

Use a consistent intake process for requests from personal representatives, attorneys, relatives, courts, providers, and other agencies. Route requests involving PHI to staff authorized to verify the requester and assess the applicable disclosure basis; refer uncertain or contested requests to the privacy officer or counsel.

• Record the requester’s identity, contact details, claimed authority, estate or case identifier, and the information requested.
• Verify a personal representative’s authority using documents and procedures accepted under state law and agency policy. An executor or administrator may qualify, but a relative or attorney does not qualify solely by relationship or profession.
• Identify the legal basis for the response, the records approved for release, the minimum necessary scope, the reviewer, the release method, and the date.
• Retain the request, verification materials, review decision, correspondence, and disclosure log in the designated case or tracking system.

Medicaid confidentiality regulations require policies for outside information requests, including requests from courts and government bodies; they also address permission, emergency disclosures, and subpoenas. Review 42 CFR § 431.306 alongside HIPAA and any stricter state confidentiality requirements. Keep the documentation needed to demonstrate that the request was assessed and handled under the applicable rules.

What policies and procedures should an audit review

Build an audit file that connects written policy to actual work practices. An auditor may test whether employees follow the documented process, not just whether a policy exists. HHS’s HIPAA audit protocol reviews selected Privacy, Security, and Breach Notification Rule requirements; the scope of any audit depends on the entity and review.

• Privacy and disclosure: policies for permitted uses, minimum-necessary decisions, identity and authority verification, external requests, disclosures, complaints, and suspected privacy incidents.
• Security: documented risk analysis and risk management, role-based access, authentication, audit logs, secure transmission, incident response, backups, and vendor safeguards. The HHS Security Rule summary describes these safeguard areas.
• Workforce practices: workforce training records, confidentiality acknowledgments, access approvals, access reviews, and sanctions or corrective actions where applicable. HIPAA requires workforce training on relevant policies and procedures, but it does not establish a universal annual certificate-renewal requirement.
• Recordkeeping: version-controlled policies, approval dates, review history, completed checklists, incident documentation, and evidence that identified deficiencies were addressed.

HIPAA requires specified documentation to be retained for six years, including required Privacy Rule documentation; other Medicaid, state, litigation-hold, or records-management requirements may require a different or longer period. Check the applicable rules and agency schedule rather than applying one retention period to every estate recovery record. See 45 CFR § 164.530 and the Security Rule’s documentation requirements.

How can units verify long-term-care costs and recovery reporting

For each sampled estate, trace the amount reported for recovery back to source data. Compare the member’s identity, relevant dates, eligibility and age information, service category, claim status, paid amount, adjustments, and any state-defined recovery limits. Confirm that reversals, voids, duplicate claims, and later corrections are reflected in the current balance.

Reconcile the case-level amount to claims or payment-system totals and to the recovery ledger or report. Preserve the query criteria, date of extraction, source system, mapping or calculation logic, reviewer, and documented resolution of discrepancies. If a claim includes multiple service types, retain enough detail to show how the amount attributed to recoverable services was determined.

Federal law generally requires states to seek recovery for certain services provided when a beneficiary was age 55 or older, including nursing facility services, home and community-based services, and related hospital and prescription drug services; states may choose to recover for certain other services. Federal law also provides protections, including restrictions involving a surviving spouse or certain children and procedures for undue-hardship waivers. Confirm the applicable scope and exceptions against the state plan and current state rules. See CMS’s Medicaid estate recovery overview and 42 CFR § 433.36.

How should staff communicate with attorneys within HIPAA guidelines

First determine which role the attorney is serving. Agency counsel handling PHI for the Medicaid program, an attorney representing an estate, and a lawyer making a general inquiry do not automatically have the same authority to receive information. Confirm the purpose of the request and the attorney’s authority before discussing identifiable case details.

A deceased person’s PHI generally remains protected under HIPAA for 50 years after death. During that period, the decedent’s personal representative is the person authorized under applicable law to act for the decedent or estate, such as an executor or administrator. The HHS guidance on deceased individuals’ health information explains these protections and the representative’s role.

For requests made in a legal proceeding, do not treat an attorney’s letter or subpoena as automatic permission to release an entire file. Apply the relevant HIPAA rule, state Medicaid confidentiality requirements, and agency legal-review procedure; a disclosure under the judicial or administrative proceedings provision must meet the applicable conditions in 45 CFR § 164.512. If an attorney performs services for the agency that involve PHI, determine whether the attorney is acting as a business associate and whether a business associate agreement or other safeguards are required.

Use approved channels, verify recipient details, limit the information sent, and document what was shared and why. If authority or scope is unclear, pause disclosure and seek guidance from the privacy officer or counsel.

What records support recovery-cost accuracy

Organize an estate recovery case file so a reviewer can follow the calculation from eligibility and service records through the reported amount and any collection or adjustment. Depending on the case and state process, useful evidence may include:

• Eligibility history and relevant age or service-date information.
• Claims and payment details, including service codes, provider information, dates of service, paid amounts, adjustments, reversals, and voids.
• Records showing how claims were categorized, filtered, and attributed to potentially recoverable services.
• Calculation worksheets, system reports, query parameters, reconciliation results, and explanations of manual changes.
• Notices, correspondence, estate or representative documentation, waiver or hardship decisions, recovery receipts, and account adjustments, as applicable.
• Access logs and disclosure records where needed to show who viewed or released PHI and under what authority.

These are practical audit-support records, not a statement that HIPAA requires every item in every case. Separate records needed to establish the recovery amount from records containing unrelated PHI, and provide auditors only the access authorized for their review. Preserve the record set according to applicable federal and state retention rules.

What audit limitations and state-specific rules should units consider

“Audit” can refer to different reviews, including a HIPAA privacy or security review, a state program-integrity examination, a financial reconciliation, or an internal quality review. Their authority, sampling methods, requested records, and deadlines may differ. Confirm the auditor’s identity, scope, authority, and secure method for receiving records before granting access.

Federal estate-recovery requirements establish a baseline, but state laws and approved state-plan choices can affect recoverable services, hardship waivers, notice processes, estate definitions, liens, and other protections. CMS’s estate recovery overview describes the federal framework; state rules and agency procedures determine how it applies to a particular case. State confidentiality laws may also impose protections beyond HIPAA.

Before closing an audit, identify which findings concern privacy or security, which concern recovery calculations or reporting, and which require legal interpretation. Assign owners, document corrective actions, and preserve evidence of completion. In short, a defensible audit file links authorized access and properly routed requests to accurate cost calculations, documented decisions, and the state-specific rules applied.

FAQs

Are state Medicaid programs covered entities under HIPAA?

Generally, yes. HHS identifies a state Medicaid program as a covered entity because it is a government program that pays for health care. Whether a particular unit is within a designated health care component can depend on the agency’s structure and hybrid-entity designation, so check the agency’s HIPAA documentation.

How should staff handle estate-related requests involving protected health information?

Route the request through the agency’s approved privacy process. Verify the requester’s identity and legal authority, identify a permitted disclosure basis, limit the information to what is authorized and necessary, and document the decision and release. Refer unclear authority or legal demands to the privacy officer or counsel.

What records may auditors review for estate recovery reporting?

Depending on the audit’s scope and authority, reviewers may examine relevant eligibility, claims, payment, calculation, reconciliation, correspondence, waiver, and recovery records, as well as policies and access or disclosure logs. Confirm the audit scope and provide only records the auditor is authorized to review.

Can the Medicaid Estate Recovery Unit correspond with attorneys about closing estates?

Yes, when the communication is permitted and the attorney’s role and authority are verified. An attorney may represent the estate, the agency, or another party; those roles do not automatically confer the same access to PHI. Apply HIPAA, Medicaid confidentiality rules, state law, and agency procedures before sharing identifiable information.