1. Government health plans like Medicaid and Medicare are covered by HIPAA privacy rules. Medicaid rules on using and disclosing PHI are more restrictive than HIPAA. 2. Managed care organizations that contract with Medicaid may be considered business associates or participants in an organized health care arrangement with more flexible sharing of PHI. 3. State agencies can disclose PHI to auditors for oversight of providers and health plans as permitted by the privacy rule.

1. HIPAA Privacy: Implementing Privacy for Government Health Plans Roberta M. Ward Senior Counsel, Privacy Officer California Department of Health Services Tuesday, September 16, 2003 * 11:00 am-Noon

2. What types of government health plans are covered by the Privacy Rule?

7. In the Final Rule, OCR excepts out only government programs that have a principal purpose other than providing or paying for cost of health care Or . . . Those which have as their principle activity the direct provision of health care or making of grants to fund the direct provision of health care

51. THE END