Q&A: Contacting a patient’s emergency contact person in a non-emergency

Q: I am an acupuncturist and have a patient who owes me $100. I contacted the patient about the missing payment but received no response. Would it be a HIPAA violation to get in touch with the patient’s emergency contact person about the missing payment? Or should I go to a debt collector?

A: If you’re a covered entity healthcare provider, it would be a violation of HIPAA to contact the patient’s emergency contact if the patient has not signed an authorization permitting you to share PHI, including billing information, with the emergency contact. If you do not bill your patients’ health plans electronically using HIPAA covered transactions, you are not a covered entity and are not subject to HIPAA. If you are not a covered entity, I still recommend not getting in touch with the emergency contact because doing so may violate state privacy laws.

You may contract with a collection agency for assistance with the collection of the $100. If you’re a covered entity, you would need to execute a business associate agreement with the collection agency prior to sending the collection agency any of the patient’s billing records.