CCA 200425046: IRS advised against disclosure contract for patient records

Plain-English summary

During an audit, the IRS sought billing records containing patient information from a health care taxpayer. The taxpayer proposed a contract governing disclosure under HIPAA. Chief Counsel advised the IRS to use a qualifying information request or summons instead. It reasoned that the proposed contract was unnecessary to obtain the records and could conflict with tax return disclosure rules and IRS policy. The advice addressed how the IRS could obtain the records, rather than the tax treatment of the taxpayer's billing discounts.

Ruling snapshot

• Question: Should the IRS sign the taxpayer's proposed disclosure agreement to obtain protected patient information for an audit?
• Outcome: Advice: do not enter the agreement; seek records through the applicable information request or summons procedure.
• Key authorities: IRC §§ 7602, 6103; 45 C.F.R. § 164.512(f).

Full text (IRS public release)

Office of Chief Counsel
memorandum
Internal Revenue Service

CC:PA:CBS:B03:SAHovey
Number: 200425046
POSTF-157519-03
Release Date: 6/18/04

UILC: 7602.00-00

date: February 24, 2004
to: Benjamin de Luna
Associate Area Counsel (Manhattan, Group 3) (Large & Mid-Size Business)

from: Peter D. Devlin /s/
Deputy Assistant Chief Counsel
(Collection, Bankruptcy and Summonses)
([Office Name])

subject: -----------------------------------

This memorandum responds to your request that we review and comment on a proposed disclosure agreement (the “Agreement”) submitted by the taxpayer, ------, whereby the taxpayer would turn over to the Service, in lieu of a summons, certain billing records that contain protected health information that is otherwise subject to statutory disclosure restraints set forth in the privacy regulations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).1 As discussed below, we are opposed to the Service entering into this or any other similar agreement for the production of documents because: (1) it is legally unnecessary, (2) it conflicts with statutorily imposed disclosure and or document retention rules, and (3) it will create bad precedent for future audits that require production of protected health information.

Background

---------------------------------------------------------------------------------------------------------------------

---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------

1
The proposed Agreement arose under the Service’s audit of the --------and --------tax years. After requesting CBS’ comments, however, the Service closed that audit and initiated a new audit of the same issues for --------and -------. Although the current Agreement is moot, the Service believes -------will raise the same HIPAA concerns and seek substantively the same agreement when information is requested in the current audit. We provide this response so you may consider CBS’s views at that time.

POSTF-157519-03
2

-----------------------------------. These contracts generally require ------ ------------- to provide the insurance company a discount when the insurance company pays its client’s bill. These discounts are referred to as “contractuals” since they arise under the contract agreement. ----------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------

The Service is currently investigating the propriety of the various methods ------ uses to calculate its contractuals. ---------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------. Accordingly, the Service sought to audit the discount ------ claimed on its --------and --------tax returns.

The Service attempted to obtain de-identified information for the audit. However, after reviewing the information provided, the Service determined that it could not proceed without information that identifies specific health care recipients. ------ is willing to release the protected health information but only if the Service enters into a contractual agreement.

Discussion and Analysis:

Congress passed the Health Insurance Portability and Accountability Act of 1996 in part to provide protection for the privacy interest of health care patients. Pursuant to the authority granted in HIPAA, regulations were promulgated authorizing and/or prohibiting disclosure of certain information. See 45 C.F.R. §§ 164.102-164.534 (effective April 14, 2003). The rules have the effect of restricting the Service’s information gathering authority by imposing civil and criminal penalties on “covered entities” for unauthorized disclosure of medical information that identifies a particular person (“protected health information”). There is no dispute that ------ is a covered entity and that the Service is requesting protected health information. Thus, unless one of the exceptions to HIPAA’s bar to production applies, the Service is not entitled to the requested information.

The Agreement proposed by ------ is fashioned after HIPAA’s rules for the exchange of information between a “covered entity” and a “business associate.”2 Business associates are defined in HIPAA and include entities that assist covered entities in performing health services (e.g. a consultant or a lawyer). 45 C.F.R. § 160.103. In auditing ------, the Service is performing a tax oversight role mandated by Congress; it is

2
The rules permit releasing protected health information to a business associate as long as the covered entity and the business associate enter into an agreement that assures the business associate will safeguard the information. 45 C.F.R. § 164.502(e).

POSTF-157519-03
3

not a business associate and need not enter into an Agreement to receive protected information. See, Final Rule, 65 Fed. Reg. 250, 82476 (Dec. 28, 2000)(noting that health oversight agencies permitted to obtain protected health information under 45 C.F.R. § 164.512(e) are not business associates and need not enter into agreements).

There does not appear to be anything in the rules that permits a covered entity to release information to a non-business associate simply because those parties enter into an agreement. To the contrary, 45 C.F.R. § 164.502 states that a covered entity may only release protected health information as permitted by the rules. The only exception applicable to the current audit is 45 C.F.R. § 164.512(f). Under this law enforcement exception, ------ may release information pursuant to an IDR or summons as long as the Service states that (1) the information sought is "relevant and material" to a "legitimate law enforcement inquiry;" (2) the request is "specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought;" and (3) "de-identified information could not reasonably be used." 45 C.F.R.
§ 164.512(f)(1)(ii)(C). The Agreement expressly recognizes this requirement by mandating that the Service state in each IDR that the information produced will satisfy the three requirements.

As a practical matter, Since the Agreement requires production of information pursuant to an IDR that satisfies HIPAA’s requirement in 45 C.F.R. § 164.512(f)(1)(ii), the Agreement only requires ------ to release information that the Service could likewise summons under HIPAA. Id. In view of the fact that HIPAA does not appear to authorize release of information pursuant to an agreement and that the information that
------ proposes to release is subject to a summons, there is no concrete reason for entering into the Agreement. Moreover, the information gathering regime contained in the Internal Revenue Code contains clear and broad authority to obtain the information that is sought in this case, and that authority has been well tested in courts. I.R.C. § 7602 et. seq.; United States v. Powell, 379 U.S. 48 (1964). -------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------

The Office of Chief Counsel has a long standing position that the Service should not enter into any agreement for the production of documents when the Service can compel production. This policy is based largely on section 6103, which is both a restrictive and permissive statute; while section 6103(a) lays out the general rule prohibiting the disclosure of returns and return information, subsections (c) through (o) provide exceptions permitting and in some cases requiring specific, limited disclosures. Accordingly, there might be circumstances under which section 6103 either allows or

POSTF-157519-03
4

requires disclosure of return information that the Agreement restricts. Additionally, executing agreements with taxpayers that bind the Service requires a delegation of authority. -------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------

---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------

For the forgoing reasons, the Service should not enter into this Agreement or any other contract to secure information from a covered entity that is subject to HIPAA in lieu of a summons. Even if any specific concerns we might have to the provisions in the Agreement are addressed, the concern remains that entering into an agreement with ---
------ is legally unnecessary, contravenes current policy, and raises the specter of preferential treatment. If you have any questions in this matter, please call me at 202- 622-3600.