Under third-party payers, when is disclosure permitted?

• A. Disclosure is allowed only after the client has authorized disclosure.
• B. Disclosure to third-party payers is allowed when the client has authorized it, and records may be provided for audits.
• C. Disclosure is never permitted to third-party payers.
• D. Disclosure is automatic upon submission of claims.

Answer: (B)

The main idea is that sharing protected health information with third-party payers is allowed when the patient has authorized the disclosure, and payers can request records for audits as part of the billing and verification process. In practice, you obtain a signed authorization that specifies what information can be released and to whom, then provide the minimum necessary PHI to the insurer to process claims. Audits by payers are a legitimate (and common) use of PHI under these disclosures, so records may be provided for that purpose. The other options don’t fit because disclosures to payers aren’t automatic or without authorization, and they aren’t restricted to never being permitted.