HIPAA Privacy and Internal Fraud Investigation

[Guest rocnrols2]

Acting on information provided by an outside source, Company X has an internal unit that investigates claims of fraud internally as well as externally with respect to its customers. One of X's employees listed an individual as her spouse and there is a concern that the employee is not married to this individual. The internal fraud unit would like to access the medical and dental claims made by the employee on her "spouse's" behalf. Should the Privacy Officer permit the internal fraud investigators to accept these claims? Should the Privacy Officer hire an outside consultant to review the claims and issue a report to the Privacy Officer? Or perhaps should the fraud unit verify whether the employee is married without the claims information and, if not, discipline the employee for the fraud? Your responses would be sincerely appreciated.

[oriecat]

I think you should just verify the marriage before digging into any claims. Just send a letter stating that the plan is auditing dependent eligibility and ask for proof. Then if there is any issue you can get into dealing with claims, but if it turns out they are married, then you won't have wasted the time dealing with the privacy issues.

[GBurns]

As oriecat pointed out any relevant health care fraud would depend on there first being a finding of a fraudulent marriage claim. A finding of a bona fide marriage would make claims investigation unnecessary.

Additionally, Why is health care fraud being investigated by the Company rather than by the insurer, health plan or state regulators? How does it get to be within the jurisdiction of the Company, anyhow?

But, what bothers me even more, is that these internal investigation people even thought to look at health claims BEFORE satisfying the marriage issue. It makes me wonder about their acumen, experience and intelligence.