Secondary Payers' Pre-Authorization

Secondary payers requiring concurrent authorization with primary payers has been a growing phenomenon over the past year. We are of the opinion, not a legal opinion mind you, that a secondary payer should not require any authorization unless and until care has been denied by the primary payer.

The requirement for concurrent authorization for services already authorized and paid by the primary payer may be a violation of HIPAA. The intent of HIPAA, as we interpret it, is that protected information should not be irresponsibly disseminated. Payers will rebut that they are legally entitled to such data. This, however, is not the issue. The issue is whether the protected information is required for them to properly proceed with claims processing in these cases.

Assume a patient stay is 6 days, with charges of $1,000 per day all authorized and allowed by the primary at $600 per day after a $500 deductible at 80%. The primary pays $2,480 of the $3,600 allowed rate. We would expect the secondary to cover the patient liability of $1,120. If the secondary only approves 3 days what portion of the patient liability will they cover now? What is the purpose of a secondary payer, responsible for only the deductible, copayment and/or coinsurance reviewing a chart for clinical necessity? The clinical necessity had already been received, reviewed and authorized in full by the primary payer.

In the example above, the secondary reviewed the chart and denied some of the days authorized by the primary. The provider would now have to appeal this determination to recover the otherwise patient pay portion. This would involve a demand for the details of each payers’ written criteria, review process and staff involved in the review that led to the discrepancy in results. Beyond creating a potential legal battle, no justification for disseminating protected documents would have been demonstrated.

ARA suggests that you require secondary payers who demand a concurrent authorization to provide you with their written policy regarding this as well as a written HIPAA release.