Medical Records in Jeopardy?

Wilton physicians, and doctors across the state, are on alert after the Connecticut State Medical Society warned of a possible fraudulent phishing expedition for patient records.

CSMS has asked the State's Attorney General to investigate what it said is an infringement of fair business practices and potential wire fraud.

The fax request bears the letterhead MediConnect Global and Ingenix. Ingenix, a subsidiary of UnitedHealth Group, said it is acting for HealthNet in requesting records from HealthNet, Evercare and SecureHorizons. 

The faxed letter asks doctors to supply patient medical records dated between Jan. 1, 2008 to the present, said CSMS.

"Under no circumstances are these requests ever made via fax as it's a violation of HIPPA," said Audrey Honig Geragosian, director of communications for CSMS. "Fax is not a reasonable and secure way to send such sensitive information."

While faxing records to insurers is a potential HIPPA violation, the request by fax is not. There is no prohibition on faxing a records request. The issue is a doctor sending them to a 3rd party by unsecured means.

At this point CSMS is advising physicians to verify the legitimacy of the letters. According to CSMS, Ingenix said the Centers for Medicare and Medicaid Services would audit records. Ingenix also cites a "Department of Public Welfare" to justify its request.  No such department on either the Connecticut or federal level exists, said CSMS.

"This appears to be a request for records under the guise of a federal requirement, with no substantiation," said Matthew C. Katz, CSMS executive vice president.

However, Daryl Richard, vice president for public relations at United Healthcare said Ingenix sent the letters to Connecticut doctors as part of a routine chart review process.

"The letters were sent via fax based on feedback from physicians that this is their preferred method of communication, and physicians were invited to respond via either fax or email," Richard said. "The chart review mailing is consistent with both CMS and HIPAA regulations."

CSMS demanded both UnitedHeatlhcare and HealthNet cease and desist the reviews. It also contacted the Connecticut Department of Insurance, the Office of the Attorney General and CMS regarding its concerns.

The records request comes at a time when CSMS has filed suit in state Superior Court to overturn the state's Insurance Department's recent approval of an insurance company merger.  The DOI approved UnitedHealth Group's purchase of Health Net last November. United purchased "renewal rights" for Health Net's commercial customers.

The incidents are not related, said Richard.

"Ingenix is a subsidiary of UnitedHealth Group.  However, I would stress that chart reviews have nothing to do with UnitedHealthcare's recent acquisition of Health Net's northeast subsidiaries," Richard said.