§1320d–8 Processing payment transactions by financial institutions

Summary

Companies that act like banks or that handle payments for banks are not covered by these health-privacy rules when they are doing payment work. That exception covers using or sharing information to approve, process, move, bill, settle, reconcile, or collect payments for health care or health plan premiums, no matter how the payment is made (for example, by credit or debit card, account, check, or electronic transfer). It also covers asking for or sharing that payment information for things like selling receivables, audits, customer disputes or questions, messages to customers about their transactions, reports to consumer reporting agencies, and when following subpoenas or federal or state laws that apply to the company. financial institution — banks and similar businesses (see Title 12, section 3401).