P3N Privacy Policy (PA eHealth Partnership Program)
Customize your policy alerts
Sign up for Pennsylvania Insurance Department Policy 5 alerts
Get alerted when Policy 5 changes without checking for updates manually.
Monitor payer policy activity
Governs privacy, consent, and limits on collection, use, and disclosure of Protected Health Information (PHI) for Certified Participants (CPs) in the Pennsylvania Patient & Provider Network (P3N); applies to all CPs and is recommended for other P3N participants.
No material clinical or coverage changes in this revision.
Consent, Notification, and Data Exchange Rules
Consent, notification, restricted data, and enforcement
Covered when the following consent checks, patient notification steps, restrictions on certain PHI, and enforcement expectations are met:
See patient consent management requirements.
Default opt-in status unless opt-out recorded.
Retention of the signed form is required prior to changing consent indicator.
Timely forwarding requirement to PA eHealth.
Collection/storage and repository updates are permitted regardless of consent.
PA eHealth will make materials available to CPs for distribution to MOs.
Restricted Self-Pay PHI defined per 45 C.F.R. §164.522(a)(1)(v) and related provisions; CPs must block such PHI from P3N exchange.
Preserve opt-out records on disconnect to avoid re- opting-in patients.
Enforcement expectations for privacy violations.
Regulatory References and Timing Requirements
| 45 C.F.R. § 164.522(a)(1) | HIPAA right to request restrictions on Uses and Disclosures of PHI |
| 45 C.F.R. § 164.522(a)(1)(v)(A)-(B) | Exception for disclosures to health plans for payment/HCO when service was paid out-of-pocket |
Provider Responsibilities and Enforcement
Check consent registry; do not send Restricted Self‑Pay PHI
Before exchanging patient information through the P3N, Certified Participants (CPs) must check the P3N consent registry for the patient’s opt‑out status; CPs may nevertheless collect, store, and update a patient’s PHI and document registries regardless of that patient’s consent status. If a CP or its managed organization forwards an Opt‑Out or Opt‑Back‑In form to PA eHealth for processing, it must be forwarded within five business days of receipt. CPs shall not exchange or disclose Restricted Self‑Pay PHI via the P3N and must prevent messages containing such PHI from passing through the P3N.
- All exchanges between separate CPs must be preceded by a check of the P3N consent status (opt‑in/opt‑out).
- CPs may continue to electronically collect and store any patient PHI regardless of the patient’s consent status, and may update the P3N document registry regardless of consent.
- Opt‑Out/Opt‑Back‑In forms forwarded to PA eHealth for processing must be sent within five business days of receipt.
- CPs must prevent any messages containing Restricted Self‑Pay PHI from passing through the P3N.
Enforce privacy rules; loss of P3N access and legal consequences
CPs and their managed organizations must maintain policies to address suspected misconduct; Authorized Users who violate patient privacy may have P3N access terminated immediately and may be subject to legal action in accordance with applicable federal and state law.
- CPs/MOs must have procedures to identify and take action on indications of potential misconduct.
- Consequences for privacy violations range from immediate termination of P3N access up to and including legal action under federal and state law.
Key Terms
OpenPayer is powered by Trek Health's payer performance platform. Trek continuously ingests, validates, and normalizes Transparency in Coverage data alongside payer policies and other commercial payer data to create a structured payer intelligence foundation. OpenPayer uses this foundation to deliver personalized search results, dynamically generated policy pages, and tailored policy monitoring based on each user's payers, specialties, billing codes, and areas of interest. The same intelligence powers broader payer performance workflows, including reimbursement benchmarking, contract evaluation, payer negotiations, and financial decision-making.