Count the organizations that touch the record from one concussion encounter. A patient is seen Friday afternoon in urgent care. A referral goes out Monday. Physical therapy starts in week three. Somewhere in there, a parent asks for paperwork for the school, and a payer denies the second visit pending documentation. By day 21, protected health information from that single episode of concussion treatment has left your building at least four separate ways — as a claim, as a referral packet, as an appeal attachment, and as a form someone hand-carried out the front door.

This article is about that traffic, not about the clinical care. If you sign vendor contracts, supervise coders, or answer records requests, your exposure lives in the billing and disclosure workflow. Here is how to map it, who needs a Business Associate Agreement, and where practices routinely over-disclose.

The Four Documents That Leave Your Building

Concussion episodes are administratively noisy because they usually involve more than one encounter and often more than one organization. Follow-up visits, referrals to neurology or vestibular therapy, and school or employer paperwork are ordinary features of the workflow. Each one produces a different disclosure with a different legal basis.

1. The claim itself

Your electronic claim carries diagnosis codes, procedure codes, dates of service, place of service, rendering and referring provider identifiers, and patient demographics. It goes to a clearinghouse, then to the payer, and frequently to one or more payer subcontractors. This is treatment, payment, and health care operations (TPO) — no patient authorization required, but the minimum necessary standard still applies to the payment disclosure.

2. The referral packet

When the encounter generates a specialist referral, someone in your office assembles chart notes and sends them. Provider-to-provider treatment disclosures are permitted, and HHS does not require you to apply minimum necessary to treatment disclosures. That does not mean your staff should default to "send the whole chart" — it means the legal risk shifts from over-disclosure to transmission method. Fax to an unverified number and misdirected-fax breaches are still breaches.

3. The appeal or documentation request

Denials on concussion follow-up visits are common enough that your billers have a habit for them. The habit is usually to attach every note in the episode. That is the single most reliable place I find over-disclosure in a billing audit.

4. The form for a third party

School return-to-learn paperwork, athletic clearance forms, coach or league notifications, employer letters. None of these are TPO. Each one needs a valid authorization or a specific regulatory permission, and the front desk is usually the only staff member standing between the form and the door.

Where Coding Turns Clinical Detail Into Transmittable Data

Concussion diagnoses live in the ICD-10-CM S06 series, and code selection depends on documented specifics — including loss of consciousness duration and the encounter type character. External cause codes frequently accompany the diagnosis. Your coders should be working from the current-year code set published through CMS's ICD-10 code files, not from a cheat sheet someone laminated in 2021.

That is a coding-integrity point, but it is also a privacy point. The more granular the code, the more clinical narrative rides along with the claim — and the more likely a payer requests supporting documentation. Clean, specific coding on the first submission reduces the number of times a full chart note has to leave your practice.

Two administrative controls worth writing down:

  • Who assigns codes. If a contractor or offshore coding service assigns them, that vendor is a business associate with access to your entire encounter record. Name them on your vendor inventory.
  • What the coder can see. Coders generally need the encounter documentation, not the patient's full longitudinal chart, not billing history for other family members, and not the payment portal. Role-based access in your practice management system should reflect that.

Who Actually Sees PHI From a Concussion Treatment Claim?

Short answer, in order:

  1. Your own workforce — front desk, clinician, coder, biller, and anyone with a login that touches the claim queue.
  2. Your billing service or RCM vendor, if outsourced. Business associate; BAA required.
  3. Your clearinghouse, which reformats and routes the claim. Business associate; BAA required.
  4. The health plan, which is a covered entity in its own right. No BAA with you — it receives the claim as a payment disclosure.
  5. The plan's subcontractors — utilization review, case management, sometimes a third-party administrator. They are the plan's business associates, not yours.
  6. Your EHR and practice management hosting vendors, which store the record at rest. Business associates; BAA required.

Everyone outside that list — schools, athletic departments, coaches, leagues, employers, attorneys, relatives — needs either a signed authorization or a narrow regulatory permission before you disclose anything about the patient's concussion treatment. "The coach called and he's just checking on the kid" is not a permission.

The Minimum Necessary Test Your Billers Should Apply

HHS's guidance on the minimum necessary requirement expects covered entities to have policies limiting routine disclosures to what's reasonably needed. For claims work, translate that into a three-question script your billing staff runs before attaching anything:

  • What exactly did the payer ask for? Read the request. If it names dates of service, send those dates only.
  • Does the attachment contain unrelated episodes? A concussion appeal does not need the patient's mental health intake from two years ago, medication history unrelated to the episode, or another family member's demographics that appear on the same statement.
  • Is there a de-identified or summary version that satisfies the request? Often a visit summary or a specific note resolves the denial.

Document the script in your privacy policies and put it in annual training. When OCR asks how you limit payment disclosures, "our billers use judgment" is not an answer. A one-page procedure is.

The appeal packet audit

Pull ten appeals your practice submitted in the last quarter. For each, compare the payer's documentation request to what you actually sent. If you sent more than half of your appeals with the full episode chart when the payer asked for a single note, you have a training issue, not a technology issue. Fix it with a checklist attached to the appeal template.

School Forms, Athletic Trainers, and Workers' Comp: Three Different Rulebooks

This is where concussion encounters diverge from most billing workflows, because third parties genuinely need paperwork and they ask insistently.

School and league paperwork

If a parent or adult patient wants clearance documentation sent to a school or athletic organization, get a written authorization that names the recipient and describes the information. The cleaner move is often to hand the completed form to the patient or parent, who then delivers it themselves — a disclosure to the individual, not to a third party. Train the front desk on that default.

Once records land in a school's hands, they generally become education records under FERPA rather than PHI under HIPAA. That is the school's problem, not yours, but it explains why school staff sometimes assume the exchange is casual. It isn't casual on your side.

Athletic trainers

An athletic trainer employed by a school or a league is not part of your covered entity and is not your business associate. If your clinic contracts to provide coverage and your clinician is the one documenting, the record is yours. Sort out which organization owns the chart before the first game of the season, in writing.

Workers' compensation

A concussion sustained at work brings a workers' comp carrier, an adjuster, and possibly an employer's third-party administrator into the picture. HIPAA permits disclosures as authorized by and to the extent necessary to comply with workers' compensation laws. Your practice should have a standing procedure identifying which state statute you're relying on, and it should still limit the disclosure to the injury at issue.

Your BAA Inventory for This Workflow

Walk the claim path and list every organization that creates, receives, maintains, or transmits PHI on your behalf. For a practice handling concussion episodes, that list typically includes: EHR and practice management host, clearinghouse, outsourced billing or coding service, transcription or ambient documentation vendor, secure fax or messaging provider, patient statement and printing vendor, release-of-information fulfillment service, cloud backup, IT managed service provider, and any shredding company that handles hard copy.

Then answer two questions for each row: Is there an executed BAA? and Is it current for the services actually being provided? Contracts signed in 2018 for a fax line often do not cover the AI-assisted documentation module the same vendor turned on last year.

If you find gaps — and most practices find two or three — you need signature-ready agreements, not a six-week legal cycle. A guided Business Associate Agreement generator walks you through a six-step wizard and exports PDF and DOCX for signature as a one-time purchase, which is usually the fastest way to close a vendor gap you discovered on a Tuesday. If your broader documentation set is also thin, automated risk analysis and policy generation covers the rest of the file.

The 30-Day Clock When the Patient or Parent Asks for the Chart

Concussion episodes generate access requests, frequently from a parent, sometimes from an attorney, occasionally from a college recruiting office asking the patient to obtain records. Under the HIPAA right of access, you have 30 days to act on the request, with one 30-day extension available if you notify the individual in writing with a reason.

Three operational details that cause most of the trouble:

  • Personal representatives. A parent is usually the personal representative of a minor, but state law on adolescent care can carve out exceptions. Your policy needs to say who at your practice makes that call — and it should not be the person at the check-in desk.
  • Fees. Right-of-access fees are limited to a reasonable, cost-based amount. Charging a records-search fee or a per-page rate copied from a state statute is a common finding.
  • Format. If the requester wants an electronic copy and you can readily produce it, produce it electronically. Insisting on paper pickup invites a complaint.

Log every request with the date received, the date fulfilled, who fulfilled it, and what was sent. That log is the first thing anyone asks for.

Where These Workflows Actually Break

Browse the OCR breach portal and the pattern is consistent: business associate incidents, email compromise, and misdirected disclosures dominate the list of reported cases involving 500 or more individuals. Nothing about that pattern is specific to concussion care. It is specific to workflows where records move between organizations frequently and under time pressure — which describes this one precisely.

Practical controls that map to those failure modes:

  1. Verify recipient endpoints annually. Referral fax numbers and portal addresses drift. Assign one person to re-verify the top twenty destinations each year.
  2. Turn off free-text in outbound email. If staff are emailing form responses to schools or employers, route them through a mechanism you control and log.
  3. Set a retention rule for appeal attachments. Copies of chart bundles sitting in a shared billing folder for three years are a breach waiting for a credential to leak.
  4. Review vendor security attestations, not just BAAs. A signed BAA does not tell you whether the vendor encrypts backups.

A Fifteen-Minute Exercise for Your Next Staff Meeting

Take one recent concussion episode — de-identified, on a whiteboard. Draw every arrow the information traveled: to the clearinghouse, to the payer, to the referral destination, to the parent, to the school. Under each arrow, write the legal basis (TPO, authorization, disclosure to the individual, workers' comp permission) and the vendor's BAA status.

Practices that run this exercise usually find one arrow nobody can justify and one vendor nobody has a current agreement with. That is a productive fifteen minutes. Repeat it once a quarter with a different service line, and your disclosure accounting stops being theoretical.

Concussion care is not unusually regulated. It is unusually connected — multiple visits, multiple organizations, and third parties who want paperwork quickly. Build the workflow so the right disclosure is the easy one, and document it well enough that a new biller inherits the discipline instead of reinventing it.

If the whiteboard exercise turns up a vendor without a current agreement, close that gap this week: generate a signature-ready Business Associate Agreement and get it out for signature before the next claim cycle carries PHI through an uncovered service.