At 2:10 a.m., your obstetric patient is moved from your affiliated community hospital to a tertiary center forty miles away. By 9:00 a.m., your billing lead has four things on her desk: a partial global maternity chart, a transfer summary from a facility you have no interface with, a payer authorization request for the inpatient stay, and a voicemail from the patient's employer asking about leave paperwork. A HELLP disorder encounter is over clinically in days. Administratively, it runs for months.

This post is about that administrative tail — the coding decisions, the claim path, the appeal packets, and the records requests. It is not clinical guidance. The only clinical fact that matters here is structural: this condition typically involves urgent escalation and specialist involvement, which means records move between organizations fast, under time pressure, through whatever channel is available at 2 a.m. That is exactly the condition under which privacy controls fail.

The Paper Trail a HELLP Disorder Encounter Leaves Behind

Count the documents your practice will generate or receive for a single episode. A prenatal record excerpt sent to the receiving facility. An inpatient face sheet returned to you. Consultant notes from maternal-fetal medicine. Lab and imaging results routed to your inbox. A discharge summary. A newborn record, if delivery occurred. Postpartum follow-up notes. Then the financial layer: claims, remittance advice, denial letters, appeal packets, and eventually a patient statement.

Each of those items has a sender, a receiver, a transmission method, and a retention location. Most practices can name the first two and guess at the last two. That gap is where your risk analysis should be pointing.

The transfer breaks your global obstetric package

Global obstetric billing assumes one practice provides antepartum, delivery, and postpartum care. When care transfers mid-pregnancy or at delivery, the global package fragments, and your biller has to itemize what your practice actually provided — visit counts, dates, and services rendered before the transfer.

Itemizing requires reconciliation with the receiving organization. Someone in your office will call someone in theirs to ask who billed the delivery. That call is a disclosure conversation. It is permitted for payment purposes, but it should follow a script that limits what your staff volunteers. "We provided seven antepartum visits through 32 weeks" is payment information. A narrative about the clinical course is not, and your staff does not need to offer it to settle a billing question.

Who Sees PHI When a HELLP Disorder Claim Is Billed

A single claim for a HELLP disorder episode is typically visible to the following parties, in this order:

  1. Your clinical staff — documenting the encounter and the transfer.
  2. Your coder — in-house or contracted. Contracted coders are business associates.
  3. Your practice management or billing system vendor — a business associate with standing access to the full claim history.
  4. Your clearinghouse — a business associate that touches every claim you submit.
  5. The health plan — a covered entity in its own right. No BAA required; disclosure is permitted for payment.
  6. The plan's utilization review or care management contractor — often requesting clinical documentation beyond the claim.
  7. The receiving hospital's billing office — during coordination on the split package.
  8. Your denial-management or A/R follow-up vendor, if you use one — a business associate.
  9. Your statement and print-mail vendor, and, if the balance ages, your collections agency — both business associates.

Nine touchpoints, of which six require a signed business associate agreement. If your BAA binder contains fewer than six agreements for this workflow, the gap is not theoretical.

The Coding Desk Is a Minimum Necessary Problem

ICD-10-CM classifies this condition within the obstetric chapter, and the relevant codes are trimester-specific — the character set changes depending on when in the pregnancy the condition occurred. CMS maintains the official ICD-10 code files and annual updates, and your coding staff should be pulling from that source rather than a vendor cheat sheet that may be a year stale.

The privacy consequence of trimester specificity is that your coder needs gestational age, dates, and often the transfer narrative to assign the code correctly. That is a legitimate need. What is not legitimate is a workflow where the coder gets read access to the entire longitudinal chart because it was easier than configuring a role.

Three questions to ask about your coding access

  • Does your contracted coder log into your system under a named individual account, or a shared "codingvendor" login? Shared logins destroy your audit trail.
  • If the coder needs a document your system cannot expose in-context, how is it sent? Email attachments to a personal-domain address are the most common finding in a real audit.
  • When the contract ends, who disables the account, and how fast? Name the role, not the department.

Denials and Appeals Move Far More PHI Than the Original Claim

The initial claim carries codes and dates. The appeal carries the chart. When a payer denies an inpatient obstetric stay as not medically necessary, your appeal packet may include operative notes, lab results, nursing flowsheets, consultant documentation, and a physician letter — dozens of pages of narrative clinical detail about a pregnancy complication.

Assign one person to assemble appeal packets and one person to review them before transmission. The reviewer is checking two things: that the packet supports the specific denial reason, and that it does not include records for a different date of service, a different patient, or a family member whose information happens to sit adjacent in the chart. Misdirected appeal packets are a recurring source of small breaches, and small breaches still require notification.

Log the transmission. If you fax, log the confirmation. If you upload to a payer portal, log the confirmation number and the date. If a packet later turns up somewhere it should not be, the log is the difference between a documented investigation and a shrug.

Two Charts, One Night: Maternal PHI Inside the Infant's Record

When delivery accompanies a HELLP disorder admission, two records exist: the mother's and the newborn's. The newborn's record almost always contains maternal information — delivery circumstances, maternal labs, indications for early delivery. That is clinically appropriate and administratively inconvenient.

Then a request arrives for the infant's records. Perhaps from a pediatric specialist, perhaps from a parent, perhaps from an attorney. Your release-of-information staff now has to decide what to send. The default answer — export the infant's chart and mail it — discloses the mother's health information to whoever receives it.

Write the rule down before you need it. Decide, with counsel, how your practice handles maternal information embedded in a pediatric record, who reviews those requests, and what documentation of that review you keep. Do not leave this to a front-desk judgment call on a Friday afternoon.

Records Requests That Arrive Ninety Days Later

The 30-day access clock

When the patient asks for her own records, you have 30 days, with one 30-day extension available if you notify her in writing of the reason and the new date. Fees are limited to a reasonable, cost-based amount. HHS keeps a detailed breakdown of these obligations in its individual right of access guidance, and OCR has enforced this provision more consistently than almost any other.

Practical trap: the request often comes by phone, to your front desk, from a patient who is recovering and not inclined to fill out a form. Your intake process should capture the date the request was received — not the date the form was completed — because that is when the clock started.

Employer, disability, and life insurance forms need authorization

Postpartum leave, short-term disability, and FMLA certification requests routinely follow a serious obstetric complication. None of them are treatment, payment, or operations. Each requires a valid written authorization identifying the recipient, the information to be disclosed, and an expiration date.

Train the front desk on one sentence: "We can complete that as soon as we have a signed authorization on file — here is the form." That sentence prevents most of the well-intentioned faxes that end up in a breach log.

Attorney requests and subpoenas

Adverse obstetric outcomes generate legal inquiry. A subpoena that is not accompanied by a court order requires satisfactory assurances — either notice to the patient or a qualified protective order — before you disclose. Route every one of these to your privacy officer and your counsel. No exceptions, no matter how official the letterhead looks.

One note on the regulatory landscape: the 2024 amendments that created heightened protections for reproductive health care information were vacated by a federal court in 2025, and the pre-existing Privacy Rule framework governs. State law may impose additional restrictions. Confirm current status with counsel rather than relying on a policy template written in 2024.

Your Vendor List Is the Control That Actually Fails

Walk the workflow above and write down every outside organization that touched PHI: transcription, coding, the practice management vendor, the clearinghouse, the ROI service, the secure fax provider, the statement printer, the A/R follow-up firm, the collections agency, the answering service that took the after-hours call from the transferring hospital.

Now check your files. In most practices, three or four of those have no executed agreement, or have one signed by a predecessor administrator with a vendor that has since been acquired. HHS explains the scope of these obligations in its business associate guidance, and the obligation runs to subcontractors as well.

If you are missing agreements, you can produce a signature-ready contract in an afternoon. The six-step business associate agreement generator at baa.hipaa.app walks through the parties, services, permitted uses, and breach-notification terms, then exports PDF and DOCX for signature. It is a one-time purchase with no subscription, which matters when you have eight vendors to paper and no budget line for it.

A 30-Minute Audit You Can Run This Week

  1. Pull the last three obstetric transfer encounters. List every organization that sent or received records. Confirm a BAA exists for each business associate.
  2. Check how the transfer summary arrived. Fax to a machine in an unlocked hallway is a finding. Write it down.
  3. Open your appeals folder. Count how many packets have a transmission confirmation attached.
  4. Ask your front desk what they do when an employer calls about leave paperwork. Compare the answer to your policy.
  5. Verify your access-request log records the date of the original request, not the date the form was signed.
  6. Confirm your breach-response procedure names a person and states the 60-day notification deadline in plain language.

Document what you find, including what you fixed and when. HIPAA requires you to retain that documentation for six years, and "we looked at this in June 2026 and corrected two items" is a materially better position than silence.

Start With the Contracts, Then the Workflow

A HELLP disorder episode is a stress test for administrative controls that work fine on a routine well-visit claim. The volume of documentation, the cross-organization transfer, the split billing, and the near-certain denial all push PHI through channels your policies may not describe.

Close the contract gaps first, because they are the fastest to fix — generate the missing business associate agreements and get them signed. Then work the transmission methods, one channel at a time. If your broader documentation set needs rebuilding too, automated risk analysis and policy generation will get you further than another year of editing the same template.