Must a health insurance in the United States provide a listing of procedure and diagnosis codes that are covered upon request?

Question

I wonder whether a health insurance in the United States must provide a listing of procedure and diagnosis codes that are covered, if requested by a policyholder?

In my opinion, the listing of procedure codes that are covered should be part of the health insurance contract, and subsequently be made available to the policyholder, but the health insurance I am in discussion with (namely Blue Cross Blue Shield of Massachusetts) seems unwilling to provide such a list (see below for the exact message they sent me).

---

I am mostly interested in the following locations:

• California, United States
• Massachusetts, United States

---

Here is the message I received from my health insurance, Blue Cross Blue Shield of Massachusetts, when I asked them "Where can I find the list of all procedure codes, marked as covered or not covered by my insurance plan?":

We do not have a listing of procedure codes that are covered or not covered that we can provide you with. We can check on certain procedure codes when they are provided to us, to see if they are covered based on medical policy guidelines. If you have codes from your provider you can contact us to check on them for you, however, the best way to find out is for the doctor to call provider services to confirm coverage.

More details after further insisting:

The procedure code alone is not what determines if a service will be covered, it is just one piece of the puzzle. Claims are billed with a procedure code and a diagnosis code. The procedure code is what tells us what service is done, and the diagnosis code tells us why. Not only does the procedure code need to be related to a covered service, but the reason for the service (the diagnosis) needs to indicate that the service was medically necessary. We do not have a list of all covered procedures and the related diagnosis codes and we are not clinically trained to determine medical necessity. Typically, it is the doctor’s responsibility to verify if the services are covered and that they are medically necessary. We can research the procedure code that the doctor plans to bill with to see if it is a service that we would potentially cover, but we cannot advise you if it is medically necessary.

ADDITIONAL EXAMPLE

To illustrate that this same problem goes beyond California and Massachusetts, here is an additional example from North Carolina where the insurance company attempting to excuse itself from providing procedure codes. The excuse is that the codes are "PHI" (protected health information). Of course the entire contents of the EOB, not just the codes, are "PHI", so the reasoning is laughable. And the letter is coming from UnitedHealthcare's "Regulatory Consumer Advocate"!

Answer 1

The health insurance contract should set forth what is and is not covered in detail (in addition, there would be a short summary version).

They probably don't have to provide procedure codes that are covered or not covered because no such one to one correspondence exists because the language of the insurance contract is controlling and does not exactly correspond to procedure codes.

For example, one of the basic eligibility questions is whether a procedure is medically necessary. A procedure may be medically necessary for one person, but not for another, and usually a denial based upon medical necessity is subject to appeal to other medical professionals engaged by the insurance company.

Unless the insurance contract provides that an EOB must contain procedure codes, it probably doesn't have an affirmative obligation to do so, because there is no general principle of law that would require them to disclose their internal classification of services provided outside of a litigation context. And, in a litigation context, you probably could obtain procedure codes in discovery from the insurance company, as the code assigned to a procedure on an EOB would almost surely not be privileged or a legally protected secret.

It may very well be that the company has an in house set of procedures for certain common diagnosis codes that are routinely allowed or are flagged for review by an insurance company bureaucrat. But, that would ordinarily be considered something of a trade secret of the company and is not a statement of what is or is not allowed under the actual health insurance contract. However, the privilege against disclosing the information in that context would flow from trade secret law and not from the fact that they are PHI.

I don't agree that PHI is the correct reason for failing to disclose that information (unless some case law of which I am not aware has interpreted it differently). The federal law definition of PHI is at 45 CFR 160.103:

Protected health information means individually identifiable health information:

(1) Except as provided in paragraph (2) of this definition, that is:

(i) Transmitted by electronic media;

(ii) Maintained in electronic media; or

(iii) Transmitted or maintained in any other form or medium.

(2) Protected health information excludes individually identifiable health information:

(i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g;

(ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv);

(iii) In employment records held by a covered entity in its role as employer; and

(iv) Regarding a person who has been deceased for more than 50 years.

The cross reference to 20 U.S.c. 1232g(a)(4)(B)(iv) reads as follows:

(iv) records on a student who is eighteen years of age or older, or is attending an institution of postsecondary education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice.

In short, it is B.S. that you are being given an illegitimate reason for not complying with your request, but it is probably still within the company's rights for other legitimate reasons to deny your request.