Insurance Discovery for Self-Pay Accounts
Running an aged self-pay population against a coverage search is one of the few things in patient billing that looks like free money. It is not free, and the cost is not where practices look for it. The permission to search is settled. What is not settled is how much you are allowed to ask — and what obligations a positive answer creates the moment it arrives, whether or not anybody reads it.
Updated 14 min read
On this page
Key takeaways
- Searching for coverage is a payment activity. It needs no patient consent, and the regulation names determinations of eligibility or coverage in terms.
- The minimum necessary standard applies to what you request, not only to what you send — and payment is not one of its exemptions.
- The regulation sets no limit on the content of a request. It delegates one, to a written protocol the practice has to have.
- A payer answering a request may rely on it as being the minimum necessary. Nobody downstream sizes the query for you.
- No source read gives a practice a right to make a plan say whether a person is covered. The transaction standard governs the form of an exchange, not a duty to disclose enrollment.
- On the Medicare side the search is a duty, and the regulation places it at admission — so a discovery program run at collections is remediation, not compliance.
- The statutory bar is expectational, so a successful search recharacterizes a payment already made rather than simply revealing a better payer.
- Two clocks run and neither is the one people watch: the obligation period starts when the information arrives, and the filing window started at the date of service and does not restart because you found something.
- None of the enumerated exceptions to Medicare's filing limit is triggered by discovering coverage. They are all about Medicare's own status changing.
Looking is permitted, and that is the easy part
The privacy question is settled twice over. The definition of payment expressly includes determinations of eligibility or coverage, including coordination of benefits, and separately includes billing, claims management and collection activities — so a balance already sitting in self-pay collections is inside the payment definition before any search begins. And a covered entity may use or disclose protected health information for its own payment purposes, with patient consent expressly permissive rather than required.
So the question worth spending time on is a different one
Minimum necessary governs the ask, and payment is not an exemption
Most people carry the minimum necessary standard as a rule about disclosure — about what leaves the building. The regulation is broader than that on four separate textual grounds, and the breadth is exactly where a discovery program lives.
- The standard's own opening clause names requesting protected health information as a triggering act, and closes on “the use, disclosure, or request”.
- The implementation specifications list a request for information ahead of use and disclosure, and devote an entire specification to requests, parallel to the one for disclosures.
- That specification splits: routine and recurring requests are governed by policies and procedures, which may be standard protocols; everything else requires criteria to be developed and each request reviewed individually against them.
- And there is a hard ceiling regardless: a covered entity may not use, disclose or request an entire medical record except where specifically justified.
The exemption list is closed, and payment is not on it
And nobody downstream will size it for you
Which makes the protocol the deliverable
Nothing gives you the right to an answer
The rule reached for here is the one requiring a health plan to conduct a transaction as a standard transaction when asked. Read closely, it is a mandate about the form of an exchange, not about its substance — and the eligibility inquiry it governs is framed as a question about a benefit plan for an enrollee, which presupposes the fact a discovery query is trying to establish. Searching the transaction rules for anything conditioning a plan's duty on a relationship with the provider turns up nothing — and equally, nothing creating a right of discovery against a plan you have no relationship with.
One provision is often read as more than it is
On the Medicare side, this is a duty — and it is placed at admission
Two commitments in the provider agreement bear directly. One requires maintaining a system that, during the admission process, identifies any primary payers other than Medicare, so that incorrect billing and overpayments can be prevented. The other requires billing those primary payers before Medicare.
Note where the regulation puts the system
And the statutory bar is written in the expectational voice: payment may not be made to the extent that payment has been made, or can reasonably be expected to be made, by a primary plan. A reasonable expectation is disqualifying before any money moves. So on a Medicare account a successful search is retroactively self-incriminating: it does not merely reveal a better payer, it recharacterizes the payment already made — and the practice's own search is the evidence.
Two clocks, and neither is the one being watched
| The obligation to redirect the money | The ability to collect it | |
|---|---|---|
| Starts when | The information is received — the statute runs its period from the date notice of, or information related to, a primary plan's responsibility is received. Not from the date somebody opened the file. | The date of service. It has been running since, and nothing about a discovery run touches it. |
| What extends it | Nothing in what was read. The period is stated and the trigger is the arrival of information. | Four enumerated exceptions, every one of them about Medicare's own status changing retroactively — entitlement granted late, a state agency recouping after the fact, a retroactive plan disenrollment. None of them is “we found a policy”. |
| Consequence of missing it | A repayment obligation with interest exposure attached, running whether or not the hit was worked. | The claim cannot be filed, an omitted item cannot be added by adjustment after the limit, and an untimely-filing denial is not an initial determination — so there is no appeal, only informal contractor review on request. |
Read together: the duty to redirect the money outlives the ability to collect it. A discovery program that produces hits nobody works has not created an idle worklist. It has started a clock, and the evidence that it started is sitting in the vendor's return file.
Which makes one unglamorous field the most valuable thing in the workflow
Who carries the loss when the found payer pays less
Suppose the search works, the primary payer exists, and the claim goes out late or defective. Two rules decide where the shortfall lands, and both land it in the same place.
- Medicare does not backfill
- Where a primary payer reduced its payment because the provider failed to file a proper claim, the amount that may be billed to Medicare is capped at what would have been payable as a secondary payment had the primary paid on a proper claim. The difference is not made up.
- And it generally cannot be moved to the patient
- The reduction may be charged to the beneficiary only where the provider can show it failed to file solely because the beneficiary failed to give the necessary information — with the burden on the provider, the word “solely” doing real work, and physical or mental incapacity carved out entirely.
- So it parks on the practice
- Which reframes what a discovery hit is worth. The value of a found policy is the amount collectible under it minus the repayment triggered by finding it, and minus whatever a defective or late claim gives away. On an aged balance those terms can net to less than zero, and the calculation is worth doing before the campaign rather than after it.
One practical detail on a late filing
Running a discovery program without creating the problem it solves
Write the protocol before the first query
Which identifiers, which payers, which population, on what trigger, and what is retained. This is the artifact the standard actually asks a routine and recurring request to have, and it is the only defense available on the sizing question.Search before the charity determination, not after it
A determination of need reached without asking the coverage question first converts a payable claim into a discount nobody was owed, and the discount is the harder one to reverse — the point presumptive charity eligibility makes about the same sequence from the other side.Paper the vendor properly, and remember paper is not a shield
A business associate agreement is required before the disclosure, and it may not authorize the vendor to do anything the practice could not do itself. A covered entity that knew of a pattern amounting to a material breach and did not act is not in compliance, whatever the agreement says.Timestamp every result on arrival
Per account, in a field, not in a note. It starts one clock and is the measuring point for the other.Work the hits on the obligation's timetable, not the worklist's
Because a hit that changes who should have paid creates a repayment question immediately, and the corpus covers that duty in the 60-day overpayment rule. Ordering the queue by expected recovery, which is right for almost every other kind of follow-up, is wrong here.Check the found payer's own window before promising anyone revenue
Nothing in the federal sources governs a commercial payer's filing limit — that is contract. The realistic question on an aged balance is not whether coverage existed but whether anything can still be filed against it.Recall the account from wherever it went
A balance found to be a payer's is no longer the patient's, and it should not still be in a statement cycle or with an agency while that is established. Sending an account to collections covers the recall obligation generally.
And a caution about what a diligent search buys you
Common questions
Do we need the patient's permission to search for coverage on their account?
No. The privacy rule's definition of payment expressly includes determinations of eligibility or coverage, including coordination of benefits, and separately includes billing, claims management and collection activities — so an account already in self-pay collections is inside the payment definition before the search starts. A covered entity may use or disclose protected health information for its own payment purposes, and consent for that is permissive rather than required. Permission is genuinely not the constraint here, which is why the constraint that does apply gets missed.
If we can search, is there any limit on what we send in the query?
Yes, and it is the part most discovery programs have never addressed. The minimum necessary standard applies to requesting information, not only to using or disclosing it — the rule names requesting in its opening clause and closes on the use, disclosure or request. Its exemptions are a closed list that does not include payment, so a treatment request is exempt and a discovery request is not. There is an entire implementation specification devoted to requests, and a hard bar on requesting an entire record without specific justification. What the regulation does not do is state a content limit; it delegates one to your own written protocol, and for a routine and recurring activity like bulk discovery that protocol is what compliance is measured against.
Will the payer tell us if we ask for too much?
No, and this is the asymmetry that makes the sizing question consequential. The rule permits a covered entity to rely, where reasonable, on a request as being the minimum necessary when it comes from another covered entity. So a payer answering your inquiry is entitled to assume you asked for what you needed, and there is no second check anywhere downstream. The only party legally obliged to size the question is the practice, and it is the party with the least incentive to. That is why the protocol, rather than any individual query, is the thing worth building.
Does a health plan have to tell us whether a person is covered?
Nothing read establishes that it does, and the provision people reach for does not say it. The rule obliging a plan to conduct a transaction as a standard transaction when asked governs the form of an exchange, not its substance — and the eligibility inquiry it governs is framed as a question about a benefit plan for an enrollee, which presupposes the fact a discovery query exists to establish. A search of the transaction rules turns up nothing conditioning a plan's duty on a relationship with the provider, and equally nothing creating a right of discovery against a plan you have no relationship with. Treat a response as something obtained, not something owed.
We found a policy on an old Medicare account. Is that good news?
Partly, and the other part arrives faster. The statutory bar is expectational: Medicare payment may not be made to the extent payment has been made or can reasonably be expected to be made by a primary plan. So discovering coverage does not simply reveal a better payer — it recharacterizes the payment Medicare already made, and your own search is the evidence. The repayment period begins on the date the information is received rather than on the date somebody worked the result, so a return file sitting unworked is a running clock. Meanwhile the filing limit has been running since the date of service and none of its enumerated exceptions is triggered by discovery. The obligation frequently outlives the opportunity.
Does finding coverage reopen the filing window?
Not on the Medicare side. The exceptions to the filing limit are enumerated and every one of them is about Medicare's own status changing retroactively — entitlement granted after the fact, a state program recouping after the fact, a retroactive plan disenrollment. Discovery is not among them. An item omitted from an initial claim also cannot be added by adjustment once the limit has passed, and an untimely-filing denial is not an initial determination, so there is no appeal from it — only informal contractor review on request. For a commercial payer the window is a contract term and nothing in the federal material governs it, so it has to be read in the agreement.
Should we place aged self-pay accounts with an agency and run discovery in parallel?
Sequence matters more than parallelism. A balance that turns out to be a payer's was never the patient's, and having it in a statement cycle or with an agency while that is being established is the wrong posture. Running the coverage question ahead of the charity determination is the same discipline in the other direction: a determination of need reached without asking about coverage first converts a payable claim into a discount nobody was owed, and that is the harder one to reverse. Where a hit lands on an account already placed, recall it and record why.
Key terms in this article
Defined once, on their own pages.
Continue learning
The verification this is the retrospective version of, the determination it precedes, and the duty a hit creates.
Confirming Active Coverage and Effective Dates
The same question asked before the encounter, where it is cheaper and the answer is usable.
Presumptive Charity Eligibility
The determination that has to come after this one, and what goes wrong when it comes first.
The 60-Day Overpayment Rule
The return duty a positive hit can create, on a clock of its own.
Medicaid Third-Party Liability
The program where identifying other coverage is a condition of the payer's own participation.
Sending an Account to Collections
Placement, and the recall obligation when a placed balance turns out to belong to a payer.
Timely Filing Calculator
Check whether anything can still be filed against a policy found on an aged balance.
Authoritative sources
- 45 CFR §§ 164.501, 164.502(b), 164.506 and 164.514(d) — Payment activities and the minimum necessary standard (opens in a new tab)
The definition of payment expressly includes determinations of eligibility or coverage, including coordination of benefits, and separately includes billing, claims management and collection activities. A covered entity may use or disclose protected health information for its own payment purposes, and consent for that purpose is permissive. The minimum necessary standard applies when requesting protected health information as well as when using or disclosing it, and its exemptions — treatment, the individual, an authorization, the Secretary, required by law, and compliance with the subchapter — do not include payment. The implementation specifications treat requests separately from disclosures, requiring policies and procedures which may be standard protocols for routine and recurring requests and criteria plus individual review for others, and prohibit using, disclosing or requesting an entire medical record except where specifically justified. A covered entity may rely, where reasonable, on a request from another covered entity as being the minimum necessary.
- 45 CFR §§ 162.925, 162.1201 and 162.1202 — The eligibility inquiry and a health plan's duties (opens in a new tab)
The health care eligibility benefit inquiry and response transaction is defined as a provider's inquiry to a health plan about eligibility, coverage or benefits for an enrollee, and the plan's response. A health plan asked to conduct a transaction as a standard transaction must do so, may not delay or reject it on the ground that it is a standard transaction, and may not reject one because it contains data elements the plan does not need or use — coordination of benefits information being the regulation's own example. These are requirements about the form of an exchange; nothing in them obliges a plan to disclose whether a given individual is enrolled, and the inquiry is framed around an enrollee rather than around establishing enrollment.
- 42 U.S.C. § 1395y(b)(2) and 42 CFR § 489.20 — Medicare Secondary Payer and the provider agreement (opens in a new tab)
Payment may not be made to the extent that payment has been made, or can reasonably be expected to be made, by a primary plan — an expectational bar rather than an actual one. The repayment period for a conditional payment runs from the date notice of, or information related to, a primary plan's responsibility is received. The provider agreement requires maintaining a system that, during the admission process, identifies any primary payers other than Medicare so that incorrect billing and overpayments can be prevented, and requires billing other primary payers before Medicare. Where a primary payer reduced payment because the provider failed to file a proper claim, the amount billable to Medicare is capped at what would have been payable as a secondary payment on a proper claim; the reduction may be charged to the beneficiary only where the provider can show it failed to file solely because the beneficiary failed to give the necessary information, and not where the beneficiary was physically or mentally incapacitated.
- CMS Medicare Claims Processing Manual, Pub. 100-04, Chapter 1, §§ 70–70.7 — The filing limit and its exceptions (opens in a new tab)
The filing limit runs from the date of service, and the enumerated exceptions are all cases in which Medicare's own status changed retroactively: administrative error by a Medicare-side actor, retroactive Medicare entitlement, retroactive entitlement combined with a state Medicaid agency recouping after the fact, and retroactive disenrollment from a plan combined with a recoupment. Discovering other coverage is not among them. An item or service omitted from an initial claim may not be added by adjustment after the limit has expired; an untimely-filing denial is not an initial determination, so the provider has no appeal rights and only informal contractor review on request; and where a late claim is filed with no explanation, the contractor is to assume the provider accepts responsibility for the late filing. Where an exception applies, the extension is measured from the date the provider was first notified or from the month of a recoupment, rather than from the date of service.