Medical Records captured by HSA

Question

The website of my HSA has recently began forcing all this rigmarole for submitting reimbursement claims that has made me nervous about them essentially possessing all this medical history on their site.

They now push you to define providers and give the addresses and optionally a medical ID / account number for that provider. Claims have to be dialed in with the dates of service, the patient's name and DOB, and optionally can upload a receipt to associate with the claim.

I realize they're trying to streamline the packaging of an auditable package of qualifying medical expenses and what not but I take care of such things myself with my own thorough record keeping. I don't really feel comfortable with a third party consolidating all this information of ours.

I'm thinking about just creating a generic bucket provider and reimburse all claims under myself. My question is how folks take this change of user experience for an HSA. Does a third party HSA entity really need all this information, what are the pro/cons of such a redesign? Could my generic strategy described above come back and bite me?

Prior to the redesign the only field they had was a description field that was listed on the statements and printed in a form where the end user detailed their own short hand of account information.

Here's some language that shows up on the web forms:

Provider - You can choose to list your provider/payee or choose self/other as the provider. This information is only used to complete the details needed for your records within the expense journal.

Entering expense information allows you to record the details of your payment in the Expense Journal.

Date of Service (optional)

Expense category (optional) None, Dental, Medical, Vision, Pharmacy, Dependent Care, Premium, Transportation

Patient/Recipient (optional)

Description (optional)

Answer 1

I don't believe there is any federal requirement that the banks collect that much information, and I think your guess is correct that they are doing this as a service to the customer in case you are ever audited. My HSA bank doesn't offer fields to enter in that information, so in the description field I typically put something like:

Unreimbursed medical expenses for April 1, 2017 - June 30, 2017.

That's all my bank gets to know. I have a folder of receipts I keep at home (which I plan to scan and store online someday). Given that the fields your bank provides all appear to be optional I would assume you could do the same thing if you are more comfortable self managing your receipts.

As for your specific question:

Could my generic strategy described above come back and bite me?

Yes, if you lose your receipts and you are audited. If both of those happened you may be able to rebuild your receipts from the original providers, but that "bite" would probably sting quite a bit.

Answer 2

My experience with an HSA has been:

• if you use the debit card they know it was for medical expenses by the vendor ID. So nothing additional is needed.
• if you use the website to "pay my provider" they want the information you mention: provider/dates/very broad categories/which family member.
• they added a requirement a few years ago for invoice/patient number so that the medical provider could correctly apply the electronic funds transfer
• the most paperwork is when you ask for the funds to be sent to you. They want to see a detailed bill or Explanation of Benefits.

For some items (prescriptions and co-pays) I use the debit card. For ones where the bill is more complex I wait until the doctor bills me, then I use "pay my provider" The extra paperwork for the pay-me-back makes me avoid it.

The HSA company has to follow HIPAA regulations for medical records. They should have info on their website describing their policies.

I believe your plan to have the funds sent to you could cause a problem. I am surprised that they don't require more documentation to send the funds to you.