Ah, wow. Now this is interesting, and I am SOO glad you looked before you leapt. Ironically, in general, YES, providers can disclose records pertinent to payments, and those statute sections I provide below. However you can see there is a little trail of exceptions within the statutes.
And when one is followed out, guess who seems to be the exception to the rule? Psychotherapists. No one else seems to be. (And I can see why!) I will detail it below:
When for payment of services, it is fair game, generally to disclose. This is by virtue of the express provisions of HIPAA, as well as his likely contract terms that are part of his insurance contract with Aetna. When a consumer asks for insurance coverage, part of the deal is that he is consenting to the carrier being able to learn of the actual services he is wanting the carrier to pay for - it helps prevent fraud, etc., because if the carrier had no such right, then they would not be able to approve the billing, make sure it is a covered service, etc. That would also mean that you wouldn't get paid if Aetna were the party paying you. Imagine if you could not bill the client service to the carrier? Anyway, here are your code sections that applied GENERALLY (but not to you necessarily, it appears):
Uses and disclosures of protected health information: general rules.
(a) Standard. A covered entity may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter. (1) Permitted uses and disclosures. A covered entity is permitted to use or disclose protected health information as follows: (ii) For treatment, payment, or health care operations, as permitted by and in compliance with § 164.506 ;..." (see 164.506, below)
Uses and disclosures to carry out treatment, payment, or health care operations.
(a) Standard: Permitted uses and disclosures. Except with respect to uses or disclosures that require an authorization under § 164.508(a)(2) and (3), (SEE THAT EXCEPTION BELOW) a covered entity may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph (c) of this section,... [provided that such use or disclosure is consistent with other applicable requirements of this subpart. (b) Standard: Consent for uses and disclosures permitted. (1) A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations. (2) Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart. (c) Implementation specifications: Treatment, payment, or health care operations. (1) A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations. (2) A covered entity may disclose protected health information for treatment activities of a health care provider. (3) A covered entity may disclose protected health information to another covered entity or a health care provider for the payment activities of the entity that receives the information. (4) A covered entity may disclose protected health information to another covered entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with the individual who is the subject of the protected health information being requested, the protected health information pertains to such relationship, and the disclosure is: (i) For a purpose listed in paragraph (1) or (2) of the definition of health care operations; or (ii) For the purpose of health care fraud and abuse detection or compliance. (5) A covered entity that participates in an organized health care arrangement may disclose protected health information about an individual to another covered entity that participates in the organized health care arrangement for any health care operations activities of the organized health care arrangement."]
Uses and disclosures for which an authorization is required.
(a) Standard: authorizations for uses and disclosures— (1) Authorization required: general rule. Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization. (2) Authorization required: psychotherapy notes. Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except: (i) To carry out the following treatment, payment, or health care operations: (A) Use by the originator of the psychotherapy notes for treatment; (B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or (C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and (ii) A use or disclosure that is required by § 164.502(a)(2)(ii) or permitted by § 164.512(a); § 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; § 164.512(g)(1); or § 164.512(j)(1)(i). [These exceptions to the normal prohibition on psychotherapy disclosure do not seem to apply to your situation, so my read is that you are still prohibited. However, consider checking them out to be sure, in case there is a fact not presented me.]
Note also, that you may want to give your client the option of providing the authorization so you CAN send - if you and he/she believe that his treatment may be deemed not covered it you do not and if he finds that coverage is more important than keeping this entirely private.
I hope this helps!
My goal is to provide you with excellent and accurate service – if you feel you have gotten anything less, please reply back, I am happy to address follow-up questions. Kindly rate me "excellent" when you are done. I look forward to assisting you in the future, should you have legal questions.