Use and Disclosure of Protected Health Information: Difference between revisions

#Each use or disclosure of PHI must be an authorized use or disclosure (either by a written patient authorization or Nebraska Medicine/UNMC policy). Some of the authorized uses and disclosures are described in this policy and associated policies.

#The use or disclosure of PHI must be in accordance with the [https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices].

#Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.)

#Uses and disclosures of PHI may be subject to requests for confidential communications. (See Confidential Address policy.) '''need Nebr Med policy #'''

#All uses and disclosures of PHI should be made in accordance with safeguards adopted by Nebraska Medicine/UNMC to further protect the privacy of PHI.

#Improper uses and disclosures of PHI should be immediately brought to Privacy Office’s attention so it can consider and facilitate the implementation of any effective mitigation or remedial steps.

==Procedures==

Protected Health Information (PHI) may be used and disclosed within the [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Affiliated_Covered_Entity_.28ACE.29 Affiliated Covered Entity (ACE)] for each member’s own treatment, [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Payment_2 Payment] and [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Health_Care_Operations_2 Health Care Operations] if it has or is about to have a treatment relationship with the Individual supporting its need for such use or disclosure of such information, without having to obtain the Individual’s authorization. ACE entities also may share PHI with one another without Individual authorization as permitted by HIPAA and necessary for the delivery of health care treatment, payment and operations. <br />

===Treatment===

#If the request is from a health care provider who is not a member of Nebraska Medicine/UNMC’s medical staff, Nebraska Medicine/UNMC staff should request confirmation that there is a treatment relationship or determine, based on the medical record, that there is a treatment relationship. For example, if the record includes documentation that the Individual was brought by the local emergency squad, the treatment relationship between Nebraska Medicine/UNMC and the EMS provider is confirmed.

#Release/disclosure of Individual's information should be documented by the department/Workforce member releasing the information. Releases of information outside of the Health Information Management department (HIM) should be documented in the medical record, such as by using Epic/One Chart’s Quick Disclosure.

Nebraska Medicine/UNMC may disclose PHI to another provider or covered entity for its [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Payment_2 Payment] purposes after confirming that the other provider or covered entity has a treatment relationship that supports the request for information.

#Release/disclosure of patient information should be documented by the department/Workforce member releasing the information. Releases of information outside of HIM should be documented in the medical record, such as by using Epic/One Chart’s Quick Disclosure.

===Health Care Operations===

Nebraska Medicine/UNMC may disclose PHI to another covered entity (including members of its medical staff) for certain health care operations of the requesting covered entity if the following steps are followed. Requests of this type are expected to be infrequent.  

##Ask if the Individual would prefer to talk in a more private location.

===Disclosures to the Individual===

#For Other Disclosures to Individual

##For disclosures in written or electronic form, staff should document the disclosure/release in one of the following ways:

===Disclosures to Family, Friends and Others===

====Facility Directory====

====Disclosures with Individual’s Permission====

#You may disclose PHI to the Individual in the presence of others if the Individual is asked and consents or is given a chance to object and does not verbally object to such disclosure and you reasonably infer from the circumstances that the Individual does not object. Disclosures of sensitive information, such as mental health or sexually transmitted disease diagnoses, should only be disclosed with the permission of the Individual.

Nebraska Medicine/UNMC may disclose PHI about an Individual in order to notify family, friends or others of the Individual’s whereabouts, general condition or death. In these cases, Nebraska Medicine/UNMC may not know the details of the involvement of others in the patient’s care or payment for care. Therefore, in these cases, try to follow these steps:

#Ask the Individual, if possible, whether they consent to such disclosure and rely on what the patient says.

#If following the above steps does not work, use your best judgment in making contact with family, friends or others for notification purposes. Try asking for the person by order of priority (See Nebraska Medicine Consents and Permits policy, MS14.) Try to limit disclosures to individuals in the highest priority you can locate. In the end, use your best professional judgment in deciding how much you can say and to whom.

#When the Individual has been deemed not competent, and is not expected to regain competence, and no family or friend has been located to act on the Individual’s behalf, Care Transitions and/or Pastoral Services staff may reach out to resources, such as the Individual’s landlord or employer (if known), agencies contracted for such purposes with the assistance of Legal Services, or local enforcement. In all such cases, the disclosure of PHI shall be limited solely to the Individual’s name and date of birth unless permission has been obtained from the [mailto:privacy@nebraskamed.com Privacy Office] to disclosure additional information.

====Uses/Disclosure of PHI for Electronic Health Information Exchanges====

=====CyncHealth (Previously NeHII)=====

CyncHealth participants may access CyncHealth PHI pursuant to [https://cynchealth.org/privacy-security/ CyncHealth’s Privacy and Information Security Policies and Procedures]. If unsure as to whether a particular use or disclosure is permissible, contact the [mailto:privacy@nebraskamed.com Privacy Office].  

#All users of the eHealth Exchange are required to cooperate with Nebraska Medicine/UNMC on related investigations or issues; request, use and disclose eHealth Exchange message content only for treatment purposes; comply with all applicable laws and report any suspected breach of PHI to the Privacy Office immediately. Users must not disclose passwords or any other security measures to anyone.

===Business Associate Agreements/Addendums===

===Use/Disclosure of PHI for Training Health Care Professionals ===

See UNMC Policy No. 6303, [[Use and Disclosure of PHI for Training Health Care Professionals]]

Refer requests for disclosures of PHI for marketing or fundraising purposes to the [mailto:privacy@nebraskamed.com Privacy Office].

===Use/Disclosure of PHI for Research===

#For research requests involving use of a decedent's information, Nebraska Medicine/UNMC must obtain from the researcher (before making such disclosure):  

##A representation that the requested use or disclosure of PHI is solely for research on the PHI of decedents;

#To an Individual who is requesting access to their own PHI;

#As required by law; and

===Minimum Necessary===

#The “minimum necessary” standard does not apply to the following requests, uses and disclosures of PHI:

##Uses, disclosures or requests among health care providers for treatment purposes.

#Workforce. The minimum necessary standard applies to access and use of PHI by members of the Workforce. Each member of the Workforce must avoid intentionally accessing, using or disclosing PHI except as authorized by Nebraska Medicine/UNMC’s policies.  

##When using, disclosing, or requesting PHI, staff shall make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. Disclosure of the entire medical record is prohibited unless specifically justified and documented in the medical record as the minimum necessary for the request or otherwise required by law.

#Departments who provide PHI in response to valid requests shall ensure that minimum necessary requirements are met.  

##Routine/recurring disclosures: managers of departments who routinely release PHI on a recurring basis (e.g., HIM, Decision Support depts., etc.) shall establish minimum necessary written protocols for standard releases of PHI internally and externally.

##Biometric identifiers, including finger and voice prints; and  

## Full-face photographic images and any comparable images.

===De-identification/Re-identification of PHI===

#PHI may be used to create information that is not individually identifiable health information (i.e., de-identified information). The HIPAA privacy rules do not apply to de-identified information that does not identify an Individual and cannot be used to identify an Individual. PHI is de-identified when one of the following methods is used:  

##The 18 identifiers of the Individual or of the Individual’s relatives, employers, or household members are removed and Nebraska Medicine/UNMC does not have actual knowledge that the information could be used alone or in combination with other information to identify the Individual who is the subject of the information. The identifiers are:

##All elements of dates except year, for dates related to Individual (e.g., birth date, admission date, discharge date, date of death);  

##Telephone numbers;  

Legally separate covered entities that designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. Access and amendment rights apply to designated record sets throughout the ACE.

===Designated Record Set (DRS)===

The following activities related to the Organization's functions as a health care provider and sponsor of a self-insured health plan:

#Quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities, otherwise these activities may be classified as research if PHI is included;

#Reviewing the competence or qualifications and accrediting/licensing of health care providers;

#Training health care professionals;

#Business planning and development;

#Business management activities

#Fundraising (see restrictions below).

===Health Information Exchange (HIE)===

===Individual===

The person who is the subject of the PHI. Personal representatives of the Individual have the same rights as the Individual under HIPAA (i.e., they “step into the shoes” of the Individual). Personal representatives include the legal guardian and anyone else authorized by law to act on behalf of the Individual. (See Nebraska Medicine Consents and Permits policy, MS14.)

===Payment===

Activities undertaken by a health care provider or health plan to obtain premiums, to determine or fulfill its responsibility for coverage and provision of benefits under the health plan or to obtain or provide reimbursement for the provision of health care. Some of these types of activities include determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), billing, collection activities, claims management, medical necessity determinations, utilization review activities including pre-certification and pre-authorization of services, disclosure to consumer reporting agencies related to collection of premiums or reimbursement and health care data processing related to the above-listed activities.  

Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that:

*is created or received by UNMC/ACE; and

PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age):

*the genetic tests of an Individual’s family members; or

*the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history); or

*employment records held by UNMC in its role as employer.

===Research ===

===Sale of Protected Health Information ===

===Treatment===

The provision, coordination or management of health care and related services by one or more health care providers including the coordination or management of health care by a health care provider with a third party, consultation between health care providers relating to a patient, or the referral of a patient for health care from one health care provider to another.

===Workforce===

==Additional Information==

*Contact the [mailto:debrbishop@nebraskamed.com Privacy Officer] or the [mailto:privacy@nebraskamed.com Privacy Office] at 402-559-5136 '''is this phone # still correct?'''

*UNMC Policy No. 6058, [[Notice of Privacy Practices]]

*'''UNMC Policy No. 6066, [[Psychotherapy Notes]] is this being deleted or kept? If being kept, it should be reviewed and review date note on policy 6066, even if not changed.'''

*[https://unmcredcap.unmc.edu/redcap/surveys/?s=94TLJCCAAT Request for Electronic Health Data] Form

*Nebraska Medicine Consents and Permits policy, MS14.

*[https://nebraska.edu/-/media/unca/docs/offices-and-policies/policies/executive-memorandum/hipaa-compliance-policy.pdf University of Nebraska Executive Memorandum No. 27]