257
edits
Use and Disclosure of Protected Health Information: Difference between revisions
Jump to navigation
Jump to search
Use and Disclosure of Protected Health Information (view source)
Revision as of 13:59, March 28, 2024
, March 28→General Policies Governing the Use and Disclosure of PHI
Mhurlocker (talk | contribs) |
Mhurlocker (talk | contribs) |
||
| Line 46: | Line 46: | ||
#The person or entity to which PHI is disclosed must be authorized to receive it and their identity and authority must be verified prior to such disclosure. (See Verification and Authority policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d IM55] and the Nebraska Medicine Consents and Permits policy, MS14, Authorized Consenting Persons section.) | #The person or entity to which PHI is disclosed must be authorized to receive it and their identity and authority must be verified prior to such disclosure. (See Verification and Authority policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d IM55] and the Nebraska Medicine Consents and Permits policy, MS14, Authorized Consenting Persons section.) | ||
#Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.) | #Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.) | ||
#Uses and disclosures of PHI may be subject to requests for confidential communications. (See Confidential Address policy.) | #Uses and disclosures of PHI may be subject to requests for confidential communications. (See Confidential Address policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d REG365].) | ||
#If a disclosure of PHI is subject to an Individual’s right to an accounting, it must be documented per UNMC Policy No. 6061, [https://wiki.unmc.edu/index.php/Accounting_of_PHI_Disclosures Accounting of Protected Health Information Disclosures]. Also note the documentation requirements listed throughout this policy and associated policies. | #If a disclosure of PHI is subject to an Individual’s right to an accounting, it must be documented per UNMC Policy No. 6061, [https://wiki.unmc.edu/index.php/Accounting_of_PHI_Disclosures Accounting of Protected Health Information Disclosures]. Also note the documentation requirements listed throughout this policy and associated policies. | ||
#Requests for uses and disclosures of PHI that are not clearly addressed in Nebraska Medicine/UNMC policies must be considered and resolved by a designated decision-maker. The [mailto:debrbishop@nebraskamed.com Privacy Officer] is the designated decision-maker unless someone else is designated by the [mailto:privacy@nebraskamed.com Privacy Office] | #Requests for uses and disclosures of PHI that are not clearly addressed in Nebraska Medicine/UNMC policies must be considered and resolved by a designated decision-maker. The [mailto:debrbishop@nebraskamed.com Privacy Officer] is the designated decision-maker unless someone else is designated by the [mailto:privacy@nebraskamed.com Privacy Office] for a particular policy or situation. (See Nebraska Medicine Consents and Permits policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d MS14].) | ||
#All uses and disclosures of PHI should be made in accordance with safeguards adopted by Nebraska Medicine/UNMC to further protect the privacy of PHI. | #All uses and disclosures of PHI should be made in accordance with safeguards adopted by Nebraska Medicine/UNMC to further protect the privacy of PHI. | ||
#Improper uses and disclosures of PHI should be immediately brought to Privacy Office’s attention so it can consider and facilitate the implementation of any effective mitigation or remedial steps. | #Improper uses and disclosures of PHI should be immediately brought to Privacy Office’s attention so it can consider and facilitate the implementation of any effective mitigation or remedial steps. | ||
| Line 101: | Line 101: | ||
===Disclosures to Family, Friends and Others=== | ===Disclosures to Family, Friends and Others=== | ||
====Facility Directory==== | ====Facility Directory==== | ||
Nebraska Medicine/UNMC may include limited information about an Individual in the facility directory or census and may disclose that information to people who ask about the Individual by name, or to members of the clergy, in accordance with applicable policies. (See Nebraska Medicine Private Designation policy, for additional details.) | Nebraska Medicine/UNMC may include limited information about an Individual in the facility directory or census and may disclose that information to people who ask about the Individual by name, or to members of the clergy, in accordance with applicable policies. (See Nebraska Medicine Private Designation policy [https://secure.compliance360.com/Default.aspx RI15], for additional details.) | ||
====Disclosures with Individual’s Permission==== | ====Disclosures with Individual’s Permission==== | ||
#You may disclose PHI to the Individual in the presence of others if the Individual is asked and consents or is given a chance to object and does not verbally object to such disclosure and you reasonably infer from the circumstances that the Individual does not object. Disclosures of sensitive information, such as mental health or sexually transmitted disease diagnoses, should only be disclosed with the permission of the Individual. | #You may disclose PHI to the Individual in the presence of others if the Individual is asked and consents or is given a chance to object and does not verbally object to such disclosure and you reasonably infer from the circumstances that the Individual does not object. Disclosures of sensitive information, such as mental health or sexually transmitted disease diagnoses, should only be disclosed with the permission of the Individual. | ||
| Line 231: | Line 231: | ||
###Full face photographic images and any comparable images; and | ###Full face photographic images and any comparable images; and | ||
###Any other unique identifying number, characteristic, or code. | ###Any other unique identifying number, characteristic, or code. | ||
##A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable, applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an Individual who is a subject of the information; and documents the methods and results of the analysis that justify such determination. The Legal Services | ##A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable, applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an Individual who is a subject of the information; and documents the methods and results of the analysis that justify such determination. The [mailto:contracts@nebraskamed.com NE Med Legal Services Department] and/or [mailto:privacy@nebraskamed.com Privacy Office] must approve of the use of this de-identification method and the person who performs it. | ||
#Re-identification of PHI. A code or other means of record identification may be assigned to allow information de-identified above to be re-identified by Organization, provided that: | #Re-identification of PHI. A code or other means of record identification may be assigned to allow information de-identified above to be re-identified by Organization, provided that: | ||
##The code or other means of record identification is not derived from or related to information about the Individual and is not otherwise capable of being translated so as to identify the Individual; and | ##The code or other means of record identification is not derived from or related to information about the Individual and is not otherwise capable of being translated so as to identify the Individual; and | ||
| Line 246: | Line 246: | ||
#The minimum necessary standard does not apply to disclosures to disaster relief agencies. | #The minimum necessary standard does not apply to disclosures to disaster relief agencies. | ||
===Authorization Generally Required for All Other Uses/Disclosures=== | ===Authorization Generally Required for All Other Uses/Disclosures=== | ||
Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Nebraska Medicine Consents and Permits policy, MS14) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900) | Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Nebraska Medicine Consents and Permits policy, MS14) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900). Forms can be requested at [[Mailto:Privacy@NebraskaMed.com|Privacy@NebraskaMed.com]]. Restrictions on the use and disclosure of psychotherapy notes are explained in UNMC Policy Nos. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set] and 6066, [[Psychotherapy Notes]]. | ||
===Compound Authorizations=== | ===Compound Authorizations=== | ||
An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases: | An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases: | ||