1,619
edits
Use and Disclosure of Protected Health Information: Difference between revisions
Jump to navigation
Jump to search
Use and Disclosure of Protected Health Information (view source)
Revision as of 10:54, February 10, 2016
, February 10, 2016→Minimum Necessary
| Line 170: | Line 170: | ||
All other uses and disclosures of PHI not described in the sections above are prohibited unless the patient signs an authorization specifically permitting the use/disclosure (Form CON-MR-0074). Restrictions on the use and disclosure of psychotherapy notes are explained in UNMC Policy No. 6066, [[Psychotherapy Notes]]. | All other uses and disclosures of PHI not described in the sections above are prohibited unless the patient signs an authorization specifically permitting the use/disclosure (Form CON-MR-0074). Restrictions on the use and disclosure of psychotherapy notes are explained in UNMC Policy No. 6066, [[Psychotherapy Notes]]. | ||
===Minimum Necessary=== | ===Minimum Necessary=== | ||
When using, disclosing or requesting PHI, staff shall make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purposes of the use, disclosure or request.[http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/minimumnecessary.pdf 45 CFR 164.502(b)] | When using, disclosing or requesting PHI, staff shall make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purposes of the use, disclosure or request.[http://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/coveredentities/minimumnecessary.pdf 45 CFR 164.502(b)] | ||
:#Role-based Access; access to PHI shall be based on role performed as specified in the following: | :#Role-based Access; access to PHI shall be based on role performed as specified in the following: | ||
:##Computer security matrices maintained by electronic health record system security and other system administrators listing staff roles, job codes/titles and associated levels of access to PHI | :##Computer security matrices maintained by electronic health record system security and other system administrators listing staff roles, job codes/titles and associated levels of access to PHI | ||
| Line 183: | Line 183: | ||
:##Disclosure made to the Secretary of HHS for enforcement purposes | :##Disclosure made to the Secretary of HHS for enforcement purposes | ||
:##Electronic data elements transmitted in electronic claims | :##Electronic data elements transmitted in electronic claims | ||
===Limited Data Set=== | ===Limited Data Set=== | ||
A limited data set of PHI may be used and disclosed for the purposes of research, public health or healthcare operations that excludes the following direct identifiers of the individual or of relatives, employers or household members of the individual: | A limited data set of PHI may be used and disclosed for the purposes of research, public health or healthcare operations that excludes the following direct identifiers of the individual or of relatives, employers or household members of the individual: | ||