Use and Disclosure of Protected Health Information - Revision history

Mhurlocker: /* Use/Disclosure of PHI for Research */

2025-10-15T14:43:48Z

Use/Disclosure of PHI for Research

← Older revision		Revision as of 09:43, October 15, 2025
Line 162:		Line 162:
	##Documentation of the death of such Individuals; and		##Documentation of the death of such Individuals; and
	##A representation that the requested PHI is necessary for the research purposes.		##A representation that the requested PHI is necessary for the research purposes.
	#Review of PHI Preparatory to Research. Nebraska Medicine/UNMC staff and students who wish to review PHI to prepare a research proposal must submit a [https://unmcredcap.unmc.edu/redcap/surveys/?s=NMPNWMEA7W Electronic Health Data Request] Form to the [https://www.unmc.edu/~~cctr~~/resources/~~ehr~~/index.html Electronic Health Record Data Access Core] to obtain access to such PHI.		#Review of PHI Preparatory to Research. Nebraska Medicine/UNMC staff and students who wish to review PHI to prepare a research proposal must submit a [https://unmcredcap.unmc.edu/redcap/surveys/?s=NMPNWMEA7W Electronic Health Data Request] Form to the [https://www.unmc.edu/research-resources/resources/cores/readi-core/index.html Electronic Health Record Data Access Core] to obtain access to such PHI.
	#Access to PHI for reviews preparatory to research requires that the researcher provide the following representations in advance of such disclosure and use:		#Access to PHI for reviews preparatory to research requires that the researcher provide the following representations in advance of such disclosure and use:
	##that the use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;		##that the use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;

Afaylor: /* Additional Information */ updated Health Insurance Portability and Accountability Act of 1996 (HIPAA) link

2025-09-29T18:57:44Z

Additional Information: updated Health Insurance Portability and Accountability Act of 1996 (HIPAA) link

← Older revision		Revision as of 13:57, September 29, 2025
Line 333:		Line 333:
	*[https://nebraska.edu/-/media/unca/docs/offices-and-policies/policies/executive-memorandum/hipaa-compliance-policy.pdf University of Nebraska Executive Memorandum No. 27]		*[https://nebraska.edu/-/media/unca/docs/offices-and-policies/policies/executive-memorandum/hipaa-compliance-policy.pdf University of Nebraska Executive Memorandum No. 27]
	*[http://nehii.org/index.php?option=com_docman&Itemid=59 NeHII Privacy and Information Security Policies and Procedures]		*[http://nehii.org/index.php?option=com_docman&Itemid=59 NeHII Privacy and Information Security Policies and Procedures]
	*[https://www.cdc.gov/phlp/~~publications~~/~~topic~~/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)]		*[https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)]
	*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]		*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]
	*[https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html HIPAA Security Rule]		*[https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html HIPAA Security Rule]

	This page is maintained by [mailto:mhurlocker@unmc.edu mh].		This page is maintained by [mailto:mhurlocker@unmc.edu mh].

Afaylor: /* Additional Information */ updated HIPAA Security Rule link

2025-09-29T18:57:06Z

Additional Information: updated HIPAA Security Rule link

← Older revision		Revision as of 13:57, September 29, 2025
Line 335:		Line 335:
	*[https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)]		*[https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)]
	*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]		*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]
	*[https://www.cdc.gov/phlp/~~publications~~/~~topic~~/hipaa.html~~#security-rule~~ HIPAA Security Rule]		*[https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html HIPAA Security Rule]

	This page is maintained by [mailto:mhurlocker@unmc.edu mh].		This page is maintained by [mailto:mhurlocker@unmc.edu mh].

Afaylor: /* Policy */ updated Health Insurance Portability and Accountability Act of 1996 (HIPAA) link

2025-09-29T18:52:59Z

Policy: updated Health Insurance Portability and Accountability Act of 1996 (HIPAA) link

← Older revision		Revision as of 13:52, September 29, 2025
Line 38:		Line 38:

	== Policy ==		== Policy ==
	Nebraska Medicine/UNMC shall limit the use and disclosure of Protected Health Information (PHI) to the right people, for the right purposes, with the right authority, and always subject to reasonable safeguards -- all as defined by the [https://www.cdc.gov/phlp/~~publications~~/~~topic~~/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and Nebraska Medicine/UNMC policies.		Nebraska Medicine/UNMC shall limit the use and disclosure of Protected Health Information (PHI) to the right people, for the right purposes, with the right authority, and always subject to reasonable safeguards -- all as defined by the [https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and Nebraska Medicine/UNMC policies.

	==Purpose==		==Purpose==
	To establish guidelines for the use and disclosure of PHI.		To establish guidelines for the use and disclosure of PHI.

Afaylor: /* Basis for Policy */ updated HIPAA Security Rule link

2025-09-29T18:52:05Z

Basis for Policy: updated HIPAA Security Rule link

← Older revision		Revision as of 13:52, September 29, 2025
Line 35:		Line 35:
	<big>'''Use and Disclosure of Protected Health Information Policy'''</big>		<big>'''Use and Disclosure of Protected Health Information Policy'''</big>
	== Basis for Policy ==		== Basis for Policy ==
	Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/~~publications~~/~~topic~~/hipaa.html~~#security-rule~~ HIPAA Security Rule] outline considerations for the access control family of security controls.		Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html HIPAA Security Rule] outline considerations for the access control family of security controls.

	== Policy ==		== Policy ==
	Nebraska Medicine/UNMC shall limit the use and disclosure of Protected Health Information (PHI) to the right people, for the right purposes, with the right authority, and always subject to reasonable safeguards -- all as defined by the [https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and Nebraska Medicine/UNMC policies.		Nebraska Medicine/UNMC shall limit the use and disclosure of Protected Health Information (PHI) to the right people, for the right purposes, with the right authority, and always subject to reasonable safeguards -- all as defined by the [https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and Nebraska Medicine/UNMC policies.

Mhurlocker at 18:18, April 22, 2024

2024-04-22T18:18:11Z

← Older revision		Revision as of 13:18, April 22, 2024
Line 30:		Line 30:
	Policy No.: '''6057'''<br />		Policy No.: '''6057'''<br />
	Effective Date: '''03/17/03'''<br />		Effective Date: '''03/17/03'''<br />
	Revised Date: '''~~draft~~ 03/28/24'''<br />		Revised Date: '''03/28/24'''<br />
	Reviewed Date: ''' '''<br />		Reviewed Date: ''' 04/22/24'''<br />

	<big>'''Use and Disclosure of Protected Health Information Policy'''</big>		<big>'''Use and Disclosure of Protected Health Information Policy'''</big>

Mhurlocker at 19:23, March 28, 2024

2024-03-28T19:23:07Z

← Older revision		Revision as of 14:23, March 28, 2024
Line 30:		Line 30:
	Policy No.: '''6057'''<br />		Policy No.: '''6057'''<br />
	Effective Date: '''03/17/03'''<br />		Effective Date: '''03/17/03'''<br />
	Revised Date: '''draft 09/20/22'''<br />		Revised Date: '''draft 03/28/24'''<br />
	Reviewed Date: ''' '''<br />		Reviewed Date: ''' '''<br />

Mhurlocker: /* Authorization Generally Required for All Other Uses/Disclosures */

2024-03-28T19:19:10Z

Authorization Generally Required for All Other Uses/Disclosures

Mhurlocker: /* General Policies Governing the Use and Disclosure of PHI */

2024-03-28T18:59:11Z

General Policies Governing the Use and Disclosure of PHI

Mhurlocker: /* Purpose */

2024-03-18T20:46:53Z

Purpose

← Older revision		Revision as of 15:46, March 18, 2024
Line 44:		Line 44:
	#The use or disclosure of PHI must be in accordance with the [https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices].		#The use or disclosure of PHI must be in accordance with the [https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices].
	#The [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Workforce Workforce] member using or disclosing the PHI must do so only as necessary to perform assigned duties.		#The [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Workforce Workforce] member using or disclosing the PHI must do so only as necessary to perform assigned duties.
	#The person or entity to which PHI is disclosed must be authorized to receive it and their identity and authority must be verified prior to such disclosure. (See Verification and Authority policy and the Nebraska Medicine Consents and Permits policy, MS14, Authorized Consenting Persons section.) ~~'''need Nebr Med policy #s'''~~		#The person or entity to which PHI is disclosed must be authorized to receive it and their identity and authority must be verified prior to such disclosure. (See Verification and Authority policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d IM55] and the Nebraska Medicine Consents and Permits policy, MS14, Authorized Consenting Persons section.)
	#Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.)		#Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.)
	#Uses and disclosures of PHI may be subject to requests for confidential communications. (See Confidential Address policy.) '''need Nebr Med policy #'''		#Uses and disclosures of PHI may be subject to requests for confidential communications. (See Confidential Address policy.) '''need Nebr Med policy #'''

← Older revision		Revision as of 14:19, March 28, 2024
Line 246:		Line 246:
	#The minimum necessary standard does not apply to disclosures to disaster relief agencies.		#The minimum necessary standard does not apply to disclosures to disaster relief agencies.
	===Authorization Generally Required for All Other Uses/Disclosures===		===Authorization Generally Required for All Other Uses/Disclosures===
	Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Nebraska Medicine Consents and Permits policy, MS14) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900). Forms can be requested at [~~[Mailto~~:~~Privacy~~@~~NebraskaMed~~.com\|Privacy@NebraskaMed.com]]. Restrictions on the use and disclosure of psychotherapy notes are explained in UNMC Policy Nos. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set] and 6066, [[Psychotherapy Notes]].		Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Nebraska Medicine Consents and Permits policy, MS14) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900). Forms can be requested at [mailto:privacy@nebraskamed.com Privacy@NebraskaMed.com]]. Restrictions on the use and disclosure of psychotherapy notes are explained in UNMC Policy Nos. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set] and 6066, [[Psychotherapy Notes]].
	===Compound Authorizations===		===Compound Authorizations===
	An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases:		An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases:
Line 306:		Line 306:
	Employees, medical staff, volunteers, trainees and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC.		Employees, medical staff, volunteers, trainees and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC.
	==Additional Information==		==Additional Information==
	*Contact the [mailto:debrbishop@nebraskamed.com Privacy Officer] or the [mailto:privacy@nebraskamed.com Privacy Office] ~~at 402-559-5136 '''is this phone # still correct?'''~~		*Contact the [mailto:debrbishop@nebraskamed.com Privacy Officer] or the [mailto:privacy@nebraskamed.com Privacy Office]
	*Legal Services department ~~'''UNMC or Nebr med? best contact info ??'''~~		*NE Med Legal Services department [mailto:contracts@nebraskamed.com Contracts@NebraskaMed.com]
	*Enterprise Applications Executive Director ~~'''need email and/or phone, dept contact info'''~~		*Enterprise Applications Executive Director
	*UNMC Policy No. 6058, [[Notice of Privacy Practices]]		*UNMC Policy No. 6058, [[Notice of Privacy Practices]]
	*UNMC Policy No. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set]		*UNMC Policy No. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set]
Line 320:		Line 320:
	*[https://unmcredcap.unmc.edu/redcap/surveys/?s=94TLJCCAAT Request for Electronic Health Data] Form		*[https://unmcredcap.unmc.edu/redcap/surveys/?s=94TLJCCAAT Request for Electronic Health Data] Form
	*[https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices]		*[https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices]
	*Nebraska Medicine Verification and Authority policy, ~~'''need Nebr Med policy #'''~~		*Nebraska Medicine Verification and Authority policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d IM55]
	*Nebraska Medicine Consents and Permits policy, MS14.		*Nebraska Medicine Consents and Permits policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d MS14]
	*Nebraska Medicine Confidential Address policy, ~~'''need Nebr Med policy #'''~~		*Nebraska Medicine Confidential Address policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d REG365]
	*Nebraska Medicine Private Designation policy, for additional details.) ~~'''need Nebr Med policy #'''~~		*Nebraska Medicine Private Designation policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d R115] for additional details.)
	*Nebraska Medicine Contract Management policy, FN18		*Nebraska Medicine Contract Management policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d FN18]
	*Nebraska Medicine Form CON-MR-0074, '''~~need form name and URL~~ '''		*Nebraska Medicine Form CON-MR-0074, [https://www.nebraskamed.com/patients/medical-records/your-medical-records Authorization for Release of Informatio'''n''']
	*Nebraska Medicine Form CON-MR-1900, ~~'''need form name and URL '''~~		*Nebraska Medicine Form CON-MR-1900, [mailto:privacy@nebraskamed.com Education Authorization]
	*[https://cynchealth.org/privacy-security/ CyncHealth’s Privacy and Information Security Policies and Procedures]		*[https://cynchealth.org/privacy-security/ CyncHealth’s Privacy and Information Security Policies and Procedures]
	*[http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html Uses and Disclosures for Treatment, Payment and Health Care Operations]		*[http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html Uses and Disclosures for Treatment, Payment and Health Care Operations]
Line 335:		Line 335:
	*[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule]		*[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule]

	This page is maintained by [mailto:~~dpanowic~~@unmc.edu ~~dkp~~].		This page is maintained by [mailto:mhurlocker@unmc.edu mh].

← Older revision		Revision as of 13:59, March 28, 2024
Line 46:		Line 46:
	#The person or entity to which PHI is disclosed must be authorized to receive it and their identity and authority must be verified prior to such disclosure. (See Verification and Authority policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d IM55] and the Nebraska Medicine Consents and Permits policy, MS14, Authorized Consenting Persons section.)		#The person or entity to which PHI is disclosed must be authorized to receive it and their identity and authority must be verified prior to such disclosure. (See Verification and Authority policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d IM55] and the Nebraska Medicine Consents and Permits policy, MS14, Authorized Consenting Persons section.)
	#Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.)		#Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.)
	#Uses and disclosures of PHI may be subject to requests for confidential communications. (See Confidential Address policy.) ~~'''need Nebr Med policy #'''~~		#Uses and disclosures of PHI may be subject to requests for confidential communications. (See Confidential Address policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d REG365].)
	#If a disclosure of PHI is subject to an Individual’s right to an accounting, it must be documented per UNMC Policy No. 6061, [https://wiki.unmc.edu/index.php/Accounting_of_PHI_Disclosures Accounting of Protected Health Information Disclosures]. Also note the documentation requirements listed throughout this policy and associated policies.		#If a disclosure of PHI is subject to an Individual’s right to an accounting, it must be documented per UNMC Policy No. 6061, [https://wiki.unmc.edu/index.php/Accounting_of_PHI_Disclosures Accounting of Protected Health Information Disclosures]. Also note the documentation requirements listed throughout this policy and associated policies.
	#Requests for uses and disclosures of PHI that are not clearly addressed in Nebraska Medicine/UNMC policies must be considered and resolved by a designated decision-maker. The [mailto:debrbishop@nebraskamed.com Privacy Officer] is the designated decision-maker unless someone else is designated by the [mailto:privacy@nebraskamed.com Privacy Office] ~~(at 402-559-5136)~~ for a particular policy or situation. (See Nebraska Medicine Consents and Permits policy, MS14.)		#Requests for uses and disclosures of PHI that are not clearly addressed in Nebraska Medicine/UNMC policies must be considered and resolved by a designated decision-maker. The [mailto:debrbishop@nebraskamed.com Privacy Officer] is the designated decision-maker unless someone else is designated by the [mailto:privacy@nebraskamed.com Privacy Office] for a particular policy or situation. (See Nebraska Medicine Consents and Permits policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d MS14].)
	#All uses and disclosures of PHI should be made in accordance with safeguards adopted by Nebraska Medicine/UNMC to further protect the privacy of PHI.		#All uses and disclosures of PHI should be made in accordance with safeguards adopted by Nebraska Medicine/UNMC to further protect the privacy of PHI.
	#Improper uses and disclosures of PHI should be immediately brought to Privacy Office’s attention so it can consider and facilitate the implementation of any effective mitigation or remedial steps.		#Improper uses and disclosures of PHI should be immediately brought to Privacy Office’s attention so it can consider and facilitate the implementation of any effective mitigation or remedial steps.
Line 101:		Line 101:
	===Disclosures to Family, Friends and Others===		===Disclosures to Family, Friends and Others===
	====Facility Directory====		====Facility Directory====
	Nebraska Medicine/UNMC may include limited information about an Individual in the facility directory or census and may disclose that information to people who ask about the Individual by name, or to members of the clergy, in accordance with applicable policies. (See Nebraska Medicine Private Designation policy, for additional details.) ~~'''need Nebr Med policy #'''~~		Nebraska Medicine/UNMC may include limited information about an Individual in the facility directory or census and may disclose that information to people who ask about the Individual by name, or to members of the clergy, in accordance with applicable policies. (See Nebraska Medicine Private Designation policy [https://secure.compliance360.com/Default.aspx RI15], for additional details.)
	====Disclosures with Individual’s Permission====		====Disclosures with Individual’s Permission====
	#You may disclose PHI to the Individual in the presence of others if the Individual is asked and consents or is given a chance to object and does not verbally object to such disclosure and you reasonably infer from the circumstances that the Individual does not object. Disclosures of sensitive information, such as mental health or sexually transmitted disease diagnoses, should only be disclosed with the permission of the Individual.		#You may disclose PHI to the Individual in the presence of others if the Individual is asked and consents or is given a chance to object and does not verbally object to such disclosure and you reasonably infer from the circumstances that the Individual does not object. Disclosures of sensitive information, such as mental health or sexually transmitted disease diagnoses, should only be disclosed with the permission of the Individual.
Line 231:		Line 231:
	###Full face photographic images and any comparable images; and		###Full face photographic images and any comparable images; and
	###Any other unique identifying number, characteristic, or code.		###Any other unique identifying number, characteristic, or code.
	##A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable, applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an Individual who is a subject of the information; and documents the methods and results of the analysis that justify such determination. The Legal Services ~~department '''UNMC or Nebr med? best contact info ??'''~~ and/or [mailto:privacy@nebraskamed.com Privacy Office] must approve of the use of this de-identification method and the person who performs it.		##A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable, applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an Individual who is a subject of the information; and documents the methods and results of the analysis that justify such determination. The [mailto:contracts@nebraskamed.com NE Med Legal Services Department] and/or [mailto:privacy@nebraskamed.com Privacy Office] must approve of the use of this de-identification method and the person who performs it.
	#Re-identification of PHI. A code or other means of record identification may be assigned to allow information de-identified above to be re-identified by Organization, provided that:		#Re-identification of PHI. A code or other means of record identification may be assigned to allow information de-identified above to be re-identified by Organization, provided that:
	##The code or other means of record identification is not derived from or related to information about the Individual and is not otherwise capable of being translated so as to identify the Individual; and		##The code or other means of record identification is not derived from or related to information about the Individual and is not otherwise capable of being translated so as to identify the Individual; and
Line 246:		Line 246:
	#The minimum necessary standard does not apply to disclosures to disaster relief agencies.		#The minimum necessary standard does not apply to disclosures to disaster relief agencies.
	===Authorization Generally Required for All Other Uses/Disclosures===		===Authorization Generally Required for All Other Uses/Disclosures===
	Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Nebraska Medicine Consents and Permits policy, MS14) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900) ~~'''need URL for forms'''~~. Restrictions on the use and disclosure of psychotherapy notes are explained in UNMC Policy Nos. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set] and 6066, [[Psychotherapy Notes]].		Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Nebraska Medicine Consents and Permits policy, MS14) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900). Forms can be requested at [[Mailto:Privacy@NebraskaMed.com\|Privacy@NebraskaMed.com]]. Restrictions on the use and disclosure of psychotherapy notes are explained in UNMC Policy Nos. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set] and 6066, [[Psychotherapy Notes]].
	===Compound Authorizations===		===Compound Authorizations===
	An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases:		An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases: