Use and Disclosure of Protected Health Information

POLICY NO : 6057

EFFECTIVE DATE: 03/17/03

Use and Disclosure of Protected Health Information Policy

NOTE: These guidelines are provided to assist UNMC workforce, including those in the patient treatment areas of the Munroe-Meyer Institute, the College of Medicine Optical Shop, the Lions Eye Bank and the College of Dentistry, as applicable, comply with HIPAA regulations. Those departments and clinics which fall under the jurisdiction of The Nebraska Medical Center and/or University Medical Associates should consult the policies and procedures of those entities for authoritative guidance.

Basis for Policy

It is the policy of the University of Nebraska Medical Center (UNMC) to use and disclose protected health information in accordance with Health Insurance Portability and Accountability Act of 1996 (HIPAA) requirements and Executive Memorandum No. 27.

Policy

Protected Health Information (PHI) may be used and disclosed by UNMC, The Nebraska Medical Center, UMA, and UDA (the entities) for treatment, payment and healthcare operations (as defined by HIPAA).

• As affiliated covered entities, these entities may share PHI with one another without patient authorization to conduct business on behalf of the organizations
• Care providers may share medical information with the individual and other people the individual would like to be involved in his/her care (i.e. family members, other relatives, friends, etc.). If possible, care providers should obtain the individual’s permission to share information with others during the course of treatment. However, care providers may use their professional judgment and reasonably infer from the circumstances that an individual does not object to sharing information with others who may visit or call on the telephone. Only information relevant to such person’s involvement with the individual’s care should be shared.

Authorizations for the use /disclosure of protected health information shall be obtained in accordance with HIPAA:

Health Information Use and Disclosure AuthorizationForm

Research Preparation Request

Request for Protected Health Information

Use and disclosure guidelines for psychotherapy notes (process notes) are outlined in UNMC Policy No. 6066, Psychotherapy Notes. Guidelines for the use of PHI for fundraising purposes are outlined in Fundraising Procedures.

Definitions

Healthcare operations means the following activities related to UNMC’s function as an affiliated healthcare provider and sponsor of a self-insured health plan:

• Quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines
• Population-based activities relating to improving health or reducing health care costs
• Protocol development
• Contacting of health care providers and patients with information about treatment alternatives
• Case management and care coordination
• Risk assessment
• Reviewing the competence or qualifications and accrediting/licensing of healthcare providers and plans
• Training future healthcare professionals (students and residents)
• Conducting or arranging for legal services
• Business planning and development
• Business management activities
• General administrative and business functions
• Conducting or arranging for medical review and auditing services
• Insurance activities relating to the renewal of a contract of insurance
• Evaluating healthcare provider and plan performance
• Resolution of internal grievances
• Fundraising

Payment means activities undertaken by a healthcare provider or health plan to obtain reimbursement for the provision of health care. Activities include determinations of insurance coverage, premiums, provision of benefits under a health plan, adjudication of health benefit claims, billing, collection activities, claims management, medical data processing, medical necessity determinations, utilization review activities including pre-certification and pre-authorization, disclosure to consumer reporting agencies related to collection of premiums or reimbursement, and health care data processing related to the above listed activities.

Protected Health Information (PHI) is individually identifiable health information. Health information means any information, whether oral or recorded in any medium, that:

• is created or received by UNMC; and
• relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

Records containing PHI, in any form, are the property of UNMC. The PHI contained in the record is the property of the individual who is the subject of the record.

Protected health information excludes education records covered by the Family Educational Rights and Privacy Act (FERPA), and employment records held by UNMC in its role as employer.

Treatment means the provision, coordination or management of health care and related services by one or more healthcare providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.

For more detailed information, contact Sheila Wrobel, Privacy Officer, or The Nebraska Medical Center Medical Records at 559-4705 or seeUse and Disclosure of Protected Health Information Procedures.

Use and Disclosure of Protected Health Information Procedures / Fundraising Procedures /

HIPAA Professional Health Care Education Procedures / Health Information Use and Disclosure Authorization Form /

Request for Protected Health Information Form /

Research Preparation Request /Data Use Agreement

This is a new UNMC policy.

This page updated on Monday, February 16, 2004, by dkp.