323
edits
No edit summary |
Mhurlocker (talk | contribs) No edit summary |
||
(14 intermediate revisions by 2 users not shown) | |||
Line 30: | Line 30: | ||
Policy No.: '''6057'''<br /> | Policy No.: '''6057'''<br /> | ||
Effective Date: '''03/17/03'''<br /> | Effective Date: '''03/17/03'''<br /> | ||
Revised Date: ''' | Revised Date: '''03/28/24'''<br /> | ||
Reviewed Date: ''' '''<br /> | Reviewed Date: ''' 04/22/24'''<br /> | ||
<big>'''Use and Disclosure of Protected Health Information Policy'''</big> | <big>'''Use and Disclosure of Protected Health Information Policy'''</big> | ||
Line 37: | Line 37: | ||
Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] outline considerations for the access control family of security controls. | Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] outline considerations for the access control family of security controls. | ||
== Policy == | == Policy == | ||
Nebraska Medicine/UNMC shall limit the use and disclosure of Protected Health Information (PHI) to the right people, for the right purposes, with the right authority, and always subject to reasonable safeguards -- all as defined by the [https://www.cdc.gov/phlp/publications/topic/hipaa.html | Nebraska Medicine/UNMC shall limit the use and disclosure of Protected Health Information (PHI) to the right people, for the right purposes, with the right authority, and always subject to reasonable safeguards -- all as defined by the [https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and Nebraska Medicine/UNMC policies. | ||
==Purpose== | ==Purpose== | ||
To establish guidelines for the use and disclosure of PHI. | To establish guidelines for the use and disclosure of PHI. | ||
Line 43: | Line 43: | ||
#Each use or disclosure of PHI must be an authorized use or disclosure (either by a written patient authorization or Nebraska Medicine/UNMC policy). Some of the authorized uses and disclosures are described in this policy and associated policies. | #Each use or disclosure of PHI must be an authorized use or disclosure (either by a written patient authorization or Nebraska Medicine/UNMC policy). Some of the authorized uses and disclosures are described in this policy and associated policies. | ||
#The use or disclosure of PHI must be in accordance with the [https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices]. | #The use or disclosure of PHI must be in accordance with the [https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices]. | ||
#The Workforce member using or disclosing the PHI must do so only as necessary to perform assigned duties. | #The [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Workforce Workforce] member using or disclosing the PHI must do so only as necessary to perform assigned duties. | ||
#The person or entity to which PHI is disclosed must be authorized to receive it and their identity and authority must be verified prior to such disclosure. (See Verification and Authority policy, and the Nebraska Medicine Consents and Permits policy, MS14, Authorized Consenting Persons section.) | #The person or entity to which PHI is disclosed must be authorized to receive it and their identity and authority must be verified prior to such disclosure. (See Verification and Authority policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d IM55] and the Nebraska Medicine Consents and Permits policy, MS14, Authorized Consenting Persons section.) | ||
#Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.) | #Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.) | ||
#Uses and disclosures of PHI may be subject to requests for confidential communications. (See Confidential Address policy.) | #Uses and disclosures of PHI may be subject to requests for confidential communications. (See Confidential Address policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d REG365].) | ||
#If a disclosure of PHI is subject to an Individual’s right to an accounting, it must be documented per UNMC Policy No. 6061, [https://wiki.unmc.edu/index.php/Accounting_of_PHI_Disclosures Accounting of Protected Health Information Disclosures]. Also note the documentation requirements listed throughout this policy and associated policies. | #If a disclosure of PHI is subject to an Individual’s right to an accounting, it must be documented per UNMC Policy No. 6061, [https://wiki.unmc.edu/index.php/Accounting_of_PHI_Disclosures Accounting of Protected Health Information Disclosures]. Also note the documentation requirements listed throughout this policy and associated policies. | ||
#Requests for uses and disclosures of PHI that are not clearly addressed in Nebraska Medicine/UNMC policies must be considered and resolved by a designated decision-maker. The [mailto:debrbishop@nebraskamed.com Privacy Officer] is the designated decision-maker unless someone else is designated by the [mailto:privacy@nebraskamed.com Privacy Office] | #Requests for uses and disclosures of PHI that are not clearly addressed in Nebraska Medicine/UNMC policies must be considered and resolved by a designated decision-maker. The [mailto:debrbishop@nebraskamed.com Privacy Officer] is the designated decision-maker unless someone else is designated by the [mailto:privacy@nebraskamed.com Privacy Office] for a particular policy or situation. (See Nebraska Medicine Consents and Permits policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d MS14].) | ||
#All uses and disclosures of PHI should be made in accordance with safeguards adopted by Nebraska Medicine/UNMC to further protect the privacy of PHI. | #All uses and disclosures of PHI should be made in accordance with safeguards adopted by Nebraska Medicine/UNMC to further protect the privacy of PHI. | ||
#Improper uses and disclosures of PHI should be immediately brought to Privacy Office’s attention so it can consider and facilitate the implementation of any effective mitigation or remedial steps. | #Improper uses and disclosures of PHI should be immediately brought to Privacy Office’s attention so it can consider and facilitate the implementation of any effective mitigation or remedial steps. | ||
#All members of the Workforce are required to be familiar with the policies and procedures which affect them in their role at Nebraska Medicine/UNMC and will be held accountable for their individual compliance with such policies and procedures. | #All members of the Workforce are required to be familiar with the policies and procedures which affect them in their role at Nebraska Medicine/UNMC and will be held accountable for their individual compliance with such policies and procedures. | ||
==Procedures== | ==Procedures== | ||
Protected Health Information (PHI) may be used and disclosed within the [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Affiliated_Covered_Entity_.28ACE.29 Affiliated Covered Entity (ACE)] for each member’s own treatment, [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Payment_2 Payment] and [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Health_Care_Operations_2 Health Care Operations] if it has or is about to have a treatment relationship with the Individual supporting its need for such use or disclosure of such information, without having to obtain the Individual’s authorization. ACE entities also may share PHI with one another without Individual authorization as permitted by HIPAA and necessary for the delivery of health care treatment, payment and operations. <br /> | Protected Health Information (PHI) may be used and disclosed within the [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Affiliated_Covered_Entity_.28ACE.29 Affiliated Covered Entity (ACE)] for each member’s own treatment, [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Payment_2 Payment] and [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Health_Care_Operations_2 Health Care Operations] if it has or is about to have a treatment relationship with the Individual supporting its need for such use or disclosure of such information, without having to obtain the Individual’s authorization. ACE entities also may share PHI with one another without Individual authorization as permitted by HIPAA and necessary for the delivery of health care treatment, payment and operations. <br /> | ||
Members of the Workforce may access Individual information for a current, work-related purpose, and shall access only those portions of the medical record as required for the current, work-related purpose. Members of the Workforce shall not access or alter their own medical record. (See UNMC Policy No. 6045, [https://wiki.unmc.edu/index.php/Privacy/Confidentiality Privacy, Confidentiality and Security of Patient and Proprietary Information].) | Members of the [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Workforce Workforce] may access Individual information for a current, work-related purpose, and shall access only those portions of the medical record as required for the current, work-related purpose. Members of the Workforce shall not access or alter their own medical record. (See UNMC Policy No. 6045, [https://wiki.unmc.edu/index.php/Privacy/Confidentiality Privacy, Confidentiality and Security of Patient and Proprietary Information].) | ||
===Treatment=== | ===Treatment=== | ||
Nebraska Medicine/UNMC may disclose PHI to another health care provider for its treatment purposes if the requesting provider has or is about to have a treatment relationship with the Individual to be entitled to the information. | Nebraska Medicine/UNMC may disclose PHI to another health care provider for its treatment purposes if the requesting provider has or is about to have a treatment relationship with the Individual to be entitled to the information. | ||
#If the requesting provider is a member of Nebraska Medicine/UNMC’s medical staff, no further verification of the relationship is needed, and the information may be shared for the requesting provider’s treatment purposes. | #If the requesting provider is a member of Nebraska Medicine/UNMC’s medical staff, no further verification of the relationship is needed, and the information may be shared for the requesting provider’s treatment purposes. | ||
#If the request is from a health care provider who is not a member of Nebraska Medicine/UNMC’s medical staff, Nebraska Medicine/UNMC staff should request confirmation that there is a treatment relationship or determine, based on the medical record, that there is a treatment relationship. For example, if the record includes documentation that the Individual was brought by the local emergency squad, the treatment relationship between Nebraska Medicine/UNMC and the EMS provider is confirmed. | #If the request is from a health care provider who is not a member of Nebraska Medicine/UNMC’s medical staff, Nebraska Medicine/UNMC staff should request confirmation that there is a treatment relationship or determine, based on the medical record, that there is a treatment relationship. For example, if the record includes documentation that the Individual was brought by the local emergency squad, the treatment relationship between Nebraska Medicine/UNMC and the EMS provider is confirmed. | ||
#Release/disclosure of Individual's information should be documented by the department/Workforce member releasing the information. Releases of information outside of the Health Information Management department (HIM) should be documented in the medical record, such as by using Epic/One Chart’s Quick Disclosure. | #Release/disclosure of Individual's information should be documented by the department/Workforce member releasing the information. Releases of information outside of the Health Information Management department (HIM) should be documented in the medical record, such as by using Epic/One Chart’s Quick Disclosure. | ||
Line 65: | Line 65: | ||
Nebraska Medicine/UNMC may disclose PHI to another provider or covered entity for its [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Payment_2 Payment] purposes after confirming that the other provider or covered entity has a treatment relationship that supports the request for information. | Nebraska Medicine/UNMC may disclose PHI to another provider or covered entity for its [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Payment_2 Payment] purposes after confirming that the other provider or covered entity has a treatment relationship that supports the request for information. | ||
#Release/disclosure of patient information should be documented by the department/Workforce member releasing the information. Releases of information outside of HIM should be documented in the medical record, such as by using Epic/One Chart’s Quick Disclosure. | #Release/disclosure of patient information should be documented by the department/Workforce member releasing the information. Releases of information outside of HIM should be documented in the medical record, such as by using Epic/One Chart’s Quick Disclosure. | ||
#The minimum necessary standard does apply to disclosures to another provider or covered entity for its payment purposes. | #The minimum necessary standard does apply to disclosures to another provider or covered entity for its payment purposes. | ||
===Health Care Operations=== | ===Health Care Operations=== | ||
Nebraska Medicine/UNMC may disclose PHI to another covered entity (including members of its medical staff) for certain health care operations of the requesting covered entity if the following steps are followed. Requests of this type are expected to be infrequent. | Nebraska Medicine/UNMC may disclose PHI to another covered entity (including members of its medical staff) for certain health care operations of the requesting covered entity if the following steps are followed. Requests of this type are expected to be infrequent. | ||
Line 85: | Line 85: | ||
##Ask if the Individual would prefer to talk in a more private location. | ##Ask if the Individual would prefer to talk in a more private location. | ||
===Disclosures to the Individual=== | ===Disclosures to the Individual=== | ||
Nebraska Medicine/UNMC may disclose PHI to the Individual or his/her Personal Representative. | Nebraska Medicine/UNMC may disclose PHI to the Individual or his/her Personal Representative. | ||
The Individual has a right to see and obtain copies of PHI maintained in the Individual’s designated record set. Information, including billing information, may be sent to a minor for treatment to which the minor appropriately consented. (See UNMC Policy No. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set]. | The Individual has a right to see and obtain copies of PHI maintained in the Individual’s designated record set. Information, including billing information, may be sent to a minor for treatment to which the minor appropriately consented. (See UNMC Policy No. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set]). | ||
#For Other Disclosures to Individual | #For Other Disclosures to Individual | ||
##For disclosures in written or electronic form, staff should document the disclosure/release in one of the following ways: | ##For disclosures in written or electronic form, staff should document the disclosure/release in one of the following ways: | ||
Line 101: | Line 101: | ||
===Disclosures to Family, Friends and Others=== | ===Disclosures to Family, Friends and Others=== | ||
====Facility Directory==== | ====Facility Directory==== | ||
Nebraska Medicine/UNMC may include limited information about an Individual in the facility directory or census and may disclose that information to people who ask about the Individual by name, or to members of the clergy, in accordance with applicable policies. (See Private Designation policy, for additional details.) | Nebraska Medicine/UNMC may include limited information about an Individual in the facility directory or census and may disclose that information to people who ask about the Individual by name, or to members of the clergy, in accordance with applicable policies. (See Nebraska Medicine Private Designation policy [https://secure.compliance360.com/Default.aspx RI15], for additional details.) | ||
====Disclosures with Individual’s Permission==== | ====Disclosures with Individual’s Permission==== | ||
#You may disclose PHI to the Individual in the presence of others if the Individual is asked and consents or is given a chance to object and does not verbally object to such disclosure and you reasonably infer from the circumstances that the Individual does not object. Disclosures of sensitive information, such as mental health or sexually transmitted disease diagnoses, should only be disclosed with the permission of the Individual. | #You may disclose PHI to the Individual in the presence of others if the Individual is asked and consents or is given a chance to object and does not verbally object to such disclosure and you reasonably infer from the circumstances that the Individual does not object. Disclosures of sensitive information, such as mental health or sexually transmitted disease diagnoses, should only be disclosed with the permission of the Individual. | ||
Line 108: | Line 108: | ||
#Do not rely on this authority if the Individual is incapacitated or otherwise unable to agree or object to such disclosure. | #Do not rely on this authority if the Individual is incapacitated or otherwise unable to agree or object to such disclosure. | ||
====Disclosures Based on Role or Involvement in Patient Care==== | ====Disclosures Based on Role or Involvement in Patient Care==== | ||
Follow this policy when disclosing PHI to a person other than a Personal Representative whom you believe plays a role in the Individuals’s health care (or [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Payment_2 Payment] for health care). For example, follow this policy when you: | |||
#Talk to the Individual’s child, other relative or friend who customarily drives the Iatient to appointments to confirm the date and time of the next appointment. | |||
#Give an involved family member the Individual’s prescription, so the family member can fill it for the Individual. | |||
#Talk to a family member at discharge, if they play a role in post-discharge care. | |||
#Talk to the Individual’s spouse to obtain information necessary to file a claim through the spouse’s group plan. | |||
#Talk to a family member or friend when the Individual indicates you can or should do so, e.g., if the person accompanies the Individual for an appointment or procedure, or is invited and present at admission or discharge. | |||
If the Individual is available prior to a disclosure and has the capacity to make health care decisions, explain the proposed disclosure and do one of the following: | |||
#Obtain the Individual’s consent to such disclosure; | |||
#Provide the Individual with an opportunity to object, and disclose only if the Individual does not object; or | |||
#Reasonably infer from the circumstances, based on the exercise of professional judgment, that the Individual does not object. | |||
If the Individual is not available prior to the disclosure, use and document professional judgment to determine whether the disclosure would be in the best interest of the Individual. If so, disclose only the PHI directly relevant to the recipient’s involvement in the Individual’s health care. A code or password should not be used as a substitute for use of professional judgement to determine an Individual’s involvement in the patient's care to disclose information relevant to the Individual’s involvement. <br /> | |||
''Nebraska Medicine/UNMC may disclose a decedent’s PHI to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the Individual. | |||
'''Note:''' Nebraska Medicine/UNMC may disclose a decedent’s PHI to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the Individual.<br /> | |||
These procedures are not applicable to Personal Representatives because they generally have the same access to information as the Individual. | |||
====Disclosure for Notification Purposes==== | ====Disclosure for Notification Purposes==== | ||
Nebraska Medicine/UNMC may disclose PHI about an Individual in order to notify family, friends or others of the Individual’s whereabouts, general condition or death. In these cases, Nebraska Medicine/UNMC may not know the details of the involvement of others in the patient’s care or payment for care. Therefore, in these cases, try to follow these steps: | Nebraska Medicine/UNMC may disclose PHI about an Individual in order to notify family, friends or others of the Individual’s whereabouts, general condition or death. In these cases, Nebraska Medicine/UNMC may not know the details of the involvement of others in the patient’s care or payment for care. Therefore, in these cases, try to follow these steps: | ||
#Ask the Individual, if possible, whether they consent to such disclosure and rely on what the patient says. | #Ask the Individual, if possible, whether they consent to such disclosure and rely on what the patient says. | ||
#If the Individual is not able or available, make an effort to determine from the record the identity of others who may be Personal Representatives or involved in the Individual’s care | #If the Individual is not able or available, make an effort to determine from the record the identity of others who may be Personal Representatives or involved in the Individual’s care and make an effort to limit contact to them. | ||
#If following the above steps does not work, use your best judgment in making contact with family, friends or others for notification purposes. Try asking for the person by order of priority (See Nebraska Medicine Consents and Permits policy, MS14.) Try to limit disclosures to individuals in the highest priority you can locate. In the end, use your best professional judgment in deciding how much you can say and to whom. | #If following the above steps does not work, use your best judgment in making contact with family, friends or others for notification purposes. Try asking for the person by order of priority (See Nebraska Medicine Consents and Permits policy, MS14.) Try to limit disclosures to individuals in the highest priority you can locate. In the end, use your best professional judgment in deciding how much you can say and to whom. | ||
#When the Individual has been deemed not competent, and is not expected to regain competence, and no family or friend has been located to act on the Individual’s behalf, Care Transitions and/or Pastoral Services staff may reach out to resources, such as the Individual’s landlord or employer (if known), agencies contracted for such purposes with the assistance of Legal Services, or local enforcement. In all such cases, the disclosure of PHI shall be limited solely to the Individual’s name and date of birth unless permission has been obtained from the [mailto:privacy@nebraskamed.com Privacy Office] to disclosure additional information. | #When the Individual has been deemed not competent, and is not expected to regain competence, and no family or friend has been located to act on the Individual’s behalf, Care Transitions and/or Pastoral Services staff may reach out to resources, such as the Individual’s landlord or employer (if known), agencies contracted for such purposes with the assistance of Legal Services, or local enforcement. In all such cases, the disclosure of PHI shall be limited solely to the Individual’s name and date of birth unless permission has been obtained from the [mailto:privacy@nebraskamed.com Privacy Office] to disclosure additional information. | ||
====Uses/Disclosure of PHI for Electronic Health Information Exchanges==== | ====Uses/Disclosure of PHI for Electronic Health Information Exchanges==== | ||
Nebraska Medicine/UNMC may access and disclose PHI through ACE-approved Health Information Exchanges (HIEs). Members of the Workforce may not access their own medical records via the HIE. Use and disclosure of PHI is restricted to the permitted uses and disclosures of the particular HIE. The Enterprise Applications Executive Director | Nebraska Medicine/UNMC may access and disclose PHI through ACE-approved [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Health_Information_Exchange_.28HIE.29 Health Information Exchanges (HIEs)]. Members of the Workforce may not access their own medical records via the HIE. Use and disclosure of PHI is restricted to the permitted uses and disclosures of the particular HIE. The Enterprise Applications Executive Director authorizes individual access to the HIE. The ACE is a member of the following HIEs: | ||
=====CyncHealth (Previously NeHII)===== | =====CyncHealth (Previously NeHII)===== | ||
CyncHealth participants may access CyncHealth PHI pursuant to [https://cynchealth.org/privacy-security/ CyncHealth’s Privacy and Information Security Policies and Procedures]. If unsure as to whether a particular use or disclosure is permissible, contact the [mailto:privacy@nebraskamed.com Privacy Office]. | CyncHealth participants may access CyncHealth PHI pursuant to [https://cynchealth.org/privacy-security/ CyncHealth’s Privacy and Information Security Policies and Procedures]. If unsure as to whether a particular use or disclosure is permissible, contact the [mailto:privacy@nebraskamed.com Privacy Office]. | ||
Line 137: | Line 139: | ||
#All users of the eHealth Exchange are required to cooperate with Nebraska Medicine/UNMC on related investigations or issues; request, use and disclose eHealth Exchange message content only for treatment purposes; comply with all applicable laws and report any suspected breach of PHI to the Privacy Office immediately. Users must not disclose passwords or any other security measures to anyone. | #All users of the eHealth Exchange are required to cooperate with Nebraska Medicine/UNMC on related investigations or issues; request, use and disclose eHealth Exchange message content only for treatment purposes; comply with all applicable laws and report any suspected breach of PHI to the Privacy Office immediately. Users must not disclose passwords or any other security measures to anyone. | ||
===Business Associate Agreements/Addendums=== | ===Business Associate Agreements/Addendums=== | ||
Nebraska Medicine/UNMC shall enter into a Business Associate Agreement with each outside entity performing services on its behalf before disclosing PHI to such entity (see UNMC Policy No. 8009, [[Contracts]] or Contract Management policy, FN18). | Nebraska Medicine/UNMC shall enter into a Business Associate Agreement with each outside entity performing services on its behalf before disclosing PHI to such entity (see UNMC Policy No. 8009, [[Contracts]] or Nebraska Medicine Contract Management policy, FN18). | ||
===Use/Disclosure of PHI for Training Health Care Professionals === | ===Use/Disclosure of PHI for Training Health Care Professionals === | ||
See UNMC Policy No. 6303, [[Use and Disclosure of PHI for Training Health Care Professionals]] | See UNMC Policy No. 6303, [[Use and Disclosure of PHI for Training Health Care Professionals]] | ||
Line 153: | Line 155: | ||
Refer requests for disclosures of PHI for marketing or fundraising purposes to the [mailto:privacy@nebraskamed.com Privacy Office]. | Refer requests for disclosures of PHI for marketing or fundraising purposes to the [mailto:privacy@nebraskamed.com Privacy Office]. | ||
===Use/Disclosure of PHI for Research=== | ===Use/Disclosure of PHI for Research=== | ||
#All research requests using PHI must be submitted to the UNMC Institutional Review Board (IRB) for review and approval. See UNMC [https://guides.unmc.edu/books/hrpp-policies-and-procedures Human Research Protection Program Policies and Procedures]. The IRB-approved consent also contains the HIPAA-compliant authorization when required under HIPAA. The UNMC IRB operates as the ACE’s Privacy Board and approves all waivers of authorization as permitted under HIPAA. To learn more about such waivers, please see UNMC Human Research Protection Program Policies and Procedures. | #All research requests using PHI must be submitted to the UNMC Institutional Review Board (IRB) for review and approval. See UNMC's [https://guides.unmc.edu/books/hrpp-policies-and-procedures Human Research Protection Program (HRPP) Policies and Procedures]]. The IRB-approved consent also contains the HIPAA-compliant authorization when required under HIPAA. The UNMC IRB operates as the ACE’s Privacy Board and approves all waivers of authorization as permitted under HIPAA. To learn more about such waivers, please see UNMC Human Research Protection Program Policies and Procedures. | ||
#For research requests involving use of a decedent's information, Nebraska Medicine/UNMC must obtain from the researcher (before making such disclosure): | #For research requests involving use of a decedent's information, Nebraska Medicine/UNMC must obtain from the researcher (before making such disclosure): | ||
##A representation that the requested use or disclosure of PHI is solely for research on the PHI of decedents; | ##A representation that the requested use or disclosure of PHI is solely for research on the PHI of decedents; | ||
Line 171: | Line 173: | ||
#To an Individual who is requesting access to their own PHI; | #To an Individual who is requesting access to their own PHI; | ||
#As required by law; and | #As required by law; and | ||
#For any other HIPAA permitted purpose where the only remuneration received by Organization is a reasonable, cost-based fee to cover the cost to prepare and transmit the PHI for such purpose or a fee otherwise expressly permitted by other law. The reasonable cost-based fee includes both direct and indirect costs for generating, storing, retrieving and transmitting the PHI, including labor, material and supplies. | #For any other HIPAA permitted purpose where the only remuneration received by Organization is a reasonable, cost-based fee to cover the cost to prepare and transmit the PHI for such purpose or a fee otherwise expressly permitted by other law. The reasonable cost-based fee includes both direct and indirect costs for generating, storing, retrieving and transmitting the PHI, including labor, material and supplies. | ||
De-identified data is not PHI and therefore is not subject to the remuneration prohibition. However, limited data sets are PHI and are subject to this provision (see the section on [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Limited_Data_Set Limited Data Set]). | De-identified data is not PHI and therefore is not subject to the remuneration prohibition. However, limited data sets are PHI and are subject to this provision (see the section on [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Limited_Data_Set Limited Data Set]). | ||
===Minimum Necessary=== | ===Minimum Necessary=== | ||
Subject to the exceptions listed in this or any other Nebraska Medicine/UNMC policy, when using or disclosing PHI or when requesting PHI, members of the Workforce must make reasonable efforts to limit PHI used, disclosed or requested to the minimum information necessary (both type of information and quantity) to accomplish the intended purpose of such use, disclosure or request. | Subject to the exceptions listed in this or any other Nebraska Medicine/UNMC policy, when using or disclosing PHI or when requesting PHI, members of the Workforce must make reasonable efforts to limit PHI used, disclosed or requested to the minimum information necessary (both type of information and quantity) to accomplish the intended purpose of such use, disclosure or request. | ||
#The “minimum necessary” standard does not apply to the following requests, uses and disclosures of PHI: | #The “minimum necessary” standard does not apply to the following requests, uses and disclosures of PHI: | ||
##Uses, disclosures or requests among health care providers for treatment purposes. | ##Uses, disclosures or requests among health care providers for treatment purposes. | ||
Line 183: | Line 185: | ||
#Workforce. The minimum necessary standard applies to access and use of PHI by members of the Workforce. Each member of the Workforce must avoid intentionally accessing, using or disclosing PHI except as authorized by Nebraska Medicine/UNMC’s policies. | #Workforce. The minimum necessary standard applies to access and use of PHI by members of the Workforce. Each member of the Workforce must avoid intentionally accessing, using or disclosing PHI except as authorized by Nebraska Medicine/UNMC’s policies. | ||
##When using, disclosing, or requesting PHI, staff shall make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. Disclosure of the entire medical record is prohibited unless specifically justified and documented in the medical record as the minimum necessary for the request or otherwise required by law. | ##When using, disclosing, or requesting PHI, staff shall make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. Disclosure of the entire medical record is prohibited unless specifically justified and documented in the medical record as the minimum necessary for the request or otherwise required by law. | ||
##Role-based Access: access to PHI shall be based on the role performed as specified in computer security matrices maintained by electronic health record system security and other system administrators that lists staff roles, job codes/titles | ##Role-based Access: access to PHI shall be based on the role performed as specified in computer security matrices maintained by electronic health record system security and other system administrators that lists staff roles, job codes/titles and associated levels of access to PHI. Reference Electronic Health Record Access Control policy. | ||
##Individuals who are performing treatment, payment and health care operations functions on behalf of Nebraska Medicine/UNMC, or who require access as otherwise specified by the individual's position description, may access the entire medical record only as necessary to perform assigned duties. | ##Individuals who are performing treatment, payment and health care operations functions on behalf of Nebraska Medicine/UNMC, or who require access as otherwise specified by the individual's position description, may access the entire medical record only as necessary to perform assigned duties. | ||
#Departments who provide PHI in response to valid requests shall ensure that minimum necessary requirements are met. | #Departments who provide PHI in response to valid requests shall ensure that minimum necessary requirements are met. | ||
##Routine/recurring disclosures: managers of departments who routinely release PHI on a recurring basis (e.g., HIM, Decision Support depts., etc.) shall establish minimum necessary written protocols for standard releases of PHI internally and externally. | ##Routine/recurring disclosures: managers of departments who routinely release PHI on a recurring basis (e.g., HIM, Decision Support depts., etc.) shall establish minimum necessary written protocols for standard releases of PHI internally and externally. | ||
Line 207: | Line 209: | ||
##Biometric identifiers, including finger and voice prints; and | ##Biometric identifiers, including finger and voice prints; and | ||
## Full-face photographic images and any comparable images. | ## Full-face photographic images and any comparable images. | ||
#The recipient of the limited data set must enter into a data use agreement. If a limited data set recipient breaches the data use agreement, Nebraska Medicine/UNMC shall take reasonable steps to cure the breach or end the violation | #The recipient of the limited data set must enter into a data use agreement. If a limited data set recipient breaches the data use agreement, Nebraska Medicine/UNMC shall take reasonable steps to cure the breach or end the violation and if such steps are unsuccessful, shall discontinue disclosure of PHI to the limited data set recipient. | ||
===De-identification/Re-identification of PHI=== | ===De-identification/Re-identification of PHI=== | ||
#PHI may be used to create information that is not individually identifiable health information (i.e., de-identified information). The HIPAA privacy rules do not apply to de-identified information that does not identify an Individual and cannot be used to identify an Individual. PHI is de-identified when one of the following methods is used: | #PHI may be used to create information that is not individually identifiable health information (i.e., de-identified information). The HIPAA privacy rules do not apply to de-identified information that does not identify an Individual and cannot be used to identify an Individual. PHI is de-identified when one of the following methods is used: | ||
##The 18 identifiers of the Individual or of the Individual’s relatives, employers, or household members are removed and Nebraska Medicine/UNMC does not have actual knowledge that the information could be used alone or in combination with other information to identify the Individual who is the subject of the information. The identifiers are: | ##The 18 identifiers of the Individual or of the Individual’s relatives, employers, or household members are removed and Nebraska Medicine/UNMC does not have actual knowledge that the information could be used alone or in combination with other information to identify the Individual who is the subject of the information. The identifiers are: | ||
##Names; | ###Names; | ||
##All geographic subdivisions smaller than a state (including street address, city, county, precinct | ###All geographic subdivisions smaller than a state (including street address, city, county, precinct and zip code); | ||
##All elements of dates except year, for dates related to Individual (e.g., birth date, admission date, discharge date, date of death); | ###All elements of dates except year, for dates related to Individual (e.g., birth date, admission date, discharge date, date of death); | ||
##Telephone numbers; | ###Telephone numbers; | ||
##Fax numbers; | ###Fax numbers; | ||
##Electronic mail addresses; | ###Electronic mail addresses; | ||
##Social Security Numbers; | ###Social Security Numbers; | ||
##Medical record numbers; | ###Medical record numbers; | ||
##Health plan beneficiary numbers; | ###Health plan beneficiary numbers; | ||
##Account numbers; | ###Account numbers; | ||
##Certificate/license numbers; | ###Certificate/license numbers; | ||
##Vehicle identifiers and serial numbers, including license plate numbers; | ###Vehicle identifiers and serial numbers, including license plate numbers; | ||
##Device identifiers and serial numbers; | ###Device identifiers and serial numbers; | ||
##Web Universal Resource Locators (URLs); | ###Web Universal Resource Locators (URLs); | ||
##Internet Protocol (IP) address numbers; | ###Internet Protocol (IP) address numbers; | ||
##Biometric identifiers, including finger and voice prints; | ###Biometric identifiers, including finger and voice prints; | ||
##Full face photographic images and any comparable images; and | ###Full face photographic images and any comparable images; and | ||
##Any other unique identifying number, characteristic, or code. | ###Any other unique identifying number, characteristic, or code. | ||
#A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable, applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an Individual who is a subject of the information; and documents the methods and results of the analysis that justify such determination. The Legal Services | ##A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable, applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an Individual who is a subject of the information; and documents the methods and results of the analysis that justify such determination. The [mailto:contracts@nebraskamed.com NE Med Legal Services Department] and/or [mailto:privacy@nebraskamed.com Privacy Office] must approve of the use of this de-identification method and the person who performs it. | ||
#Re-identification of PHI. A code or other means of record identification may be assigned to allow information de-identified above to be re-identified by Organization, provided that: | #Re-identification of PHI. A code or other means of record identification may be assigned to allow information de-identified above to be re-identified by Organization, provided that: | ||
##The code or other means of record identification is not derived from or related to information about the Individual and is not otherwise capable of being translated so as to identify the Individual; and | ##The code or other means of record identification is not derived from or related to information about the Individual and is not otherwise capable of being translated so as to identify the Individual; and | ||
##The code or other means of record identification is not used for other purposes and the mechanism for re-identification is not disclosed. | ##The code or other means of record identification is not used for other purposes and the mechanism for re-identification is not disclosed. | ||
===Disaster Relief Disclosures=== | ===Disaster Relief Disclosures=== | ||
Nebraska Medicine/UNMC may disclose PHI to public or private relief organizations authorized by law or the HIPAA Privacy Rule to assist in disaster relief efforts. | Nebraska Medicine/UNMC may disclose PHI to public or private relief organizations authorized by law or the HIPAA Privacy Rule to assist in disaster relief efforts.<br /> | ||
''Disaster relief agency means a public or private agency or program which is authorized by law or its charter to assist in disaster relief efforts. Examples of private disaster relief agencies would be the American Red Cross or the Salvation Army. | |||
'''''Disaster relief agency''''' means a public or private agency or program which is authorized by law or its charter to assist in disaster relief efforts. Examples of private disaster relief agencies would be the American Red Cross or the Salvation Army. | |||
#Limit releases of information to the information needed by the agencies to perform their disaster relief efforts. Often, this includes such uses as: | #Limit releases of information to the information needed by the agencies to perform their disaster relief efforts. Often, this includes such uses as: | ||
##Coordinating availability of care, | ##Coordinating availability of care, | ||
Line 243: | Line 246: | ||
#The minimum necessary standard does not apply to disclosures to disaster relief agencies. | #The minimum necessary standard does not apply to disclosures to disaster relief agencies. | ||
===Authorization Generally Required for All Other Uses/Disclosures=== | ===Authorization Generally Required for All Other Uses/Disclosures=== | ||
Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Nebraska Medicine Consents and Permits policy, MS14) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900) | Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Nebraska Medicine Consents and Permits policy, MS14) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900). Forms can be requested at [mailto:privacy@nebraskamed.com Privacy@NebraskaMed.com]]. Restrictions on the use and disclosure of psychotherapy notes are explained in UNMC Policy Nos. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set] and 6066, [[Psychotherapy Notes]]. | ||
===Compound Authorizations=== | ===Compound Authorizations=== | ||
An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases: | An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases: | ||
#An authorization for the use or disclosure of PHI for a research study may be combined with any other type of written permission for the same or another research study. This exception includes combining an authorization for the use or disclosure of PHI for a research study with another authorization for the same research study, with an authorization for the creation or maintenance of a research database or repository, or with a consent to participate in research. When the ACE has conditioned the provision of research-related treatment on the provision of one of the authorizations, any compound authorization must clearly differentiate between the conditioned and unconditioned components and provide the Individual with an opportunity to opt in to the research activities described in the unconditioned authorization. | #An authorization for the use or disclosure of PHI for a research study may be combined with any other type of written permission for the same or another research study. This exception includes combining an authorization for the use or disclosure of PHI for a research study with another authorization for the same research study, with an authorization for the creation or maintenance of a research database or repository, or with a consent to participate in research. When the ACE has conditioned the provision of research-related treatment on the provision of one of the authorizations, any compound authorization must clearly differentiate between the conditioned and unconditioned components and provide the Individual with an opportunity to opt in to the research activities described in the unconditioned authorization. | ||
#An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for use or disclosure of psychotherapy notes. | #An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for use or disclosure of psychotherapy notes. | ||
== Definitions == | == Definitions == | ||
===Affiliated Covered Entity (ACE)=== | ===Affiliated Covered Entity (ACE)=== | ||
Legally separate covered entities that designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. | Legally separate covered entities that designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. | ||
===Designated Record Set (DRS)=== | ===Designated Record Set (DRS)=== | ||
Includes medical records and billing records about Individuals maintained by or for UNMC/ACE and any other record used by | Includes medical records and billing records about Individuals maintained by or for UNMC/ACE and any other record used by the ACE to make decisions about Individuals. | ||
===Health Care Operations | ===Health Care Operations=== | ||
The following activities related to the Organization's functions as a health care provider and sponsor of a self-insured health plan: | The following activities related to the Organization's functions as a health care provider and sponsor of a self-insured health plan: | ||
#Quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities, otherwise these activities may be classified as research if PHI is included; | #Quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities, otherwise these activities may be classified as research if PHI is included; | ||
Line 264: | Line 267: | ||
#Reviewing the competence or qualifications and accrediting/licensing of health care providers; | #Reviewing the competence or qualifications and accrediting/licensing of health care providers; | ||
#Training health care professionals; | #Training health care professionals; | ||
#Conducting or arranging for medical review, legal services | #Conducting or arranging for medical review, legal services and auditing functions (including fraud and abuse detection and compliance programs); | ||
#Business planning and development; | #Business planning and development; | ||
#Business management activities | #Business management activities | ||
Line 271: | Line 274: | ||
#Evaluating healthcare provider and plan performance; | #Evaluating healthcare provider and plan performance; | ||
#Resolution of internal grievances; and | #Resolution of internal grievances; and | ||
#Fundraising (see | #Fundraising (see [https://wiki.unmc.edu/index.php?title=Use_and_Disclosure_of_Protected_Health_Information&action=edit#Use.2FDisclosure_of_PHI_for_Marketing Use/Disclosure of PHI for Marketing]). | ||
===Health Information Exchange (HIE)=== | ===Health Information Exchange (HIE)=== | ||
The electronic movement of health-related information among organizations according to nationally recognized standards. The goal of a HIE is to facilitate health care providers’ access to and retrieval of clinical data to provide safer, timelier, efficient, effective and equitable patient-centered care. Health Information exchange organizations (HIOs) provide the capability to electronically move information between disparate health care information systems. | The electronic movement of health-related information among organizations according to nationally recognized standards. The goal of a HIE is to facilitate health care providers’ access to and retrieval of clinical data to provide safer, timelier, efficient, effective and equitable patient-centered care. Health Information exchange organizations (HIOs) provide the capability to electronically move information between disparate health care information systems. | ||
===Individual=== | ===Individual=== | ||
The person who is the subject of the PHI. Personal representatives of the Individual have the same rights as the Individual under HIPAA (i.e., they “step into the shoes” of the Individual). Personal representatives include the legal guardian and anyone else authorized by law to act on behalf of the Individual. (See Nebraska Medicine Consents and Permits policy, MS14.) | The person who is the subject of the PHI. Personal representatives of the Individual have the same rights as the Individual under HIPAA (i.e., they “step into the shoes” of the Individual). Personal representatives include the legal guardian and anyone else authorized by law to act on behalf of the Individual. (See Nebraska Medicine Consents and Permits policy, MS14.) | ||
Line 283: | Line 286: | ||
Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that: | Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that: | ||
*is created or received by UNMC/ACE; and | *is created or received by UNMC/ACE; and | ||
*relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual and identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual. | *relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual and identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual. | ||
PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age): | PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age): | ||
*an Individual’s genetic tests; | *an Individual’s genetic tests; | ||
*the genetic tests of an Individual’s family members; or | *the genetic tests of an Individual’s family members; or | ||
*the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history) | *the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history). | ||
PHI excludes: | PHI excludes: | ||
*individually identifiable health information of a person who has been deceased for more than fifty (50) years. | *individually identifiable health information of a person who has been deceased for more than fifty (50) years. | ||
*education records covered by the Family Educational Rights and Privacy Act (FERPA); and | *education records covered by the Family Educational Rights and Privacy Act (FERPA); and | ||
*employment records held by UNMC in its role as employer. | *employment records held by UNMC in its role as employer. | ||
===Psychotherapy Notes=== | |||
Notes recorded (in any medium) by a mental health provider including psychiatrists, psychologists and other mental health professionals documenting or analyzing the contents of a conversation during a private counseling session or group, joint or family counseling session. Psychotherapy notes are kept separate from the rest of the individual’s medical record. Psychotherapy notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date. Psychotherapy notes are not progress notes and are created at the discretion of the mental health care provider. (HIPAA: 45 CFR §164.501) | |||
===Research === | ===Research === | ||
A systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalized knowledge. Generalized knowledge is knowledge that can be applied to populations outside the population served by the ACE. | A systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalized knowledge. Generalized knowledge is knowledge that can be applied to populations outside the population served by the ACE. | ||
===Sale of Protected Health Information === | ===Sale of Protected Health Information === | ||
Disclosure of Protected Health Information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the PHI in exchange for the PHI. | Disclosure of Protected Health Information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the PHI in exchange for the PHI. | ||
===Treatment=== | ===Treatment=== | ||
The provision, coordination or management of health care and related services by one or more health care providers including the coordination or management of health care by a health care provider with a third party, consultation between health care providers relating to a patient, or the referral of a patient for health care from one health care provider to another. | The provision, coordination or management of health care and related services by one or more health care providers including the coordination or management of health care by a health care provider with a third party, consultation between health care providers relating to a patient, or the referral of a patient for health care from one health care provider to another. | ||
===Workforce=== | ===Workforce=== | ||
Employees, medical staff, volunteers, trainees | Employees, medical staff, volunteers, trainees and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC. | ||
==Additional Information== | ==Additional Information== | ||
*Contact the [mailto:debrbishop@nebraskamed.com Privacy Officer] or the [mailto:privacy@nebraskamed.com Privacy Office] | *Contact the [mailto:debrbishop@nebraskamed.com Privacy Officer] or the [mailto:privacy@nebraskamed.com Privacy Office] | ||
*NE Med Legal Services department [mailto:contracts@nebraskamed.com Contracts@NebraskaMed.com] | |||
*Enterprise Applications Executive Director | |||
*UNMC Policy No. 6058, [[Notice of Privacy Practices]] | *UNMC Policy No. 6058, [[Notice of Privacy Practices]] | ||
* | *UNMC Policy No. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set] | ||
*UNMC Policy No. 6061, [https://wiki.unmc.edu/index.php/Accounting_of_PHI_Disclosures Accounting of Protected Health Information Disclosures] | |||
*UNMC Policy No. 6066, [[Psychotherapy Notes]] If being kept, this should be reviewed and review date noted on policy 6066, even if not changed.''' | |||
*UNMC Policy No. 6303, [[Use and Disclosure of PHI for Training Health Care Professionals]] | |||
*UNMC Policy No. 6304, [[Disclosures of PHI as Permitted or Required by Law]] | |||
*UNMC Policy No. 6305, [[Disclosure of PHI for Law Enforcement Purposes]] | |||
*UNMC Policy No. 8009, [[Contracts]] | |||
*UNMC [https://guides.unmc.edu/books/hrpp-policies-and-procedures Human Research Protection Program (HRPP) Policies and Procedures] | |||
*[https://unmcredcap.unmc.edu/redcap/surveys/?s=94TLJCCAAT Request for Electronic Health Data] Form | *[https://unmcredcap.unmc.edu/redcap/surveys/?s=94TLJCCAAT Request for Electronic Health Data] Form | ||
*Nebraska Medicine Consents and Permits policy, MS14. | *[https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices] | ||
*Nebraska Medicine Verification and Authority policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d IM55] | |||
*[http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html Uses and Disclosures for Treatment, Payment | *Nebraska Medicine Consents and Permits policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d MS14] | ||
*Nebraska Medicine Confidential Address policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d REG365] | |||
*Nebraska Medicine Private Designation policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d R115] for additional details.) | |||
*Nebraska Medicine Contract Management policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d FN18] | |||
*Nebraska Medicine Form CON-MR-0074, [https://www.nebraskamed.com/patients/medical-records/your-medical-records Authorization for Release of Informatio'''n'''] | |||
*Nebraska Medicine Form CON-MR-1900, [mailto:privacy@nebraskamed.com Education Authorization] | |||
*[https://cynchealth.org/privacy-security/ CyncHealth’s Privacy and Information Security Policies and Procedures] | |||
*[http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html Uses and Disclosures for Treatment, Payment and Health Care Operations] | |||
*[https://nebraska.edu/-/media/unca/docs/offices-and-policies/policies/executive-memorandum/hipaa-compliance-policy.pdf University of Nebraska Executive Memorandum No. 27] | *[https://nebraska.edu/-/media/unca/docs/offices-and-policies/policies/executive-memorandum/hipaa-compliance-policy.pdf University of Nebraska Executive Memorandum No. 27] | ||
*[http://nehii.org/index.php?option=com_docman&Itemid=59 NeHII Privacy and Information Security Policies and Procedures] | *[http://nehii.org/index.php?option=com_docman&Itemid=59 NeHII Privacy and Information Security Policies and Procedures] | ||
*[https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] | *[https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] | ||
Line 316: | Line 335: | ||
*[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] | *[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] | ||
This page is maintained by [mailto: | This page is maintained by [mailto:mhurlocker@unmc.edu mh]. |