Use and Disclosure of Protected Health Information: Difference between revisions
Mhurlocker (talk | contribs) |
Mhurlocker (talk | contribs) |
||
| (7 intermediate revisions by 2 users not shown) | |||
| Line 30: | Line 30: | ||
Policy No.: '''6057'''<br /> | Policy No.: '''6057'''<br /> | ||
Effective Date: '''03/17/03'''<br /> | Effective Date: '''03/17/03'''<br /> | ||
Revised Date: ''' | Revised Date: '''03/28/24'''<br /> | ||
Reviewed Date: ''' '''<br /> | Reviewed Date: ''' 04/22/24'''<br /> | ||
<big>'''Use and Disclosure of Protected Health Information Policy'''</big> | <big>'''Use and Disclosure of Protected Health Information Policy'''</big> | ||
== Basis for Policy == | == Basis for Policy == | ||
Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/ | Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html HIPAA Security Rule] outline considerations for the access control family of security controls. | ||
== Policy == | == Policy == | ||
Nebraska Medicine/UNMC shall limit the use and disclosure of Protected Health Information (PHI) to the right people, for the right purposes, with the right authority, and always subject to reasonable safeguards -- all as defined by the [https://www.cdc.gov/phlp/ | Nebraska Medicine/UNMC shall limit the use and disclosure of Protected Health Information (PHI) to the right people, for the right purposes, with the right authority, and always subject to reasonable safeguards -- all as defined by the [https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and Nebraska Medicine/UNMC policies. | ||
==Purpose== | ==Purpose== | ||
To establish guidelines for the use and disclosure of PHI. | To establish guidelines for the use and disclosure of PHI. | ||
| Line 160: | Line 162: | ||
##Documentation of the death of such Individuals; and | ##Documentation of the death of such Individuals; and | ||
##A representation that the requested PHI is necessary for the research purposes. | ##A representation that the requested PHI is necessary for the research purposes. | ||
#Review of PHI Preparatory to Research. Nebraska Medicine/UNMC staff and students who wish to review PHI to prepare a research proposal must submit a [https://unmcredcap.unmc.edu/redcap/surveys/?s=NMPNWMEA7W Electronic Health Data Request] Form to the [https://www.unmc.edu/ | #Review of PHI Preparatory to Research. Nebraska Medicine/UNMC staff and students who wish to review PHI to prepare a research proposal must submit a [https://unmcredcap.unmc.edu/redcap/surveys/?s=NMPNWMEA7W Electronic Health Data Request] Form to the [https://www.unmc.edu/research-resources/resources/cores/readi-core/index.html Electronic Health Record Data Access Core] to obtain access to such PHI. | ||
#Access to PHI for reviews preparatory to research requires that the researcher provide the following representations in advance of such disclosure and use: | #Access to PHI for reviews preparatory to research requires that the researcher provide the following representations in advance of such disclosure and use: | ||
##that the use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research; | ##that the use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research; | ||
| Line 246: | Line 248: | ||
#The minimum necessary standard does not apply to disclosures to disaster relief agencies. | #The minimum necessary standard does not apply to disclosures to disaster relief agencies. | ||
===Authorization Generally Required for All Other Uses/Disclosures=== | ===Authorization Generally Required for All Other Uses/Disclosures=== | ||
Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Nebraska Medicine Consents and Permits policy, MS14) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900). Forms can be requested at [ | Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Nebraska Medicine Consents and Permits policy, MS14) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900). Forms can be requested at [mailto:privacy@nebraskamed.com Privacy@NebraskaMed.com]]. Restrictions on the use and disclosure of psychotherapy notes are explained in UNMC Policy Nos. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set] and 6066, [[Psychotherapy Notes]]. | ||
===Compound Authorizations=== | ===Compound Authorizations=== | ||
An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases: | An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases: | ||
| Line 306: | Line 308: | ||
Employees, medical staff, volunteers, trainees and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC. | Employees, medical staff, volunteers, trainees and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC. | ||
==Additional Information== | ==Additional Information== | ||
*Contact the [mailto:debrbishop@nebraskamed.com Privacy Officer] or the [mailto:privacy@nebraskamed.com Privacy Office] | *Contact the [mailto:debrbishop@nebraskamed.com Privacy Officer] or the [mailto:privacy@nebraskamed.com Privacy Office] | ||
*Legal Services department | *NE Med Legal Services department [mailto:contracts@nebraskamed.com Contracts@NebraskaMed.com] | ||
*Enterprise Applications Executive Director | *Enterprise Applications Executive Director | ||
*UNMC Policy No. 6058, [[Notice of Privacy Practices]] | *UNMC Policy No. 6058, [[Notice of Privacy Practices]] | ||
*UNMC Policy No. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set] | *UNMC Policy No. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set] | ||
| Line 320: | Line 322: | ||
*[https://unmcredcap.unmc.edu/redcap/surveys/?s=94TLJCCAAT Request for Electronic Health Data] Form | *[https://unmcredcap.unmc.edu/redcap/surveys/?s=94TLJCCAAT Request for Electronic Health Data] Form | ||
*[https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices] | *[https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices] | ||
*Nebraska Medicine Verification and Authority policy, | *Nebraska Medicine Verification and Authority policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d IM55] | ||
*Nebraska Medicine Consents and Permits policy, MS14 | *Nebraska Medicine Consents and Permits policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d MS14] | ||
*Nebraska Medicine Confidential Address policy, | *Nebraska Medicine Confidential Address policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d REG365] | ||
*Nebraska Medicine Private Designation policy, for additional details.) | *Nebraska Medicine Private Designation policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d R115] for additional details.) | ||
*Nebraska Medicine Contract Management policy, FN18 | *Nebraska Medicine Contract Management policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d FN18] | ||
*Nebraska Medicine Form CON-MR-0074, ''' | *Nebraska Medicine Form CON-MR-0074, [https://www.nebraskamed.com/patients/medical-records/your-medical-records Authorization for Release of Informatio'''n'''] | ||
*Nebraska Medicine Form CON-MR-1900, | *Nebraska Medicine Form CON-MR-1900, [mailto:privacy@nebraskamed.com Education Authorization] | ||
*[https://cynchealth.org/privacy-security/ CyncHealth’s Privacy and Information Security Policies and Procedures] | *[https://cynchealth.org/privacy-security/ CyncHealth’s Privacy and Information Security Policies and Procedures] | ||
*[http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html Uses and Disclosures for Treatment, Payment and Health Care Operations] | *[http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html Uses and Disclosures for Treatment, Payment and Health Care Operations] | ||
*[https://nebraska.edu/-/media/unca/docs/offices-and-policies/policies/executive-memorandum/hipaa-compliance-policy.pdf University of Nebraska Executive Memorandum No. 27] | *[https://nebraska.edu/-/media/unca/docs/offices-and-policies/policies/executive-memorandum/hipaa-compliance-policy.pdf University of Nebraska Executive Memorandum No. 27] | ||
*[http://nehii.org/index.php?option=com_docman&Itemid=59 NeHII Privacy and Information Security Policies and Procedures] | *[http://nehii.org/index.php?option=com_docman&Itemid=59 NeHII Privacy and Information Security Policies and Procedures] | ||
*[https://www.cdc.gov/phlp/ | *[https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] | ||
*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] | *[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] | ||
*[https://www.cdc.gov/phlp/ | *[https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html HIPAA Security Rule] | ||
This page is maintained by [mailto: | This page is maintained by [mailto:mhurlocker@unmc.edu mh]. | ||