Use and Disclosure of Protected Health Information: Difference between revisions

Protected Health Information (PHI) may be used and disclosed within the [ Affiliated Covered Entity (ACE)] for each member’s own treatment, payment and [ Health Care Operations] if it has or is about to have a treatment relationship with the patient supporting its need for such use or disclosure of such information, without having to obtain the patient’s authorization. ACE entities also may share PHI with one another without patient authorization as permitted by HIPAA and necessary for the delivery of health care treatment, payment and operations. <br />

##Quality assessment activities, utilization management activities, and activities designed to measure or improve care or reduce costs.

IV. Incidental Disclosures

 

1. The unintended disclosure of PHI must be a consequence of a permitted use or disclosure.

2. The permitted disclosure of PHI must have met the minimum necessary standard, as applicable.

3. Workforce members must have employed reasonable safeguards to prevent the unintended disclosure of PHI:

a. Use common sense and judgment – look for ways to lessen the risk and any potential impact of an incidental disclosure (e.g., signage visible outside patient rooms should not contain PHI, except information necessary for safe clinical care, such as infection control and fall precaution notices; patients in public areas or being transported should be draped in a manner that respects the patient’s modesty or dignity).

b. Speak in a lower voice;

c. Provide more privacy through partitions and room arrangements (e.g., protect the visual privacy of patients receiving treatment through the use of curtains or other visual barriers whenever possible);

d. Pull the dividers or partitions between the patient and other patients or visitors; and

e. Ask if the patient would prefer to talk in a more private location.

V.  Disclosures to the Patient

Nebraska Medicine/UNMC may disclose Protected Health Information to the patient or his/her Personal Representative.   

The patient has a right to see and obtain copies of Protected Health Information maintained in the patient’s designated record set.   Information, including billing information, may be sent to a minor for treatment to which the minor appropriately consented. Please refer to Access & Amendment of Designated Record Set policy.

1. For other disclosures to the patient –

a. For disclosures in written or electronic form, staff should document the disclosure/release in one of the following ways:

i.     Notation in the medical, billing or other record from which the material was obtained

ii. Electronic notation such as Quick Disclosure (Epic) in the database from which the information was obtained

b. It is not necessary to document oral disclosures to Individuals, unless required by nursing, medical staff or other policies. This policy recognizes that there is constant exchange of information between health care providers and Individuals during episodes of care.

c. When disclosing to the patient, appropriate safeguards should be taken to reduce the risk that people other than the patient or people permitted by the patient will hear the disclosure. Examples of such safeguards would include:

i. Asking the patient if the patient would prefer to talk in a more private location.

ii. Confirming with the patient that it is okay to proceed with the conversation while friends, relatives or others are present.

iii. Speaking in a lower voice.

iv. Pulling the dividers or partitions between the patient and other patients or visitors.

v. Providing more privacy through partitions and room arrangements.

2. The minimum necessary standard does not apply to disclosures to the patient.

VI. Disclosures to Family, Friends and Others

1. Facility Directory.  Nebraska Medicine/UNMC may include limited information about an Individual in the facility directory or census and may disclose that information to people who ask about the patient by name, or to members of the clergy, in accordance with applicable policies. Reference Private Designation policy, for additional details.

2.  Disclosures with the Patient’s Permission

a. You may disclose Protected Health Information to the patient in the presence of others if the patient is asked and consents or is given a chance to object and does not verbally object to such disclosure and you reasonably infer from the circumstances that the patient does not object. Disclosures of sensitive information, such as mental health or sexually transmitted disease diagnoses, should only be disclosed with the permission of the patient.

b. When relying on this authority, disclose only the minimum amount of information needed to achieve the purpose of the disclosure, unless you know that the individuals present are all involved in the patient's care or payment for care.

c. Remember – people who are present when a disclosure of PHI is made may be mere friends, visitors or onlookers.  They may have no role in the patient’s care.  They may simply be visiting the patient.  Therefore, try to give the patient every opportunity to agree or object to a disclosure of his or her PHI when it will otherwise be made in their presence.

d. Do not rely on this authority if the patient is incapacitated or otherwise unable to agree or object to such disclosure.

 

3. Disclosures Based on Role or Involvement in Patient Care

 

a. Follow this policy when disclosing Protected Health Information to a person, other than a Personal Representative, whom you believe plays a role in the patient’s health care (or payment for health care).  For example, follow this policy when you: