Use and Disclosure of Protected Health Information: Difference between revisions

===Uses/Disclosure of PHI for Electronic Health Information Exchanges===  

====CyncHealth (Previously NeHII)====

====Epic-integrated HIE Software====

====eHealth Exchange====

IX. Use/Disclosure of PHI Permitted/Required by Law

Please reference Disclosures of PHI As Permitted or Required by Law policy.

X. Use/Disclosure of PHI for Law Enforcement Purposes.  

Please reference Disclosures of PHI for Law Enforcement Purposes policy.

XI.    Use/Disclosure of PHI for Whistleblowing Purposes.

1. The Workforce member believes in good faith that Nebraska Medicine/UNMC engaged in conduct that is unlawful or otherwise violates professional or clinical standards, or that the care, services, or conditions provided by Nebraska Medicine/UNMC potentially endangers one or more patients, other Workforce members, or the public; and  

2. The disclosure is to:  

a. A health oversight agency or public health authority authorized by law to investigate or otherwise oversee the relevant conduct or conditions of Nebraska Medicine/UNMC or to an appropriate health care accreditation organization for the purpose of reporting the allegation of failure to meet professional standards or misconduct by Nebraska Medicine/UNMC; or  

b. An attorney retained by or on behalf of the Workforce member or business associate for the purpose of determining the legal options of the Workforce member or business associate with regard to the conduct described in this section.  

XII.  Use/Disclosure of PHI for Marketing  

Refer requests for disclosures of PHI for marketing or fundraising purposes to the Office of Privacy.

XIII. Use/Disclosure of PHI for Research

1. All research requests using PHI must be submitted to the UNMC Institutional Review Board (IRB) for review and approval. See UNMC Human Research Protection Policies and Procedures. The IRB approved consent also contains the HIPAA-compliant authorization when required under HIPAA.   The UNMC IRB operates as the ACE’s Privacy Board and approves all waivers of authorization as permitted under HIPAA. To learn more about such waivers, please reference UNMC HRPP policy.   

2. For research requests involving use of a decedent's information, Nebraska Medicine/UNMC must obtain from the researcher (before making such disclosure):  

a. A representation that the requested use or disclosure of PHI is solely for research on the PHI of decedents;

b. Documentation of the death of such Individuals; and  

c. A representation that the requested PHI is necessary for the research purposes.

3. Review of PHI Preparatory to Research. Nebraska Medicine/UNMC staff and students who wish to review PHI to prepare a research proposal must submit a "Request for Electronic Health Data" form to the Electronic Health Record Data Access Core to obtain access to such PHI.  This request form is located at: https://www.unmc.edu/cctr/resources/ehr/index.html.

 

4. Access to PHI for reviews preparatory to research requires that the researcher provide the following representations in advance of such disclosure and use:

a. that the use or disclosure is sought solely to review Protected Health Information as necessary to prepare a research protocol or for similar purposes preparatory to research;  

b. that no Protected Health Information is to be removed from the covered entity by the researcher in the course of the review; and  

c. that the Protected Health Information for which disclosure and use is sought is necessary for the research purposes.

XIV. Sale of Protected Health Information.

Selling Protected Health Information is generally prohibited unless the patient signs an authorization specifically permitting the sale. This includes any disclosure of PHI where Nebraska Medicine/UNMC directly or indirectly receives remuneration from or on behalf of the recipient of the PHI in exchange for the Protected Health Information. Sale of Protected Health Information does not include certain disclosures of PHI:

a. For public health purposes;

b. For research purposes where the only remuneration received by Organization is a reasonable cost-based fee to cover the cost to prepare and transmit the PHI for such purposes;

c. For treatment and payment purposes;

d. To a business associate for activities that the business associate undertakes on Nebraska Medicine/UNMC’s behalf (if such business associate executes a business associate agreement with Nebraska Medicine/UNMC);  

e. To an Individual who is requesting access to his or her own PHI;

f. As required by law; and

g. For any other HIPAA permitted purpose where the only remuneration received by Organization is a reasonable, cost-based fee to cover the cost to prepare and transmit the PHI for such purpose or a fee otherwise expressly permitted by other law. The reasonable cost-based fee includes both direct and indirect costs for generating, storing, retrieving and transmitting the PHI, including labor, material and supplies.   

 

De-identified data is not PHI and therefore is not subject to the remuneration prohibition.  However, limited data sets are PHI and are subject to this provision (see the Limited Data Set section below).   

 

XV. Minimum Necessary.

XVI. Limited Data Set.

1. A limited data set of PHI that excludes certain direct identifiers of the Individual or of relatives, employers, or household members of the Individual may be used and disclosed for the purposes of research, public health, or health care operations:  

 

XVII.    De-identification/Re-identification of PHI  

 

XVIII. Disaster Relief Disclosures

2. The same requirements that apply to disclosures to family, friends and others, apply to disclosures to disaster relief organizations, unless Nebraska Medicine/UNMC, in the exercise of professional judgment, determines that those requirements interfere with the ability to respond to the emergency circumstances. Professional judgment under this policy may be exercised and documented by the Privacy Officer or individuals designated in Nebraska Medicine/UNMC’s Disaster Plan.

 

3. The minimum necessary standard does not apply to disclosures to disaster relief agencies.

 

XIX. Authorization Generally Required for all other Uses/Disclosures.

Unless otherwise permitted by this policy, any use or disclosure of PHI is prohibited unless the patient or the patient’s representative (see Consents and Permits policy,) signs an authorization specifically permitting the use/disclosure (e.g., Form CON-MR-0074, CON-MR-1900). Restrictions on the use and disclosure of psychotherapy notes are explained in the Psychotherapy Notes policy.

 

XX. Compound authorizations.

 

1. An authorization for the use or disclosure of PHI for a research study may be combined with any other type of written permission for the same or another research study. This exception includes combining an authorization for the use or disclosure of PHI for a research study with another authorization for the same research study, with an authorization for the creation or maintenance of a research database or repository, or with a consent to participate in research. When the ACE has conditioned the provision of research-related treatment on the provision of one of the authorizations, any compound authorization must clearly differentiate between the conditioned and unconditioned components and provide the Individual with an opportunity to opt in to the research activities described in the unconditioned authorization.  

2. An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes.