Use and Disclosure of Protected Health Information: Difference between revisions

[[Identification Card]] | [[Secure Area Card Access]] | [[Privacy/Confidentiality]] | [[Computer Use/Electronic Information]] | [[Confidential Information]] | [[Protected Health Information (PHI)]] | [[Notice of Privacy Practices]] | [[Access to Designated Record Set]] | [[Accounting of PHI Disclosures]] | [[Patient/Consumer Complaints]] | [[Vendors]] | [[Fax Transmissions]] | [[Psychotherapy Notes]] | [[Facility Security]] | [[Conditions of Treatment Form]] | [[Informed Consent for UNMC Media]] | [[Transporting Protected Health Information]]

<br /><br />

<big>'''Use and Disclosure of Protected Health Information Policy'''</big>  

== Basis for Policy ==  

== Policy ==  

== Definitions ==

'''Healthcare operations''' means the following activities related to UNMC’s function as an affiliated healthcare provider:

:#Quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; otherwise these activities may be classified as research if PHI is included

:#Population-based activities relating to improving health or reducing health care costs

:#Resolution of internal grievances

:#Fundraising

'''Protected Health Information (PHI)''' is individually identifiable health information.  Individually identifiable health information is a subset of health information including demographic information, collected from an individual, whether oral or recorded in any medium that:

:#Is created or received by ACE; and

:#Relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual.

Protected Health Information includes genetic information containing individual identifiers which is defined as:

:#Information about an individual's genetic tests; or

:#The genetic tests of family members of the individual; or

:#The manifestation of a disease or disorder in family members of such individual (i.e., family medical history)  

'''Sale of Protected Health Information''' means disclosure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information. See Sale of Protected Health Information below.

== Procedures ==

===Use/Disclosure of PHI Related to Healthcare===

Protected Health Information (PHI) may be used and disclosed by the ACE for its own treatment, payment and healthcare operations (as defined above).  These entities may share PHI with one another without patient authorization to conduct business on behalf of the organizations.

:#Care providers may share medical information with the individual and other people that individual would like to be involved in his/her care (i.e. family members, other relatives, friends, etc.).  If possible, care providers should obtain the individual’s permission to share information with others during the course of treatment.  However, care providers may use their professional judgment and reasonably infer from the circumstances that an individual does not object to sharing information with others who may visit or call on the telephone.  Only information relevant to such person’s involvement with the individual’s care should be shared.

:#The ACE may disclose a decedent’s PHI to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual.

Individuals will be given the opportunity to agree or object to follow uses/disclosures of their PHI:

:#Disclosure of religious affiliation to clergy members.

:#Disclosure of PHI to family member, other relative, or close personal friend of the individual, or any other person identified by the individual, the PHI directly relevant to such person's involvement with the individual's care or payment, if the individual is available and has the capacity to agree or reject.

===Request for restrictions===   

Individuals may request restrictions on how their health information is used or disclosed for treatment, payment or healthcare operation purposes, or to certain family member or others involved in their care.  Requests for restrictions can be denied, with one exception.  Requests to restrict self-pay account information from being sent to third party payers must be approved if the account is paid in full out of pocket in advance.

:#All requests for restrictions must be in writing and shall be forwarded to the Health Information Management Department Manager of Health Information Logistics.  The Privacy Officer shall be notified and shall coordinate the request for restrictions to the Chief Medical Officer for approval/disapproval.  If a request for restriction is approved, processes must be implemented to restrict the use or disclosure of the information within the scope of the approved restriction.  Information subject to an approved restriction can be used for emergency treatment if needed, but the healthcare provider cannot further use or disclose the information.

:#Requests to have medical information removed from a medical information system/medical record will not generally be approved, since records of treatment provided must be kept and made available for several regulatory and business purposes.

===Use/Disclosure of PHI Related for Training Healthcare Professionals===

Training healthcare professionals is a category of healthcare operations.  Staff may share PHI with students, residents, trainees and faculty supervising such individuals pursuant to a clinical affiliation agreement between UNMC and the affiliation institution.  Individuals receiving training and faculty supervising such individuals at UNMC shall be considered members of UNMC’s workforce for purposes of HIPAA.

===Use/Disclosure of PHI Permitted/Required by Law===

Disclosure of PHI beyond treatment, payment and healthcare operations (TPO) may be made without individual authorization for the following purposes:

:#Disclosures to prevent serious threat to health or safety consistent with applicable law.

:#Disclosures about military personnel to military command authority in limited circumstances.

===Use/Disclosure of PHI for Law Enforcement Purposes===

PHI may be disclosed to law enforcement under the following circumstances:

:#Crime (or suspected crime) occurred on UNMC campus.

:#UNMC staff providing emergency care in an emergency situation off-campus during work time, and information is necessary to alert law enforcement to a potential crime (i.e. accident scene involving hit-and-run, etc.)

===Use/Disclosure of PHI for Marketing===

The term “marketing” under HIPAA has a specific meaning for purposes of determining when PHI can be used or disclosed without individual authorization.  Marketing under HIPAA is making a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.  Marketing includes an arrangement between UNMC and any other entity whereby UNMC discloses PHI to the other entity in exchange for direct or indirect financial remuneration, for the other entity or its affiliate to make a communication about its own product or service that encourages recipients of the communication to purchase or use that product or service.  If UNMC does not receive any remuneration from an external entity, the activity is not considered to be marketing under HIPAA.

:#Communications for case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, healthcare providers, or settings of care to the individual.   

:#Providing refill reminders or otherwise communicating about a drug or biological that is currently being prescribed for the individual, only if any financial remuneration received by UNMC in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication (such as the cost of mailing); and

Use and disclosures of PHI for marketing as defined by HIPAA require signed patient authorization.  The authorization must state that UNMC will receive remuneration for the marketing activity.

===Use/Disclosure of PHI for Fundraising===

Only the following patient information may be used or disclosed to business associates and institutionally-related foundations for fundraising.  

:#Outcome information; and  

:#Health insurance status

All fundraising materials must clearly and conspicuously explain how the individual may opt out of receiving any further fundraising communications for an individual campaign or for all future fundraising.  The cost of opting out must be nominal, so postage-paid envelopes should be provided, or a toll-free telephone number and/or email address provided so individuals can opt-out without incurring costs.  If an individual opts-out of fundraising, the action is treated as a revocation of authorization and UNMC may not make further fundraising communications to the individual within the scope of revocation. UNMC may not condition treatment or payment on the individual’s choice about receiving future fundraising communications.

===Use/Disclosure of PHI for Research===

===Sale of Protected Health Information===

Selling protected health information is prohibited unless the patient signs an authorization specifically permitting the sale.  This includes any disclosure of PHI where UNMC directly or indirectly receives remuneration from or on behalf of the recipient of the PHI in exchange for the protected health information.  Sale of protected health information does not include a disclosure of PHI:

:#To an individual where the individual is requesting access to their own PHI

:#Required by law; and

De-identified data is not PHI and therefore is not subject to the remuneration prohibition.  However, limited data sets are PHI and are subject to this provision.

===Authorization Required for all other Uses/Disclosures===

===Minimum Necessary===

:#Role-based Access; access to PHI shall be based on role performed as specified in the following:

:##Computer security matrices maintained by electronic health record system security and other system administrators listing staff roles, job codes/titles and associated levels of access to PHI

:##Disclosure made to the Secretary of HHS for enforcement purposes

:##Electronic data elements transmitted in electronic claims

===Limited Data Set===

A limited data set of PHI may be used and disclosed for the purposes of research, public health or healthcare operations that excludes the following direct identifiers of the individual or of relatives, employers or household members of the individual:

:#Biometric identifiers, including finger and voice prints; and

:#Full face photographic images and any comparable images

The recipient of the limited data set must enter into a data use agreement.  If a limited data set recipient breaches the data use agreement, UNMC shall take reasonable steps to cure the breach or end the violation, and if such steps are unsuccessful, shall discontinue disclosure of PHI to the limited data set recipient.  

===De-Identification /Re-Identification of PHI (164.514)===

'''De-Identification of PHI.''' PHI may be used to create information that is not individually identifiable health information (de-identified).  The HIPAA privacy rules do not apply to information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual.  PHI is de-identified when 18 identifiers of the individual or of relatives, employers or household members of the individual are removed and the organization does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is the subject of the information.  The identifiers are:

:#Full face photographic images and other comparable images and

:#Any other unique identifying number, characteristic/code, except as permitted under the Re-identification section below

'''Re-Identification of PHI.''' A code or other means of record identification may be assigned to allow information de-identified under De-Identification of PHI (above) about to be re-identified by UNMC, provided that:

:#The code or other means of record identification is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual; and

:#The code or other means of record identification is not used for other purposes and the mechanism for re-identification is not disclosed.  

==Staff Accountability==

[mailto:swrobel@unmc.edu Privacy Officer]  

This page is maintained by [mailto:dpanowic@unmc.edu dkp].