Access to Designated Record Set: Difference between revisions

no edit summary
No edit summary
No edit summary
Line 34: Line 34:


<big>'''Access and Amendment of Designated Record Set Policy'''</big>
<big>'''Access and Amendment of Designated Record Set Policy'''</big>
'''NOTE:''' This policy/procedure is provided to assist University of Nebraska Medical Center Workforce, including those in the patient treatment areas of the Munroe-Meyer Institute for Genetics and Rehabilitation, and other clinical operations that use One Chart and associated applications, as applicable, comply with HIPAA regulations. Those departments and clinics which fall under the jurisdiction of Nebraska Medicine should consult those policies for guidance. The UNMC College of Dentistry maintains a separate policy.<br />
==Basis for Policy ==
==Basis for Policy ==
It is the policy of University of Nebraska Medical Center (UNMC) to comply with access and amendment requirements of the [https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and [https://nebraska.edu/-/media/unca/docs/offices-and-policies/policies/executive-memorandum/hipaa-compliance-policy.pdf Executive Memorandum No. 27, HIPAA Compliance Policy].
Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] outline considerations for the access control family of security controls.
==Policy ==
== Policy ==  
UNMC shall provide Individuals access to inspect and obtain a copy of Protected Health Information (PHI) contained in the Designated Record Set maintained by UNMC or Nebraska Medicine, as applicable, and to request amendment to such information, in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).   
It is the policy of Nebraska Medicine/UNMC to comply with the procedures set forth below.<br />
== Definitions ==
 
===Affiliated Covered Entity (ACE)===
Nebraska Medicine/UNMC ("Organization"), shall provide individuals access to inspect and obtain a copy of Protected Health Information (PHI) contained in the Designated Record Set (DRS) maintained by Nebraska Medicine/UNMC or its business associates, and to request amendment to such information, in accordance with the [https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)].   
Legally separate covered entities that designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. Access and amendment rights apply to designated record sets throughout the ACE.
==Purpose==
===Designated Record Set (DRS)===
To establish guidelines for individual access to and request for amendment of Protected Health Information (PHI) contained in the Designated Record Set.
Includes medical records and billing records about Individuals maintained by or for UNMC/ACE and any other record used by an ACE entity to make decisions about Individuals. Exact duplicates of records maintained by business associates are not considered part of the DRS. 
===Individual===
The person who is the subject of the PHI. Personal representatives of the patient have the same rights as the Individual under HIPAA (i.e., they “step into the shoes” of the Individual). Personal representatives include the legal guardian and anyone else authorized by law to act on behalf of the Individual. Reference Nebraska Medicine Consents and Permits policy, MS14.
===Protected Health Information (PHI)===
Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that:
*is created or received by UNMC/ACE; and
*relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual and identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual. 
PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age):
*an Individual’s genetic tests; 
*the genetic tests of an Individual’s family members; or
*the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history); or
*any request for, or receipt of, genetic services (e.g., genetic test, genetic counseling, genetic education), or participation in clinical research which includes genetic services by the Individual or any family member of the Individual.
PHI excludes:
*individually identifiable health information of a person who has been deceased for more than fifty (50) years.
*education records covered by the Family Educational Rights and Privacy Act (FERPA); and
*employment records held by UNMC in its role as employer.
===Psychotherapy Notes===
Notes recorded (in any medium) by a licensed mental health practitioner (LMHP) documenting or analyzing the contents of a conversation during a private counseling session or group, joint or family counseling session. Psychotherapy notes are kept separate from the Individual's medical record. Psychotherapy notes are sometimes referred to as "process notes." Psychotherapy notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis and progress. Psychotherapy notes are not progress notes.
==Procedures==
==Procedures==
===UNMC Records in Designated Record Set===
===Records Designated as Designated Records Set (DRS)===
#'''Legal Medical Record'''. The Health Information Management Department (HIM) shall manage access to and amendment of the Legal Medical Record for UNMC clinical operations using One Chart for patient care. Contents of the Legal Medical Record shall be approved by the Nebraska Medicine Clinical Governance Committee.   
#Nebraska Medicine/UNMC designates the following records as its designated record set:
##'''Legal Medical Record'''. The Health Information Management Department (HIM) shall manage access to and amendment of the Legal Medical Record. Contents of the Legal Medical Record shall be approved by the Clinical Governance Committee.   
#'''Billing Records'''. The DRS billing record includes all of the data elements required on the [ CMS-1500 form] or [ Health Care Financing Administration claim form (HCFA)]. The contents shall be approved by the Nebraska Medicine Chief Financial Officer for UNMC clinical operations using One Chart for patient care.  
#'''Billing Records'''. The DRS billing record includes all of the data elements required on the [ CMS-1500 form] or [ Health Care Financing Administration claim form (HCFA)]. The contents shall be approved by the Nebraska Medicine Chief Financial Officer for UNMC clinical operations using One Chart for patient care.  
#Any other record used in whole or in part by or for the covered entity to make decisions about Individuals.
#Any other record used in whole or in part by or for the covered entity to make decisions about Individuals.
Line 73: Line 54:
#'''Review for Completeness'''. When a Patient Access Request or Authorization for Release of Information form is received, HIM shall review the form for completion. If any information is incomplete that is necessary for an access request ('''NOTE:''' some information on the Authorization for Release of Information is not necessary for a request for access), HIM will notify the Individual that they cannot process the incomplete request. HIM should document on the form the attempts to contact the Individual.
#'''Review for Completeness'''. When a Patient Access Request or Authorization for Release of Information form is received, HIM shall review the form for completion. If any information is incomplete that is necessary for an access request ('''NOTE:''' some information on the Authorization for Release of Information is not necessary for a request for access), HIM will notify the Individual that they cannot process the incomplete request. HIM should document on the form the attempts to contact the Individual.
#'''Timeframe for Response.'''
#'''Timeframe for Response.'''
#*If examination of the records is requested, HIM/UNMC shall make the records available for inspection within ten (10) days of the date HIM/UNMC received the request.   
#*If examination of the records is requested, Nebraska Medicine/UNMC shall make the records available for inspection within ten (10) days of the date Nebraska Medicine/UNMC received the request.   
#*If unusual circumstances have delayed handling the request, HIM may notify the Individual in writing that an extension (not to exceed 21 days) from the original date UNMC received the complete request is necessary and shall provide the reasons the extension is necessary. The extension notice must state the date by which access or copies will be available. (See the [Extension Notice] provided with this policy.)
#*If unusual circumstances have delayed handling the request, HIM may notify the Individual in writing that an extension (not to exceed 21 days) from the original date Nebraska Medicine/UNMC received the complete request is necessary and shall provide the reasons the extension is necessary. The extension notice must state the date by which access or copies will be available. (See the [Extension Notice] provided with this policy.)
#'''If copies of the records are requested, HIM/UNMC must produce the requested copies within 30 days of the date UNMC received the request. No extension of this date is permitted without the patient’s consent.'''
#'''If copies of the records are requested, Nebraska Medicine/UNMC must produce the requested copies within 30 days of the date Nebraska Medicine/UNMC received the request. No extension of this date is permitted without the patient’s consent.'''
#*If PHI is maintained electronically in one or more DRS for such Individual and the Individual requests an electronic copy of their information, UNMC must provide such information to the Individual in the form and format requested by the Individual, if it is readily producible. If HIM/UNMC cannot readily produce it as requested by the Individual, then such information must be produced in a form and format as mutually agreed by the Individual and HIM/UNMC. If HIM/UNMC and the Individual cannot agree on an electronic form and format, then HIM/UNMC must provide a hard copy option to fulfill the access request.
#*If PHI is maintained electronically in one or more DRS for such Individual and the Individual requests an electronic copy of their information, Nebraska Medicine/UNMC must provide such information to the Individual in the form and format requested by the Individual, if it is readily producible. If Nebraska Medicine/UNMC cannot readily produce it as requested by the Individual, then such information must be produced in a form and format as mutually agreed by the Individual and HIM/UNMC. If HIM/UNMC and the Individual cannot agree on an electronic form and format, then HIM/UNMC must provide a hard copy option to fulfill the access request.
#*If the Individual directs HIM/UNMC to transmit an electronic copy to a third party, HIM/UNMC will comply with such request, provided that the Individual's directions are clear, conspicuous, and specific, and the direction is in writing. If the Individual's directions are not clear, conspicuous, and specific, HIM/UNMC will attempt to contact the Individual to clarify their request. HIM/UNMC may provide the Individual with a summary (abstract) of the PHI requested, in lieu of providing access to PHI or may provide an explanation of the PHI to which access has been provided, if the Individual agrees to the summary or explanation in advance, including any fees imposed for such summary or explanation (see Fees, below in Section 7).
#*If PHI is maintained electronically in one or more Designated Record Sets for such individual and the individual requests an electronic copy of their information, Nebraska Medicine/UNMC must provide such information to the individual in the form and format requested by the individual, if it is readily producible. If Nebraska Medicine/UNMC cannot readily produce it as requested by the Individual, then such information must be produced in a form and format as mutually agreed by the individual and Nebraska Medicine/UNMC. If Nebraska Medicine/UNMC and the individual cannot agree on an electronic form and format, then Nebraska Medicine/UNMC must provide a hard copy option to fulfill the access request.
#'''Fees'''. If an Individual requests a copy of the PHI, HIM/UNMC may impose cost-based fees, not to exceed $0.50 (50 cents) per page. The basis for calculating such fee must be documented and may include staff time to create and copy the electronic file, such as compiling, extracting, scanning and writing the information to portable media. The cost-based fee may also include the cost of the agreed-upon electronic media, such as a USB drive, or creating a paper copy. If a summary or explanation is requested in advance by the patient and the patient has agreed to the fee for such request, HIM/UNMC may charge a pre-determined fee for preparation of such summary or explanation. Reference the fee schedule attached to HIM department policy, Responding to Requests for Clinical Information: External Requestors, ROI 050.
#*If the individual directs Nebraska Medicine/UNMC to transmit an electronic copy to a third party, Nebraska Medicine/UNMC will comply with such request, provided that the Individual's directions are clear, conspicuous and specific, and the direction is in writing. If the Individual's directions are not clear, conspicuous and specific, Nebraska Medicine/UNMC will attempt to contact the individual to clarify their request. Nebraska Medicine/UNMC may provide the Individual with a summary (abstract) of the PHI requested, ''in lieu'' of providing access to PHI or may provide an explanation of the PHI to which access has been provided, if the individual agrees to the summary or explanation in advance, including any fees imposed for such summary or explanation (see Fees below, in Section 7).
#'''Fees'''. If an Individual requests a copy of the PHI, Nebraska Medicine/UNMC may impose cost-based fees, not to exceed $0.50 (50 cents) per page. The basis for calculating such fee must be documented and may include staff time to create and copy the electronic file, such as compiling, extracting, scanning and writing the information to portable media. The cost-based fee may also include the cost of the agreed-upon electronic media, such as a USB drive, or creating a paper copy. If a summary or explanation is requested in advance by the Individual and the Individual has agreed to the fee for such request, Nebraska Medicine/UNMC may charge a pre-determined fee for preparation of such summary or explanation. Reference the fee schedule attached to Nebraska Medicine HIM department policy, Responding to Requests for Clinical Information: External Requestors, ROI 050.
#'''Production of Records'''. If access to the requested information is granted in whole or in part, HIM will arrange for a convenient time and place for the patient to inspect the records or obtain a copy.
#'''Production of Records'''. If access to the requested information is granted in whole or in part, HIM will arrange for a convenient time and place for the patient to inspect the records or obtain a copy.
#*Inspection will generally be during normal business hours of HIM, unless special circumstances are present. Consult the [mailto:privacy@nebraskamed.com Privacy Officer] if the patient requests to inspect the records or obtain a copy before or after normal business hours.
#*Inspection will generally be during normal business hours of HIM, unless special circumstances are present. Consult the [mailto:privacy@nebraskamed.com Privacy Officer] if the patient requests to inspect the records or obtain a copy before or after normal business hours.
Line 121: Line 103:
#'''Timeframe for Response'''. HIM shall respond back to the requestor in writing within 60 days of the date UNMC received the amendment request. If HIM determines that UNMC is unable to respond to the request within sixty (60) days, HIM must notify the Individual in writing that one 30-day extension is necessary to respond to the request and shall provide the reasons the extension is necessary. The extension notice must state the date by which action on the request will be taken.
#'''Timeframe for Response'''. HIM shall respond back to the requestor in writing within 60 days of the date UNMC received the amendment request. If HIM determines that UNMC is unable to respond to the request within sixty (60) days, HIM must notify the Individual in writing that one 30-day extension is necessary to respond to the request and shall provide the reasons the extension is necessary. The extension notice must state the date by which action on the request will be taken.
#'''Recordkeeping'''. The request for amendment, denial of the request, and statement of disagreement/rebuttal statement (if any) must be placed (append or otherwise linked in the electronic record) in the DRS and provided to the Individual as a part of a request for access.  
#'''Recordkeeping'''. The request for amendment, denial of the request, and statement of disagreement/rebuttal statement (if any) must be placed (append or otherwise linked in the electronic record) in the DRS and provided to the Individual as a part of a request for access.  
 
Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] outline considerations for the access control family of security controls.
== Policy ==
Nebraska Medicine/UNMC shall limit the use and disclosure of Protected Health Information (PHI) to the right people, for the right purposes, with the right authority, and always subject to reasonable safeguards -- all as defined by the [https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)]. Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and Nebraska Medicine/UNMC policies.
==Purpose==
To establish guidelines for the use and disclosure of PHI.
==Definitions==
===Affiliated Covered Entity (ACE)===
Legally separate covered entities that designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. Access and amendment rights apply to designated record sets throughout the ACE.
===Designated Record Set (DRS)===
Includes medical records and billing records about Individuals maintained by or for UNMC/ACE and any other record used by an ACE entity to make decisions about Individuals. Exact duplicates of records maintained by business associates are not considered part of the DRS.
===Individual===
The person who is the subject of the PHI. Personal representatives of the Individual have the same rights as the Individual under HIPAA (i.e., they “step into the shoes” of the Individual). Personal representatives include the legal guardian and anyone else authorized by law to act on behalf of the Individual. (See Nebraska Medicine Consents and Permits policy, MS14.)
===Protected Health Information (PHI)===
Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that:
*is created or received by UNMC/ACE; and
*relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual and identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual.
PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age):
*an Individual’s genetic tests;
*the genetic tests of an Individual’s family members; or
*the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history); or
*any request for, or receipt of, genetic services (e.g., genetic test, genetic counseling, genetic education), or participation in clinical research which includes genetic services by the Individual or any family member of the Individual.
PHI excludes:
*individually identifiable health information of a person who has been deceased for more than fifty (50) years.
*education records covered by the Family Educational Rights and Privacy Act (FERPA); and
*employment records held by UNMC in its role as employer.
===Psychotherapy Notes===
Notes recorded (in any medium) by a licensed mental health practitioner (LMHP) documenting or analyzing the contents of a conversation during a private counseling session or group, joint or family counseling session. Psychotherapy notes are kept separate from the Individual's medical record. Psychotherapy notes are sometimes referred to as "process notes." Psychotherapy notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis and progress. Psychotherapy notes are not progress notes.
==Additional Information==
==Additional Information==
*Contact [mailto:privacy@nebraskamed.com Privacy Officer]
*Contact [mailto:privacy@nebraskamed.com Privacy Officer]