Disclosures of PHI as Permitted or Required by Law: Difference between revisions

Jump to navigation Jump to search

Disclosures of PHI as Permitted or Required by Law (view source)

Revision as of 12:09, October 28, 2022

50 bytes added ,  October 28, 2022
no edit summary
VisualWikitext
No edit summary
No edit summary
(4 intermediate revisions by the same user not shown)
Line 28: Line 28:
[[Identification Card]] | [[Secure Area Card Access]] | [[Privacy/Confidentiality]] | [[Computer Use/Electronic Information]] | [[Retention and Destruction/Disposal of Private and Confidential Information]] | [[Use and Disclosure of Protected Health Information]] | [[Notice of Privacy Practices]] | [[Access to Designated Record Set]] | [[Accounting of PHI Disclosures]] | [[Patient/Consumer Complaints]] | [[Vendors]] | [[Fax Transmissions]] | [[Psychotherapy Notes]] | [[Facility Security]] | [[Conditions of Treatment Form]] | [[Informed Consent for UNMC Media]] | [[Transporting Protected Health Information]] | [[Honest Broker]] | [[Social Security Number]] | [[Third Party Registry]] | [[Information Security Awareness and Training]] | [[Patient Privacy Investigations and Levels of Violation]] | [[Use and Disclosure of PHI for Training Health Care Professionals]] | [[Disclosures of PHI as Permitted or Required by Law]] | [[Disclosure of PHI for Law Enforcement Purposes]]
[[Identification Card]] | [[Secure Area Card Access]] | [[Privacy/Confidentiality]] | [[Computer Use/Electronic Information]] | [[Retention and Destruction/Disposal of Private and Confidential Information]] | [[Use and Disclosure of Protected Health Information]] | [[Notice of Privacy Practices]] | [[Access to Designated Record Set]] | [[Accounting of PHI Disclosures]] | [[Patient/Consumer Complaints]] | [[Vendors]] | [[Fax Transmissions]] | [[Psychotherapy Notes]] | [[Facility Security]] | [[Conditions of Treatment Form]] | [[Informed Consent for UNMC Media]] | [[Transporting Protected Health Information]] | [[Honest Broker]] | [[Social Security Number]] | [[Third Party Registry]] | [[Information Security Awareness and Training]] | [[Patient Privacy Investigations and Levels of Violation]] | [[Use and Disclosure of PHI for Training Health Care Professionals]] | [[Disclosures of PHI as Permitted or Required by Law]] | [[Disclosure of PHI for Law Enforcement Purposes]]
<br /><br />
<br /><br />
Policy No.: '''6303'''<br />
Policy No.: '''6304'''<br />
Effective Date: '''Draft 08/19/22'''<br />
Effective Date: '''Draft 10/28/22'''<br />
Revised Date: <br />
Revised Date: <br />
Revised Date: <br />
Revised Date: <br />
Line 38: Line 38:
==Policy==
==Policy==
UNMC shall disclose Protected Health Information (PHI) as permitted or required by law in accordance with the requirements of the [https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and UNMC policies to maintain confidentiality of PHI and protect patient privacy.
UNMC shall disclose Protected Health Information (PHI) as permitted or required by law in accordance with the requirements of the [https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and UNMC policies to maintain confidentiality of PHI and protect patient privacy.
==Definitions==
===Individual===
The person who is the subject of the PHI. Personal representatives of the patient have the same rights as the Individual under HIPAA (i.e., they “step into the shoes” of the Individual). Personal representatives include the legal guardian and anyone else authorized by law to act on behalf of the Individual. See Nebraska Medicine Consents and Permits policy, MS14.
===Protected Health Information (PHI)===
Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that:
*is created or received by UNMC/Nebraska Medicine; and
*relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual and identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual. 
PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age):
*an Individual’s genetic tests; 
*the genetic tests of an Individual’s family members; or
*the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history); or
*any request for, or receipt of, genetic services (e.g., genetic test, genetic counseling, genetic education), or participation in clinical research which includes genetic services by the Individual or any family member of the Individual.
PHI excludes:
*individually identifiable health information of a person who has been deceased for more than fifty (50) years.
*education records covered by the Family Educational Rights and Privacy Act (FERPA); and
*employment records held by UNMC in its role as employer.
===Qualified Protective Order (QPO)===
An order of a court or of an administrative tribunal or a stipulation by the parties to litigation or an administrative proceeding that:
*prohibits the parties from using or disclosing PHI for any purpose other than the litigation or proceeding for which such information was requested; and
*requires the return (to UNMC) or destruction of the PHI (including all copies made) at the end of the litigation or proceeding.
===Workforce===
Employees, medical staff, volunteers, trainees, and other persons whose conduct, in the performance of work for UNMC, is under the direct control of UNMC, whether or not they are paid by UNMC.
==Procedures==
==Procedures==
Disclosures of PHI may be made without a written Individual authorization for the following purposes. Any other disclosures not described below cannot be made unless specifically authorized by another UNMC policy, the Privacy Office, or General Counsel’s office. Unless otherwise provided by UNMC Policy No. 6057, [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information Use and Disclosure of Protected Health Information], all disclosures of PHI permitted by this policy or any other UNMC policy are limited to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. All disclosures, regardless if a written Individual authorization is required or not for any given disclosure, must be documented in the EMR. If a written Individual authorization is required, such authorization must be included in the patient’s medical record.<br />
Disclosures of PHI may be made without a written Individual authorization for the following purposes. Any other disclosures not described below cannot be made unless specifically authorized by another UNMC policy, the Privacy Office, or General Counsel’s office. Unless otherwise provided by UNMC Policy No. 6057, [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information Use and Disclosure of Protected Health Information], all disclosures of PHI permitted by this policy or any other UNMC policy are limited to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. All disclosures, regardless if a written Individual authorization is required or not for any given disclosure, must be documented in the EMR. If a written Individual authorization is required, such authorization must be included in the patient’s medical record.<br />
Line 122: Line 100:
**Unless there is a serious and imminent threat to the health or safety of a person or the public (in which case, see that section above), contact the Privacy Office, General Counsel’s office and/or Risk prior to making disclosures that are intended to enable law enforcement to identify or apprehend an Individual pursuant to the two bullets in this section above.
**Unless there is a serious and imminent threat to the health or safety of a person or the public (in which case, see that section above), contact the Privacy Office, General Counsel’s office and/or Risk prior to making disclosures that are intended to enable law enforcement to identify or apprehend an Individual pursuant to the two bullets in this section above.
Uses and disclosures for specialized government functions.
Uses and disclosures for specialized government functions.
To officials of the Department of State for the purpose of '''medical suitability determinations'''.
*To officials of the Department of State for the purpose of '''medical suitability determinations'''.
'''Note:''' Staff should not proactively alert military command authority regarding the voluntary treatment or admission of active military personnel unless the Individual presents a serious and imminent threat to the Individual or others (see the first bullet under serious and imminent threat section above for more details on this point).
<p>'''Note:''' Staff should not proactively alert military command authority regarding the voluntary treatment or admission of active military personnel unless the Individual presents a serious and imminent threat to the Individual or others (see the first bullet under serious and imminent threat section above for more details on this point).</p>
*'''National security and intelligence activities'''. Disclosure of PHI to authorized Federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities authorized by the National Security Act (and its implementing authority.
*'''National security and intelligence activities'''. Disclosure of PHI to authorized Federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities authorized by the National Security Act (and its implementing authority.
*'''Protective services for the President and others'''. PHI may be disclosed to authorized Federal officials for the provision of protective services to the President or other legally authorized persons.
*'''Protective services for the President and others'''. PHI may be disclosed to authorized Federal officials for the provision of protective services to the President or other legally authorized persons.
*Refer any questions about any of the above provisions and all other requests for government uses not clearly covered by this or another UNMC policy to the Privacy Office or General Counsel’s office.
*Refer any questions about any of the above provisions and all other requests for government uses not clearly covered by this or another UNMC policy to the Privacy Office or General Counsel’s office.
Disclosures for '''workers' compensation'''. UNMC may disclose PHI as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault. Per state law, information disclosed should be limited to only that information relevant to the injury. A workers’ compensation plan’s request for “all medical records” should generally be denied unless the services to the Individual were limited to one episode of care related to the injury.
Disclosures for '''workers' compensation'''. UNMC may disclose PHI as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault. Per state law, information disclosed should be limited to only that information relevant to the injury. A workers’ compensation plan’s request for “all medical records” should generally be denied unless the services to the Individual were limited to one episode of care related to the injury.
==Definitions==
===Individual===
The person who is the subject of the PHI. Personal representatives of the Individual have the same rights as the Individual under HIPAA (i.e., they “step into the shoes” of the Individual). Personal representatives include the legal guardian and anyone else authorized by law to act on behalf of the Individual. (See Nebraska Medicine Consents and Permits policy, MS14.)
===Protected Health Information (PHI)===
Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that:
*is created or received by UNMC/ACE; and
*relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual and identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual.
PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age):
*an Individual’s genetic tests; 
*the genetic tests of an Individual’s family members; or
*the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history); or
*any request for, or receipt of, genetic services (e.g., genetic test, genetic counseling, genetic education), or participation in clinical research which includes genetic services by the Individual or any family member of the Individual.
PHI excludes:
*individually identifiable health information of a person who has been deceased for more than fifty (50) years.
*education records covered by the Family Educational Rights and Privacy Act (FERPA); and
*employment records held by UNMC in its role as employer.
===Qualified Protective Order (QPO)===
An order of a court or of an administrative tribunal or a stipulation by the parties to litigation or an administrative proceeding that:
*prohibits the parties from using or disclosing PHI for any purpose other than the litigation or proceeding for which such information was requested; and
*requires the return (to UNMC) or destruction of the PHI (including all copies made) at the end of the litigation or proceeding.
===Workforce===
Employees, medical staff, volunteers, trainees and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC.
==Additional Information==
==Additional Information==
*Contact the [mailto:privacy@nebraskamed.com Privacy Office] or at 402-559-5136.
*Contact the [mailto:privacy@nebraskamed.com Privacy Office] or at 402-559-5136.
Retrieved from "https://wiki.unmc.edu/index.php/Special:MobileDiff/13182...13410"

Navigation menu