Use and Disclosure of PHI for Training Health Care Professionals: Difference between revisions

*Access shall only be used for the purposes related to direct patient care (e.g., review of pertinent history, review of health care data, treatment planning, treatment, follow-up of treatment, communication with other health professionals, preparation for educational and patient care sessions and documentation of findings) and the completion of educational assignments (e.g., case-write ups and presentations for internal educational purposes).

*Review of patients who are not under the direct care of the learner or team, but who have findings of high educational value as determined by the supervisor or senior leader shall be accessed only with guidance and supervision of the supervisor or senior leader.

:'''NOTE:''' Accessing the record of a patient for whom you are no longer providing care is permitted with noted limitations for training purposes; however, students should understand that accessing a patient you are no longer caring for is prohibited outside of the training environment.

*Learners and staff may not indiscriminately search through the EMR or associated application looking for interesting cases to use for educational/training activities.

Providers/faculty/staff/trainees/students or other members of the Workforce may not use PHI in case studies, Grand Rounds, community presentations, articles, industry conferences/lectures, posters, fliers or any other material or media that could be seen or accessed by individuals who are not a member of the Workforce unless:

*The Workforce member gets the individual’s written permission using the [ Education Authorization form CON MR 1900] or other Privacy Office-approved form. The signed authorization form shall be maintained in the patient’s medical record; or

:*Many images and scenarios may be identifiable even after all 18 identifiers are removed. De-identification requires that UNMC “does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information”. Consider:

::*How common is the condition/disease/scenario? Diabetes is very common and therefore lower risk, depending on the information included. An image of an amputation resulting from a car accident is uncommon and, therefore, has a higher risk of being identifiable.

::*De-identified information should be used whenever possible (see De-identification section of this policy).

::*Patient’s or legal guardian’s written authorization is required to photograph or videotape a patient for training purposes.  The patient or the patient’s legal guardian will complete the [ Education Authorization Form CON MR 1900] or other Privacy Office-approved form. Then, only the minimum amount of information shall be photographed/videotaped. (See [https://info.unmc.edu/its-security/policies/procedures/electronic-comm-phi.html Electronic Communication of Protected Health Information], Procedure for UNMC Policy No. 6051, for additional guidance.)

*Research is not considered training or education within the meaning of this policy.

*All research requests using PHI must be submitted to the UNMC IRB for review and approval. See UNMC Human Research Protection Policies and Procedures. The IRB approved consent also contains the HIPAA-compliant authorization when required under HIPAA. The UNMC IRB operates as UNMC’s Privacy Board and approves all waivers of authorization as permitted under HIPAA.   

Education Authorization form CON MR 1900

Request for Electronic Health Data

This page maintained by [mailto:dpanowic@unmc.edu dkp].