2,654
edits
Use and Disclosure of PHI for Training Health Care Professionals: Difference between revisions
Use and Disclosure of PHI for Training Health Care Professionals (view source)
Revision as of 09:57, August 18, 2022
, August 18, 2022no edit summary
No edit summary |
No edit summary |
||
| Line 95: | Line 95: | ||
::*Patient name, MRN and/or SSN shall not be used without obtaining prior written patient authorization. | ::*Patient name, MRN and/or SSN shall not be used without obtaining prior written patient authorization. | ||
::*De-identified information should be used whenever possible (see De-identification section of this policy). | ::*De-identified information should be used whenever possible (see De-identification section of this policy). | ||
::*Patient’s or legal guardian’s written authorization is required to photograph or videotape a patient for training purposes. | ::*Patient’s or legal guardian’s written authorization is required to photograph or videotape a patient for training purposes. The patient or the patient’s legal guardian will complete the [ Education Authorization Form CON MR 1900] or other Privacy Office-approved form. Then, only the minimum amount of information shall be photographed/videotaped. (See [https://info.unmc.edu/its-security/policies/procedures/electronic-comm-phi.html Electronic Communication of Protected Health Information], Procedure for UNMC Policy No. 6051, for additional guidance.) | ||
*Individuals participating in clinical job shadowing shall follow [http://www.nebraskamed.com/careers/job-shadowing Nebraska Medicine’s job shadowing process] and visiting providers functioning as observers or trainees follow Med Staff’s Visiting Staff policy, MS28. | *Individuals participating in clinical job shadowing shall follow [http://www.nebraskamed.com/careers/job-shadowing Nebraska Medicine’s job shadowing process] and visiting providers functioning as observers or trainees follow [Med Staff’s Visiting Staff policy, MS28]. | ||
===Use/Disclosure of PHI for Research === | ===Use/Disclosure of PHI for Research === | ||
*Research is not considered training or education within the meaning of this policy. | *Research is not considered training or education within the meaning of this policy. | ||
*All research requests using PHI must be submitted to the UNMC IRB for review and approval. See UNMC Human Research Protection Policies and Procedures. The IRB approved consent also contains the HIPAA-compliant authorization when required under HIPAA. The UNMC IRB operates as UNMC’s Privacy Board and approves all waivers of authorization as permitted under HIPAA. | *All research requests using PHI must be submitted to the UNMC IRB for review and approval. See UNMC Human Research Protection Policies and Procedures. The IRB-approved consent also contains the HIPAA-compliant authorization when required under HIPAA. The UNMC IRB operates as UNMC’s Privacy Board and approves all waivers of authorization as permitted under HIPAA. | ||
Review of PHI Preparatory to Research. UNMC staff and students who wish to review PHI to prepare a research proposal must submit a "Request for Electronic Health Data" form to the Electronic Health Record Core to obtain access to PHI. The form is located at: www.unmc.edu/cctr/ehr_research.html. | Review of PHI Preparatory to Research. UNMC staff and students who wish to review PHI to prepare a research proposal must submit a "Request for Electronic Health Data" form to the Electronic Health Record Core to obtain access to PHI. The form is located at: www.unmc.edu/cctr/ehr_research.html. | ||
===De-identification of PHI for Educational Purposes=== | ===De-identification of PHI for Educational Purposes=== | ||
PHI may be used to create information that is not individually identifiable health information (de-identified). The HIPAA privacy rules do not apply to information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. However, de-identification to HIPAA standards is challenging and is not always possible, which often results in the need for written Individual authorization to use/disclose the patient’s PHI. Beyond the removal of identifiers, the following considerations are required by the Privacy Office: | |||
PHI may be used to create information that is not individually identifiable health information (de-identified). The HIPAA privacy rules do not apply to information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. However, de-identification to HIPAA standards is challenging and is not always possible, which often results in the need for written Individual authorization to use/disclose the patient’s PHI. | |||
*Is the case unique/novel? (It is often impossible to deidentify PHI in these cases, which are generally the most popular types of requests.) | *Is the case unique/novel? (It is often impossible to deidentify PHI in these cases, which are generally the most popular types of requests.) | ||
*Has the case been covered in the media? (The media often states when a gunshot or accident victim is taken to Nebraska Medicine/UNMC, with details about the individual and the injuries, which can lead to identification.) | *Has the case been covered in the media? (The media often states when a gunshot or accident victim is taken to Nebraska Medicine/UNMC, with details about the individual and the injuries, which can lead to identification.) | ||
*Is the case statistically uncommon? (These would be cases that are rare, such as having Ebola.) | *Is the case statistically uncommon? (These would be cases that are rare, such as having Ebola.) | ||
*Is the case geographically uncommon? (E.g., a case that is common in Brazil, but rarely seen/treated in Nebraska) | *Is the case geographically uncommon? (E.g., a case that is common in Brazil, but rarely seen/treated in Nebraska) | ||
*Is the case procedurally uncommon? (E.g., the first double lung transplant, etc.) | *Is the case procedurally uncommon? (E.g., the first double lung transplant, etc.) | ||
Some cases and images would be unique without any indication of the injury or disease (e.g., physical structures that are unusual). However, any image/case combined with the treatment location (e.g., UNMC/Nebraska Medicine), the facts of the case (e.g., how the injury occurred or the disease process), and/or the facts of the treatment (e.g., the number of screws in the injured ankle) tips the image/case toward identifiability. Additionally, cases/images are rarely presented in a vacuum – while identifiers are commonly removed, the presenter generally provides some background (e.g., a story about how the injury happened) or applicable facts about the patient (e.g., place/type of employment; medical history), adding additional risk of identifiability.<br /> | |||
Some cases and images would be unique without any indication of the injury or disease (e.g., physical structures that are unusual). However, any image/case combined with the treatment location (e.g., UNMC/Nebraska Medicine), the facts of the case (e.g., how the injury occurred or the disease process), and/or the facts of the treatment (e.g., the number of screws in the injured ankle) tips the image/case toward identifiability. Additionally, cases/images are rarely presented in a vacuum – while identifiers are commonly removed, the presenter generally provides some background (e.g., a story about how the injury happened) or applicable facts about the patient (e.g., place/type of employment; medical history), adding additional risk of identifiability. | |||
See UNMC Policy No. 6057, [[Use and Disclosure of Protected Health Information]], for additional information regarding de-identification. | |||
==Additional Information== | ==Additional Information== | ||
*Contact the [mailto:privacy@nebraskamed.com Privacy Office] or at 402-559-5136. | *Contact the [mailto:privacy@nebraskamed.com Privacy Office] or at 402-559-5136. | ||
| Line 119: | Line 118: | ||
*UNMC Policy No. 6057, [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information Use and Disclosure of Protected Health Information] | *UNMC Policy No. 6057, [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information Use and Disclosure of Protected Health Information] | ||
*[https://info.unmc.edu/its-security/policies/procedures/electronic-comm-phi.html Electronic Communication of Protected Health Information], Procedure for UNMC Policy No. 6051 | *[https://info.unmc.edu/its-security/policies/procedures/electronic-comm-phi.html Electronic Communication of Protected Health Information], Procedure for UNMC Policy No. 6051 | ||
HRPP Policy 1.8 | *HRPP Policy 1.8 | ||
Education Authorization form CON MR 1900 | *Med Staff’s Visiting Staff policy, MS28. | ||
Request for Electronic Health Data | *Education Authorization form CON MR 1900 | ||
*Request for Electronic Health Data Form | |||
*[http://www.nebraskamed.com/careers/job-shadowing Nebraska Medicine’s job shadowing process] | *[http://www.nebraskamed.com/careers/job-shadowing Nebraska Medicine’s job shadowing process] | ||
This page maintained by [mailto:dpanowic@unmc.edu dkp]. | This page maintained by [mailto:dpanowic@unmc.edu dkp]. | ||