University of Nebraska Medical Center

Use and Disclosure of PHI for Training Health Care Professionals: Difference between revisions

Page Discussion

Use and Disclosure of PHI for Training Health Care Professionals (view source)

Revision as of 10:07, August 18, 2022

296 bytes added ,  August 18, 2022
no edit summary
VisualWikitext
No edit summary
No edit summary
Line 88: Line 88:
::*How often would the condition/disease/scenario be seen at UNMC/Nebraska Medicine in a given year? For instance, de-identifying an Ebola case is not possible as the number of such cases is too low.
::*How often would the condition/disease/scenario be seen at UNMC/Nebraska Medicine in a given year? For instance, de-identifying an Ebola case is not possible as the number of such cases is too low.
::*How much publicity is associated with the condition/disease/scenario such that the name of the patient is common knowledge? If the media has covered the story of a 15-year-old with stage 2A melanoma, presenting what otherwise may seem low risk is likely to lead to identification of the patient.
::*How much publicity is associated with the condition/disease/scenario such that the name of the patient is common knowledge? If the media has covered the story of a 15-year-old with stage 2A melanoma, presenting what otherwise may seem low risk is likely to lead to identification of the patient.
:*Review [De-identification section] below and/or contact the Privacy Office at privacy@nebraskamed.com for assistance with meeting the deidentification standard.
:*Review [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_PHI_for_Training_Health_Care_Professionals#De-identification_of_PHI_for_Educational_Purposes 4.8 De-identification of PHI for Educational Purposes] and/or contact the [mailto:privacy@nebraskamed.com Privacy Office] for assistance with meeting the deidentification standard.
*Learners may disclose to specialty boards or official academic/professional units the minimum amount of patient information necessary related to the care provided to patient(s) as required for accreditation, credentialing or certification. Documentation of such information during training must be maintained in a secure manner. For guidance contact the Privacy Office at privacy@nebraskamed.com.  
*Learners may disclose to specialty boards or official academic/professional units the minimum amount of patient information necessary related to the care provided to patient(s) as required for accreditation, credentialing or certification. Documentation of such information during training must be maintained in a secure manner. For guidance contact the [mailto:privacy@nebraskamed.com Privacy Office].  
===Internal Use of PHI for Educational Purposes===
===Internal Use of PHI for Educational Purposes===
*Case reports for training (viewed only by individuals who are members of UNMC/Nebraska Medicine’s Workforce):
*Case reports for training (viewed only by individuals who are members of UNMC/Nebraska Medicine’s Workforce):
:*The minimum amount of information necessary shall be used:
:*The minimum amount of information necessary shall be used:
::*Patient name, MRN and/or SSN shall not be used without obtaining prior written patient authorization.
::*Patient name, MRN and/or SSN shall not be used without obtaining prior written patient authorization.
::*De-identified information should be used whenever possible (see De-identification section of this policy).
::*De-identified information should be used whenever possible (see [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_PHI_for_Training_Health_Care_Professionals#De-identification_of_PHI_for_Educational_Purposes 4.8 De-identification of PHI for Educational Purposes]).
::*Patient’s or legal guardian’s written authorization is required to photograph or videotape a patient for training purposes. The patient or the patient’s legal guardian will complete the [ Education Authorization Form CON MR 1900] or other Privacy Office-approved form. Then, only the minimum amount of information shall be photographed/videotaped. (See [https://info.unmc.edu/its-security/policies/procedures/electronic-comm-phi.html Electronic Communication of Protected Health Information], Procedure for UNMC Policy No. 6051, for additional guidance.)
::*Patient’s or legal guardian’s written authorization is required to photograph or videotape a patient for training purposes. The patient or the patient’s legal guardian will complete the [ Education Authorization Form CON MR 1900] or other Privacy Office-approved form. Then, only the minimum amount of information shall be photographed/videotaped. (See [https://info.unmc.edu/its-security/policies/procedures/electronic-comm-phi.html Electronic Communication of Protected Health Information], Procedure for UNMC Policy No. 6051, for additional guidance.)
*Individuals participating in clinical job shadowing shall follow [http://www.nebraskamed.com/careers/job-shadowing Nebraska Medicine’s job shadowing process] and visiting providers functioning as observers or trainees follow [Med Staff’s Visiting Staff policy, MS28].
*Individuals participating in clinical job shadowing shall follow [http://www.nebraskamed.com/careers/job-shadowing Nebraska Medicine’s job shadowing process] and visiting providers functioning as observers or trainees follow [Med Staff’s Visiting Staff policy, MS28].
Line 100: Line 100:
*Research is not considered training or education within the meaning of this policy.
*Research is not considered training or education within the meaning of this policy.
*All research requests using PHI must be submitted to the UNMC IRB for review and approval. See UNMC Human Research Protection Policies and Procedures. The IRB-approved consent also contains the HIPAA-compliant authorization when required under HIPAA. The UNMC IRB operates as UNMC’s Privacy Board and approves all waivers of authorization as permitted under HIPAA.   
*All research requests using PHI must be submitted to the UNMC IRB for review and approval. See UNMC Human Research Protection Policies and Procedures. The IRB-approved consent also contains the HIPAA-compliant authorization when required under HIPAA. The UNMC IRB operates as UNMC’s Privacy Board and approves all waivers of authorization as permitted under HIPAA.   
Review of PHI Preparatory to Research. UNMC staff and students who wish to review PHI to prepare a research proposal must submit a "Request for Electronic Health Data" form to the Electronic Health Record Core to obtain access to PHI. The form is located at: www.unmc.edu/cctr/ehr_research.html.
Review of PHI Preparatory to Research. UNMC staff and students who wish to review PHI to prepare a research proposal must submit a "Request for Electronic Health Data" form to the [www.unmc.edu/cctr/ehr_research.html Electronic Health Record Core].
===De-identification of PHI for Educational Purposes===
===De-identification of PHI for Educational Purposes===
PHI may be used to create information that is not individually identifiable health information (de-identified). The HIPAA privacy rules do not apply to information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. However, de-identification to HIPAA standards is challenging and is not always possible, which often results in the need for written Individual authorization to use/disclose the patient’s PHI. Beyond the removal of identifiers, the following considerations are required by the Privacy Office:
PHI may be used to create information that is not individually identifiable health information (de-identified). The HIPAA privacy rules do not apply to information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. However, de-identification to HIPAA standards is challenging and is not always possible, which often results in the need for written Individual authorization to use/disclose the patient’s PHI. Beyond the removal of identifiers, the following considerations are required by the Privacy Office:
Retrieved from "https://wiki.unmc.edu/index.php/Special:MobileDiff/13168"