Use and Disclosure of PHI for Training Health Care Professionals: Difference between revisions

Jump to navigation Jump to search

Use and Disclosure of PHI for Training Health Care Professionals (view source)

Revision as of 10:45, October 28, 2022

604 bytes added ,  October 28, 2022
no edit summary
VisualWikitext
No edit summary
No edit summary
(7 intermediate revisions by the same user not shown)
Line 37: Line 37:
To establish guidelines for the use and disclosure of PHI for training health care professionals in accordance with HIPAA.   
To establish guidelines for the use and disclosure of PHI for training health care professionals in accordance with HIPAA.   
==Policy==
==Policy==
The University of Nebraska Medical Center (UNMC) shall use and disclose Protected Health Information (PHI) to train health care professionals in accordance with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and UNMC policies to maintain confidentiality of PHI and protect patient privacy.
The University of Nebraska Medical Center (UNMC) shall use and disclose Protected Health Information (PHI) to train health care professionals in accordance with the requirements of the [https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)] and UNMC policies to maintain confidentiality of PHI and protect patient privacy.  
==Definitions==
'''Formal training''' as described in this policy includes learning that is delivered in an intentional way, and is guided by an instructor, supervisor, or other designated individual, versus casual, unstructured, and/or self-directed access to or disclosure of PHI (e.g., perusing the records/images/labs of patients you are curious about, sharing patient information with a colleague because it is “interesting”, etc.).<br />
 
'''Protected Health Information (PHI)''' is individually identifiable health information. Individually identifiable health information is a subset of health information, including demographic information, collected from an Individual, whether oral or recorded in any medium, that:
*is created or received by UNMC and/or Nebraska Medicine; and
*relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual AND identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual. 
PHI includes genetic information, which includes information about:
*an Individual’s genetic tests; 
*the genetic tests of an Individual’s family members; or
*the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history).
PHI excludes individually identifiable health information of a person who has been deceased for more than fifty (50) years.<br />
 
PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA) and employment records held by UNMC in its role as employer.<br />
 
'''Research''' means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.<br />
 
'''Workforce''' means employees, medical staff, volunteers, trainees, and other persons whose conduct, in the performance of work for UNMC, is under the direct control of UNMC, whether or not they are paid by UNMC.
==Procedures==
==Procedures==
===Formal Training of Health Care Professionals===
===Formal Training of Health Care Professionals===
Line 100: Line 83:
*Research is not considered training or education within the meaning of this policy.
*Research is not considered training or education within the meaning of this policy.
*All research requests using PHI must be submitted to the UNMC IRB for review and approval. See UNMC [https://guides.unmc.edu/books/hrpp-policies-and-procedures Human Research Protection Program Policies and Procedures]. The IRB-approved consent also contains the HIPAA-compliant authorization when required under HIPAA. The UNMC IRB operates as UNMC’s Privacy Board and approves all waivers of authorization as permitted under HIPAA.   
*All research requests using PHI must be submitted to the UNMC IRB for review and approval. See UNMC [https://guides.unmc.edu/books/hrpp-policies-and-procedures Human Research Protection Program Policies and Procedures]. The IRB-approved consent also contains the HIPAA-compliant authorization when required under HIPAA. The UNMC IRB operates as UNMC’s Privacy Board and approves all waivers of authorization as permitted under HIPAA.   
*Review of PHI Preparatory to Research. UNMC staff and students who wish to review PHI to prepare a research proposal must submit a "Request for Electronic Health Data" form to the [www.unmc.edu/cctr/ehr_research.html Electronic Health Record Core].
*Review of PHI Preparatory to Research. UNMC staff and students who wish to review PHI to prepare a research proposal must submit a "Request for Electronic Health Data" form at [https://unmcredcap.unmc.edu/redcap/surveys/?s=NMPNWMEA7W Electronic Health Data Request].
===De-identification of PHI for Educational Purposes===
===De-identification of PHI for Educational Purposes===
PHI may be used to create information that is not individually identifiable health information (de-identified). The HIPAA privacy rules do not apply to information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. However, de-identification to HIPAA standards is challenging and is not always possible, which often results in the need for written Individual authorization to use/disclose the patient’s PHI. Beyond the removal of identifiers, the following considerations are required by the Privacy Office:
PHI may be used to create information that is not individually identifiable health information (de-identified). The HIPAA privacy rules do not apply to information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. However, de-identification to HIPAA standards is challenging and is not always possible, which often results in the need for written Individual authorization to use/disclose the patient’s PHI. Beyond the removal of identifiers, the following considerations are required by the Privacy Office:
Line 111: Line 94:


See UNMC Policy No. 6057, [[Use and Disclosure of Protected Health Information]], for additional information regarding de-identification.
See UNMC Policy No. 6057, [[Use and Disclosure of Protected Health Information]], for additional information regarding de-identification.
==Definitions==
===Formal Training===
As described in this policy, formal training includes learning that is delivered in an intentional way, and is guided by an instructor, supervisor, or other designated individual, versus casual, unstructured, and/or self-directed access to or disclosure of PHI (e.g., perusing the records/images/labs of patients you are curious about, sharing patient information with a colleague because it is “interesting”, etc.).
===Protected Health Information (PHI)===
Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that:
*is created or received by UNMC/ACE; and
*relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual and identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual.
PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age):
*an Individual’s genetic tests;
*the genetic tests of an Individual’s family members; or
*the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history); or
*any request for, or receipt of, genetic services (e.g., genetic test, genetic counseling, genetic education), or participation in clinical research which includes genetic services by the Individual or any family member of the Individual.
PHI excludes:
*individually identifiable health information of a person who has been deceased for more than fifty (50) years.
*education records covered by the Family Educational Rights and Privacy Act (FERPA); and
*employment records held by UNMC in its role as employer.
===Research===
A systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalized knowledge. Generalized knowledge is knowledge that can be applied to populations outside the population served by the ACE.
===Workforce===
Employees, medical staff, volunteers, trainees, and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC.
==Additional Information==
==Additional Information==
*Contact the [mailto:privacy@nebraskamed.com Privacy Office] or at 402-559-5136.
*Contact the [mailto:privacy@nebraskamed.com Privacy Office] or at 402-559-5136.
Line 119: Line 123:
*Procedure for UNMC Policies No. 6051 and 6057, [https://info.unmc.edu/its-security/policies/procedures/electronic-comm-phi.html Electronic Communication of Protected Health Information]
*Procedure for UNMC Policies No. 6051 and 6057, [https://info.unmc.edu/its-security/policies/procedures/electronic-comm-phi.html Electronic Communication of Protected Health Information]
*UNMC [https://guides.unmc.edu/books/hrpp-policies-and-procedures Human Research Protection Program Policies and Procedures]
*UNMC [https://guides.unmc.edu/books/hrpp-policies-and-procedures Human Research Protection Program Policies and Procedures]
*[https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)]
*HRPP Policy 1.8
*HRPP Policy 1.8
*Med Staff’s Visiting Staff policy, MS28.
*Med Staff’s Visiting Staff policy, MS28.
*Education Authorization form CON MR 1900
*Education Authorization form CON MR 1900
*Request for Electronic Health Data Form
*[https://unmcredcap.unmc.edu/redcap/surveys/?s=NMPNWMEA7W Electronic Health Data Request] Form
*[http://newintranet.nebraskamed.com/AnalyticsRequest/ Analytics Work Request]
*[http://newintranet.nebraskamed.com/AnalyticsRequest/ Analytics Work Request]
*[https://www.unmc.edu/student-success/pathway-programs/job-shadow.html Nebraska Medicine’s job shadowing process]
*[https://www.unmc.edu/student-success/pathway-programs/job-shadow.html Nebraska Medicine’s job shadowing process]


This page maintained by [mailto:dpanowic@unmc.edu dkp].
This page maintained by [mailto:dpanowic@unmc.edu dkp].
Retrieved from "https://wiki.unmc.edu/index.php/Special:MobileDiff/13171...13406"

Navigation menu