Use and Disclosure of Protected Health Information: Difference between revisions

Policy No.: '''6057'''<br />

Effective Date: '''03/17/03'''<br />

Reviewed Date: ''' '''<br />

#The use or disclosure of PHI must be in accordance with the [https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices].

#The [https://wiki.unmc.edu/index.php/Use_and_Disclosure_of_Protected_Health_Information#Workforce Workforce] member using or disclosing the PHI must do so only as necessary to perform assigned duties.

#Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.)

#If a disclosure of PHI is subject to an Individual’s right to an accounting, it must be documented per UNMC Policy No. 6061, [https://wiki.unmc.edu/index.php/Accounting_of_PHI_Disclosures Accounting of Protected Health Information Disclosures]. Also note the documentation requirements listed throughout this policy and associated policies.  

#All uses and disclosures of PHI should be made in accordance with safeguards adopted by Nebraska Medicine/UNMC to further protect the privacy of PHI.

#Improper uses and disclosures of PHI should be immediately brought to Privacy Office’s attention so it can consider and facilitate the implementation of any effective mitigation or remedial steps.

===Disclosures to Family, Friends and Others===

====Facility Directory====

====Disclosures with Individual’s Permission====

#You may disclose PHI to the Individual in the presence of others if the Individual is asked and consents or is given a chance to object and does not verbally object to such disclosure and you reasonably infer from the circumstances that the Individual does not object. Disclosures of sensitive information, such as mental health or sexually transmitted disease diagnoses, should only be disclosed with the permission of the Individual.

###Full face photographic images and any comparable images; and

###Any other unique identifying number, characteristic, or code.

#Re-identification of PHI. A code or other means of record identification may be assigned to allow information de-identified above to be re-identified by Organization, provided that:  

##The code or other means of record identification is not derived from or related to information about the Individual and is not otherwise capable of being translated so as to identify the Individual; and  

#The minimum necessary standard does not apply to disclosures to disaster relief agencies.

===Authorization Generally Required for All Other Uses/Disclosures===

===Compound Authorizations===

An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases:  

== Definitions ==

===Affiliated Covered Entity (ACE)===

===Designated Record Set (DRS)===

===Health Care Operations===

The following activities related to the Organization's functions as a health care provider and sponsor of a self-insured health plan:

===Individual===

The person who is the subject of the PHI. Personal representatives of the Individual have the same rights as the Individual under HIPAA (i.e., they “step into the shoes” of the Individual). Personal representatives include the legal guardian and anyone else authorized by law to act on behalf of the Individual. (See Nebraska Medicine Consents and Permits policy, MS14.)

===Payment===

Activities undertaken by a health care provider or health plan to obtain premiums, to determine or fulfill its responsibility for coverage and provision of benefits under the health plan or to obtain or provide reimbursement for the provision of health care. Some of these types of activities include determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), billing, collection activities, claims management, medical necessity determinations, utilization review activities including pre-certification and pre-authorization of services, disclosure to consumer reporting agencies related to collection of premiums or reimbursement and health care data processing related to the above-listed activities.  

*an Individual’s genetic tests;  

*the genetic tests of an Individual’s family members; or

PHI excludes:

*individually identifiable health information of a person who has been deceased for more than fifty (50) years.

Employees, medical staff, volunteers, trainees and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC.

==Additional Information==

*UNMC Policy No. 6058, [[Notice of Privacy Practices]]

*UNMC Policy No. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set]

*[https://unmcredcap.unmc.edu/redcap/surveys/?s=94TLJCCAAT Request for Electronic Health Data] Form

*[https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices]

*[https://cynchealth.org/privacy-security/ CyncHealth’s Privacy and Information Security Policies and Procedures]

*[http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html Uses and Disclosures for Treatment, Payment and Health Care Operations]

*[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule]