Use and Disclosure of Protected Health Information: Difference between revisions

Policy No.: '''6057'''<br />

Effective Date: '''03/17/03'''<br />

Reviewed Date: ''' '''<br />

#The person or entity to which PHI is disclosed must be authorized to receive it and their identity and authority must be verified prior to such disclosure. (See Verification and Authority policy, [https://secure.compliance360.com/Today/DisplayTab?PD=Q63uFd1AsIvtLq6ToeED9rAee%2bFRP7onkvKrNNl2szKEszBO6tcvW30uMYCrLHz%2ff5qp5Jtyy5hY3Kc6FOXhopxNkewzPG2A8OEmY0FOV0gitoSsonRfDnbnEdx5nsr%2bZ%2fNk541fFQqAD7aXNL%2fG%2b316yK7R9SBhHMui6Ah%2fOCt8KE2umEvYPmNwFE8S%2bTVtIUrDO3xL6PALBlpa6juXkzyHaIo3iPkx1ovcv94m5d9qKwCgkuut5jNUR8E7XmClVNyehpOmY09Hmbo%2f0j%2bqZX7KNjSQrgbRadZXTJKSG7ASS%2b10Hee0yaZnQlMHoDejOl8M85zzTyj1snBEwZjAUF2TA8TNfAyKjkcXriXbvX6pQAM3PsgE84e2Vgv3hNMYYUjaKVvRHCC3ziIK2FeUNQOadKiFE9eSwvJcSWSscuz%2bJHSSE60mjfcSkTpFLJ1ImWtYli0yP4msuE3Nnfse1zwggz5pQCKDhf1Du7HOGykzdrq%2b7ITvzsC0AMcHy8SyoY4M6w6eNlx5E3sNIlAjIQ%3d%3d IM55] and the Nebraska Medicine Consents and Permits policy, MS14, Authorized Consenting Persons section.)  

#Use and disclosure of PHI must be limited to the minimum necessary to accomplish the intended purpose of such use or disclosure. (See Minimum Necessary section below.)

#If a disclosure of PHI is subject to an Individual’s right to an accounting, it must be documented per UNMC Policy No. 6061, [https://wiki.unmc.edu/index.php/Accounting_of_PHI_Disclosures Accounting of Protected Health Information Disclosures]. Also note the documentation requirements listed throughout this policy and associated policies.  

#All uses and disclosures of PHI should be made in accordance with safeguards adopted by Nebraska Medicine/UNMC to further protect the privacy of PHI.

#Improper uses and disclosures of PHI should be immediately brought to Privacy Office’s attention so it can consider and facilitate the implementation of any effective mitigation or remedial steps.

===Disclosures to Family, Friends and Others===

====Facility Directory====

====Disclosures with Individual’s Permission====

#You may disclose PHI to the Individual in the presence of others if the Individual is asked and consents or is given a chance to object and does not verbally object to such disclosure and you reasonably infer from the circumstances that the Individual does not object. Disclosures of sensitive information, such as mental health or sexually transmitted disease diagnoses, should only be disclosed with the permission of the Individual.

###Full face photographic images and any comparable images; and

###Any other unique identifying number, characteristic, or code.

#Re-identification of PHI. A code or other means of record identification may be assigned to allow information de-identified above to be re-identified by Organization, provided that:  

##The code or other means of record identification is not derived from or related to information about the Individual and is not otherwise capable of being translated so as to identify the Individual; and  

#The minimum necessary standard does not apply to disclosures to disaster relief agencies.

===Authorization Generally Required for All Other Uses/Disclosures===

===Compound Authorizations===

An authorization for use or disclosure of PHI generally may not be combined with any other document to create a compound authorization, except in the following cases:  

Employees, medical staff, volunteers, trainees and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC.

==Additional Information==

*UNMC Policy No. 6058, [[Notice of Privacy Practices]]

*UNMC Policy No. 6059, [https://wiki.unmc.edu/index.php/Access_to_Designated_Record_Set Access and Amendment of Designated Record Set]

*[https://unmcredcap.unmc.edu/redcap/surveys/?s=94TLJCCAAT Request for Electronic Health Data] Form

*[https://www.nebraskamed.com/patients/rights-responsibilities/notice-privacy-practices Nebraska Medicine/UNMC Notice of Privacy Practices]

*[https://cynchealth.org/privacy-security/ CyncHealth’s Privacy and Information Security Policies and Procedures]

*[http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html Uses and Disclosures for Treatment, Payment and Health Care Operations]

*[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule]