Module 1- HIPAA Release of Protected Health Information not - - PowerPoint PPT Presentation

Module 1- HIPAA Release of Protected Health Information not requiring Consent, Authorization

• r Opportunity for Objection

Objectives

Define the process for releasing Protected Health Information (PHI). Define the Agencies that can obtain the Protected Health Information (PHI) without patient authorization.

Policy Purpose

This Policy outlines the Release of Information's and Memorial Hermann Health System's (MHHS, Memorial Hermann) responsibility related to the release of Protected Health information (PHI) that does not require a Patient's consent or Authorization, and that does not provide the Patient with an opportunity to object to a use or disclosure

• f PHI.

Capitalized terms used but not otherwise defined shall have the meaning provided under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) implementing regulations or elsewhere in Memorial Hermann's health information policies and procedures.

This policy applies to (i) Memorial Hermann Health System ("Memorial Hermann"), (ii) all facilities and entities wholly-owned by Memorial Hermann and (iii) all facilities and entities controlled and operated by Memorial Hermann.

Scope

Policy Statement

Memorial Hermann Health System, generally, or the Memorial Hermann Release of Information department, specifically (collectively, Memorial Hermann), may release a Patient's Protected Health Information (PHI), without the consent or Authorization of the Patient and without providing the Patient with an opportunity to agree or object, subject to the applicable requirements of this Policy, in the following circumstances:

Definitions- Required by Law

a. Law Enforcement Official is defined as "an officer or employee

• f any agency or authority of the United States, a State, a

territory, a political subdivision of the state or territory, or an Indian tribe," who is empowered by law to: i. Investigate or conduct an official inquiry into a potential violation of law; or ii. Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation

• f law.

Definitions Continued

• b. Required by Law: a mandate contained in law that compels an entity

to make a use or disclosure of Protected Health Information (PHI) and that is enforceable in a court of law. This includes but is not limited to court orders, and court-ordered warrants, subpoenas, or grand jury subpoenas.

• c. Legal Process: In the law enforcement context, "legal process"

means a formal written demand or request. Legal process involves documents like: i. A court order; ii. A court-ordered warrant;

• iii. A subpoena or summons issued by a judicial officer;
• iv. A grand jury subpoena; and

v. An administrative subpoena, summons, or investigative demand.

Definitions Continued

1. Memorial Hermann may release or disclose PHI to a federal, state,

• r local government agency or authority to the extent authorized or

Required by Law. 2. Examples of federal government agencies or authorities include the Office of Inspector General (OIG), the Food and Drug Administration (FDA), the Federal Bureau of Investigation (FBI), a United States Attorney, the Social Security Administration, Department of Health and Human Services, Office of Civil Rights and Centers for Medicare & Medicaid Services (CMS).

Implementation

Implementation: All subpoenas should be sent to the Release of Information Department located at 909 Frostwood, Houston, Texas, suite 2.2 for processing. (See Policy: HIPAA - Release of Protected Health Information to Law Enforcement).

Continuum of Care

Memorial Hermann may release Patient PHI: 1. To a health care provider who is providing health care items or services to the Patient when the request for the Patient's PHI is made; 2. To a prospective health care provider for the purpose of securing the services of that health care provider as part of the Patient's continuum of care, as determined by the Patient's attending physician; and 3. To a transporting emergency medical service provider, but only for the purpose of determining the Patient's diagnosis and the outcome

• f the Patient's hospital admission.

Public Health Activities

Memorial Hermann may release or disclose PHI for the following public health activities and purposes: 1. To a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including the reporting of disease, injury, vital events such as birth or death, and to conduct a public health surveillance, public health investigations, and public health interventions; or, at the direction of a public health authority, to an

• fficial of a foreign government agency that is acting in

collaboration with a public health authority; 2. To a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect;

Public Health Activities Cont.

• 3. To a person subject to the jurisdiction of the FDA;
• 4. To report adverse events, product defects or problems, or biological

product deviations;

• 5. To track products;
• 6. To enable product recalls, repairs, or replacement; or
• 7. To conduct post-marketing surveillance; or
• 8. To a person who may have been exposed to a communicable

disease or may otherwise be at risk of contracting or spreading a disease or condition, if Memorial Hermann is authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation.

Employers

Memorial Hermann may release or disclose PHI to an employer, about a Patient who is a member of the workforce of the employer, if: 1. Memorial Hermann provides health care to a Patient at the request

• f the employer; or conducts an evaluation relating to medical

surveillance of the workplace; or to evaluate whether the Patient has a work-related illness or injury; 2. The PHI that is released or disclosed consists of findings concerning a work-related illness or injury or a workplace-related medical surveillance;

Employers Cont.

3. The employer needs such findings in order to comply with its

• bligations to record such illness or injury or to carry out

responsibilities for workplace medical surveillance; and 4. Memorial Hermann provides written notice to the Patient that information relating to the medical surveillance of the workplace and work-related illnesses and injuries is to be released to the employer by giving a copy of the notice to the Patient at the time the health care is provided; or if the health care is provided on the work site of the employer, by posting the notice in a prominent place at the location where the health care is provided.

Schools

Memorial Hermann may release or disclose PHI to a school about an individual who is a student or prospective student of the school, if: 1. The PHI that is disclosed is limited to proof of immunization; 2. The school is required by law to have proof of immunization prior to admitting the student; and 3. Memorial Hermann obtains and documents the agreement to the disclosure from either: a. A parent, guardian or other person acting in loco parentis of the individual, if the individual is an unemancipated minor; or b. The individual, if the individual is an adult or emancipated minor.

Victims of Abuse, Neglect or Domestic Violence

1. Memorial Hermann may release or disclose PHI about a Patient whom the organization reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, if the disclosure is expressly authorized or Required by Law, the Patient agrees to the disclosure, or the organization believes the disclosure is necessary to prevent serious harm to the Patient or other potential victims.

Victims of Abuse, Neglect or Domestic Violence Cont.

2. If the Patient is unable to agree because of incapacity, a law enforcement or other public official authorized to receive the report represents, in writing, that the information for which disclosure is sought is not intended to be used against the Patient and that an immediate enforcement activity that depends upon the disclosure would be adversely affected by waiting for the Patient to agree to the disclosure. 3. When a disclosure of this nature is made, the department will promptly inform the Patient that such a report has been or will be made, except if informing the Patient would place the Patient at risk

• f serious harm; or the organization would be informing a personal

representative, and the organization reasonably believes the personal representative is responsible for the abuse, neglect, or

• ther injury, and that informing such person would not be in the

best interest of the Patient. (See Policy: HIPAA - Release of Protected Health Information to Law Enforcement).

Health Oversight Activities

Health Oversight agency includes a federal, state, or local government agency authorized by law to oversee the public and private health care system or government programs on which health information is necessary for determining eligibility or compliance, or to enforce civil rights laws for which health information is relevant. The definition includes the employees, agents, contractors, persons or entities acting under a grant of authority of such public agency.

Health Oversight Activities Cont.

Uses and disclosures for health oversight also must comply with the minimum necessary provisions of the Privacy Rule. You may rely on the health agency's description of what the agency believes is necessary for its oversight purposes. You must require a written statement from the health oversight agency on appropriate government letterhead or other documentation and their identity and authority. Examples of Health Oversight : Texas State Medical Board, Texas Health Insurance Commissioner, Medicaid Fraud Control, FDA, and Texas Department of Insurance.

Health Oversight Activities Cont.

1. Memorial Hermann may release or disclose to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate

• versight of:

a. Memorial Hermann; b. Government benefit programs for which health information is relevant to beneficiary eligibility; c. Entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; or d. Entities subject to civil rights laws for which health information is necessary for determining compliance.

Health Oversight Activities Cont.

2. An investigation or other activity is not considered health oversight if the Patient is the subject of the investigation or activity, and such investigation or other activity does not arise out of and is not directly related to: health care fraud. 3. If a health oversight activity or investigation is conducted in conjunction with an oversight activity or investigation relating to a claim for public benefits not related to health, the joint activity or investigation is considered a health oversight activity.

Judicial and Administrative Proceedings

1. Memorial Hermann may release or disclose PHI in the course of any judicial or administrative proceeding: a. In response to an order of a court or administrative tribunal, provided that Memorial Hermann releases only the information expressly authorized by such order; or b. In response to a subpoena (federal, state, or local, an assistant district attorney, a district attorney, a U.S. attorney, a notary, a deputy, or another legal authority}, discovery request,

• r other lawful process, that is not accompanied by an order
• f a court or administrative tribunal, if the Patient who is the

subject of the information has been given notice of the request;

• r the party seeking the information has secured a qualified

protective order.

• 2. A qualified protective order means an order of a court or of an

administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that:

• a. Prohibits the parties from using or disclosing PHI for any purpose
• ther than the litigation or proceeding for which such information

was requested; and

• b. Requires the return to the organization or destruction of the PHI

(including all copies made) at the end of the litigation or proceeding.

• 3. Memorial Hermann may release or disclose PHI in response to lawful

process of section 1.b. above under Judicial and Administrative Proceedings section, without the Patient having been notified of the request, if Memorial Hermann makes reasonable efforts to provide notice to the Patient, or to seek a qualified protective order.

(See Policy: HIPAA - Release of Protected Health Information to Law Enforcement).

Judicial and Administrative Proceedings Cont.

Limited Information for Identification and Location Purposes

1. Memorial Hermann may release or disclose PHI for a law enforcement purpose to law enforcement officials as Required by Law, including laws that require the reporting of certain types of wounds or other physical injuries. PHI may also be released in compliance with a court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer; a grand jury subpoena; or an administrative request authorized under law, provided that the information sought is relevant to the inquiry, the request is specific and limited in scope, and de-identified information could not reasonably be used.

2. Memorial Hermann may, in response to a law enforcement official's written request, disclose limited PHI for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person. Memorial Hermann may release or disclose only the following information for such purposes: a. Name and address; b. Date and place of birth; c. Social security number; d. ABO blood type and RH factor; e. Type of injury; f. Date and time of treatment; g. Date and time of death, if applicable; and h. A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos.

Limited Information for Identification and Location Purposes Cont.

• 3. Without a court order, Memorial Hermann will not release any

information related to the Patient's DNA or DNA analysis, dental records, or typing, samples or analysis of body fluids or tissue.

• 4. Memorial Hermann may release information in response to a law

enforcement official's request for information about a Patient who is

• r is suspected to be a victim of a crime, if the Patient agrees to the

disclosure or, if the department is unable to obtain the Patient's agreement because of incapacity or other emergency circumstance, provided that:

• a. Such information is needed to determine whether a violation of

law by a person other than the victim has occurred, and such information is not intended to be used against the victim;

• b. Immediate law enforcement activity would be adversely affected

by waiting until the Patient is able to agree to the disclosure; and

• c. The disclosure is in the best interests of the Patient.

Limited Information for Identification and Location Purposes Cont.

5. Memorial Hermann may release or disclose PHI about a Patient who has died for the purpose of alerting law enforcement of the death of the Patient if there is a suspicion that such death may have resulted from criminal conduct. 6. Memorial Hermann may release or disclose PHI that constitutes evidence of criminal conduct that occurred on the premises of the

• rganization. (See Policy: HIPAA - Release of Protected Health

Information to Law Enforcement).

Limited Information for Identification and Location Purposes Cont.

Decedents

• 1. Memorial Hermann may release or disclose PHI to a coroner or

medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law.

• 2. Memorial Hermann may release or disclose PHI to funeral directors,

consistent with applicable law, as necessary to carry out their duties with respect to the decedent. Memorial Hermann may release or disclose the information prior to, and in reasonable anticipation of, the individual's death.

• 3. Memorial Hermann may disclose PHI to a family member of a

deceased Patient or other persons involved in the Patient's health care or payment for their health care prior to the Patient's death, unless doing so is inconsistent with any prior expressed preference

• f the Patient that is known to Memorial Hermann. (See Policy:

HIPAA - Release of Protected Health Information to Law Enforcement).

Cadaveric Organ, Eye or Tissue Donation

Memorial Hermann may release or disclose PHI to organ procurement

• rganizations or other entities engaged in the procurement, banking, or

transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.

Threat to Health or Safety

1. Memorial Hermann may, consistent with applicable law and standards of ethical conduct, release or disclose PHI, if the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and is able to prevent or lessen the threat.

Threat to Health or Safety Cont.

2. Memorial Hermann may also release or disclose PHI when the disclosure is necessary for law enforcement authorities to identify

• r apprehend a Patient. This disclosure is permitted because of a

statement by a Patient admitting participation in a violent crime that Memorial Hermann reasonably believes may have caused serious physical harm to the victim; or where it appears from all the circumstances that the Patient has escaped from a correctional institution or from lawful custody. However, a disclosure may not be made if the information is learned by Memorial Hermann in the course of treatment to affect the propensity to commit the criminal conduct that is the basis for the disclosure, or counseling or therapy; or through a request by the Patient to initiate or to be referred for treatment, counseling, or therapy.

Threat to Health or Safety Cont.

3. The disclosure made pursuant to this policy is limited to the specific statements related to participation in a violent crime, and to the information allowed for disclosure in the policies related to disclosures to law enforcement. (See Policy: HIPAA - Release of Protected Health Information to Law Enforcement).

Specialized Government Functions

1. Memorial Hermann may release or disclose PHI of Patients who are Armed Forces personnel for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission, as permitted by the Armed Forces under a published notice in the Federal Register which includes the appropriate military command authorities, and the purposes for which the information may be used or released. 2. Memorial Hermann may release or disclose PHI to authorized federal officials for the conduct of lawful intelligence, counter- intelligence, and other national security activities authorized by the National Security Act (50 U.S.C. 401, et seq.) and implementing authority (e.g., Executive Order 12333).

Specialized Government Functions cont.

3. Memorial Hermann may release or disclose PHI to authorized federal officials for the provision of protective services to the President or other persons authorized by 18 U.S.C. 3056, or to foreign heads of state or other persons authorized by 22 U.S.C. 2709(a)(3), or to conduct investigations authorized by 18 U.S.C. 871 and 879.

Specialized Government Functions cont.

4. Memorial Hermann may release or disclose PHI to a correctional institution or a law enforcement official having lawful custody of an inmate or other Patient information about such inmate or Patient, if the correctional institution or such law enforcement official represents that such information is necessary for:

a. The provision of health care to such Patients; b. The health and safety of such Patient or other inmates; c. The health and safety of the officers or employees of or others at the correctional institution; d. The health and safety of such Patients and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another; e. Law enforcement on the premises of the correctional institution; and f. The administration and maintenance of the safety, security, and good

• rder of the correctional institution.

Specialized Government Functions cont.

5. For the purposes of this policy, a Patient is no longer an inmate when released on parole, probation, supervised release, or

• therwise is no longer in lawful custody.

Memorial Hermann may release or disclose PHI as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.

Others

Memorial Hermann may release PHI: 1. To the American Red Cross for the specific purpose of fulfilling duties of the American Red Cross; 2. To a health care utilization review agent who requires PHI for utilization review; 3. To all third party payers, such as Blue Cross, Blue Shield, A Worker's Compensation Insurance carrier, health maintenance

• rganizations (HMOs) and preferred provider organizations

(PPOs) to facilitate reimbursement for health care services and supplies and/or adjudication of a claim;

Others cont.

4. To HMOs for the purpose of maintaining statistical reporting system as required by a rule adopted by a state agency or regulations adopted under the federal Health Maintenance Organization Act of 1973, as amended (42 U.S.C. §300 et seq.); and 5. To a person or entity other than the Patient or the Patient's legally authorized representative if the person or entity is requesting Directory information and the Patient has consented to be listed in the facility Directory. Memorial Hermann may not, however, release Directory information on a "No Information Patient."

Summary

There are certain circumstances under the Privacy Rule where a patient's consent and/or authorization are not required to disclose protected health information. These situations are limited and are

• utlined in the Rule.

Hospitals may use and disclose PHI without a patient's consent for purposes of patient treatment, payment for services rendered and health care operations. The major exception to the need for specific authorization for the release of protected health information is that medical care providers may release information to other providers and entities who are participating in the patient's care.

Summary

The HIPAA privacy regulations establish a minimum acceptable threshold for the use and release of a patient's health information. State and federal law and hospital policies may establish stricter standards. The Privacy Rules lists areas where a patient's protected health information may be disclosed under limited and specific circumstances. Some are listed below with examples or guidance: Required by Law See Policy - HIPAA Release of Protected Health Information to Law Enforcement. Continuum of Patient Care To a health care provider who is providing health care items and services to the patient when the request for health information is made.

Summary

Public Health Activities To a public health authority for the purpose of preventing or controlling disease, injury, or disability. To receive reports of child abuse or neglect. To track products. To enable product recalls, repairs or replacement.

Summary

Employers If the health care provided to the employee is at the request

• f the employer or to evaluate whether the employee has a

work-related injury or illness. Schools May disclose proof of immunization.

Summary

Victims of Abuse, Neglect or Domestic Violence Memorial Hermann may disclose to law enforcement or other authority if the patient is unable to agree or object due to incapacity AND the law enforcement official represents in writing that the disclosure of the protected health information is not intended to be used against the patient; and The health care provider, in his/her professional opinion, believes that the disclosure is in the patient's best interest.

Summary

Health Oversight Activities

Examples: Texas State Medical Board, Texas Health Insurance Commissioner, Medicaid Fraud Control, FDA, Texas Department

• f Insurance.

Judicial and Administrative Proceedings See Policy - HIPAA Release of Protected Health Information to Law Enforcement To Locate or Identification Purposes Limited disclosure of protected health information in order to locate a missing person, a suspect of a crime or a fugitive.

Summary

Decedents To a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. Organ Donation for organ procurement. Threat to Health or Safety If the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is able to prevent or lessen the threat.

Summary

Special Government Functions Armed Forces. Counter Intelligence and other national security. To the President of the United States. Correctional Institutions when the patient is an inmate (lawful custody). A patient is no longer an inmate when the individual is on parole, probation, or supervised release, or otherwise no longer in lawful custody.

References

Policy: HIPAA Release of Protected Health Information not requiring Consent, Authorization or Opportunity for Objection.