Module 1- HIPAA Release of Protected Health Information not - PowerPoint PPT Presentation

Module 1- HIPAA Release of Protected Health Information not requiring Consent, Authorization or Opportunity for Objection

Objectives Define the process for releasing Protected Health Information (PHI). Define the Agencies that can obtain the Protected Health Information (PHI) without patient authorization.

Policy Purpose This Policy outlines the Release of Information's and Memorial Hermann Health System's (MHHS, Memorial Hermann) responsibility related to the release of Protected Health information (PHI) that does not require a Patient's consent or Authorization, and that does not provide the Patient with an opportunity to object to a use or disclosure of PHI. Capitalized terms used but not otherwise defined shall have the meaning provided under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) implementing regulations or elsewhere in Memorial Hermann's health information policies and procedures.

Scope This policy applies to (i) Memorial Hermann Health System ("Memorial Hermann"), (ii) all facilities and entities wholly-owned by Memorial Hermann and (iii) all facilities and entities controlled and operated by Memorial Hermann.

Policy Statement Memorial Hermann Health System, generally, or the Memorial Hermann Release of Information department, specifically (collectively, Memorial Hermann), may release a Patient's Protected Health Information (PHI), without the consent or Authorization of the Patient and without providing the Patient with an opportunity to agree or object, subject to the applicable requirements of this Policy, in the following circumstances:

Definitions- Required by Law a. Law Enforcement Official is defined as "an officer or employee of any agency or authority of the United States, a State, a territory, a political subdivision of the state or territory, or an Indian tribe," who is empowered by law to: i. Investigate or conduct an official inquiry into a potential violation of law; or ii. Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

Definitions Continued b. Required by Law: a mandate contained in law that compels an entity to make a use or disclosure of Protected Health Information (PHI) and that is enforceable in a court of law. This includes but is not limited to court orders, and court-ordered warrants, subpoenas, or grand jury subpoenas. c. Legal Process: In the law enforcement context, "legal process" means a formal written demand or request. Legal process involves documents like: i. A court order; ii. A court-ordered warrant; iii. A subpoena or summons issued by a judicial officer; iv. A grand jury subpoena; and v. An administrative subpoena, summons, or investigative demand.

Definitions Continued 1. Memorial Hermann may release or disclose PHI to a federal, state, or local government agency or authority to the extent authorized or Required by Law. 2. Examples of federal government agencies or authorities include the Office of Inspector General (OIG), the Food and Drug Administration (FDA), the Federal Bureau of Investigation (FBI), a United States Attorney, the Social Security Administration, Department of Health and Human Services, Office of Civil Rights and Centers for Medicare & Medicaid Services (CMS).

Implementation Implementation: All subpoenas should be sent to the Release of Information Department located at 909 Frostwood, Houston, Texas, suite 2.2 for processing. (See Policy: HIPAA - Release of Protected Health Information to Law Enforcement).

Continuum of Care Memorial Hermann may release Patient PHI: 1. To a health care provider who is providing health care items or services to the Patient when the request for the Patient's PHI is made; 2. To a prospective health care provider for the purpose of securing the services of that health care provider as part of the Patient's continuum of care, as determined by the Patient's attending physician; and 3. To a transporting emergency medical service provider, but only for the purpose of determining the Patient's diagnosis and the outcome of the Patient's hospital admission.

Public Health Activities Memorial Hermann may release or disclose PHI for the following public health activities and purposes: 1. To a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including the reporting of disease, injury, vital events such as birth or death, and to conduct a public health surveillance, public health investigations, and public health interventions; or, at the direction of a public health authority, to an official of a foreign government agency that is acting in collaboration with a public health authority; 2. To a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect;

Public Health Activities Cont. 3. To a person subject to the jurisdiction of the FDA; 4. To report adverse events, product defects or problems, or biological product deviations; 5. To track products; 6. To enable product recalls, repairs, or replacement; or 7. To conduct post-marketing surveillance; or 8. To a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, if Memorial Hermann is authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation.

Employers Memorial Hermann may release or disclose PHI to an employer, about a Patient who is a member of the workforce of the employer, if: 1. Memorial Hermann provides health care to a Patient at the request of the employer; or conducts an evaluation relating to medical surveillance of the workplace; or to evaluate whether the Patient has a work-related illness or injury; 2. The PHI that is released or disclosed consists of findings concerning a work-related illness or injury or a workplace-related medical surveillance;

Employers Cont. 3. The employer needs such findings in order to comply with its obligations to record such illness or injury or to carry out responsibilities for workplace medical surveillance; and 4. Memorial Hermann provides written notice to the Patient that information relating to the medical surveillance of the workplace and work-related illnesses and injuries is to be released to the employer by giving a copy of the notice to the Patient at the time the health care is provided; or if the health care is provided on the work site of the employer, by posting the notice in a prominent place at the location where the health care is provided.

Schools Memorial Hermann may release or disclose PHI to a school about an individual who is a student or prospective student of the school, if: 1. The PHI that is disclosed is limited to proof of immunization; 2. The school is required by law to have proof of immunization prior to admitting the student; and 3. Memorial Hermann obtains and documents the agreement to the disclosure from either: a. A parent, guardian or other person acting in loco parentis of the individual, if the individual is an unemancipated minor; or b. The individual, if the individual is an adult or emancipated minor.

Victims of Abuse, Neglect or Domestic Violence 1. Memorial Hermann may release or disclose PHI about a Patient whom the organization reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, if the disclosure is expressly authorized or Required by Law, the Patient agrees to the disclosure, or the organization believes the disclosure is necessary to prevent serious harm to the Patient or other potential victims.

Victims of Abuse, Neglect or Domestic Violence Cont. 2. If the Patient is unable to agree because of incapacity, a law enforcement or other public official authorized to receive the report represents, in writing, that the information for which disclosure is sought is not intended to be used against the Patient and that an immediate enforcement activity that depends upon the disclosure would be adversely affected by waiting for the Patient to agree to the disclosure. 3. When a disclosure of this nature is made, the department will promptly inform the Patient that such a report has been or will be made, except if informing the Patient would place the Patient at risk of serious harm; or the organization would be informing a personal representative, and the organization reasonably believes the personal representative is responsible for the abuse, neglect, or other injury, and that informing such person would not be in the best interest of the Patient. (See Policy: HIPAA - Release of Protected Health Information to Law Enforcement).

Health Oversight Activities Health Oversight agency includes a federal, state, or local government agency authorized by law to oversee the public and private health care system or government programs on which health information is necessary for determining eligibility or compliance, or to enforce civil rights laws for which health information is relevant. The definition includes the employees, agents, contractors, persons or entities acting under a grant of authority of such public agency.