Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
RIVER HILLS COMMUNITY HEALTH CENTER POLICY ON RELEASE OF INFORMATION Submitted by: Curt Meeks, CO Policy # Approved By: Policy Supersedes: Date: Revised/Reviewed: Policy It shall be the policy of River Hills CHC that the release of medical information will be permitted only in accordance with the legal requirements governing the release of medical information as outlined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy and security regulations, other federal or state statutory and regulatory provisions and as provided in this policy. Purpose The purpose of this policy is to comply with the HIPAA Privacy Rule and HIPAA Security Rule’s requirements pertaining to the acceptable use of River Hills CHC IT resources regarding protected health information (PHI) and electronic protected health information (EPHI). River Hills CHC policies regarding privacy and security of PHI/EPHI reflect its commitment to protecting the confidentiality of patients’ medical records, patient accounts, clinical information from management information systems, confidential conversations, and any other sensitive material as a result of doing business. While a commitment to privacy and security of PHI/EPHI is the expectation, there remains a possibility that an inappropriate or unintended disclosure of PHI/EPHI may result in a privacy breach. This policy outlines the procedure to mitigate breaches, both willful violations and unintended actions, consistent with guidance described by the HIPAA and HITECH laws. Overview River Hills CHC’s intention for publishing this HIPAA Release of Information Policy is not to impose restrictions that are contrary to River Hills CHC’s established culture of openness, trust and integrity. River Hills CHC is committed to protecting employees, patients, partners and itself from illegal or damaging actions by individuals, either knowingly or unknowingly. Effective HIPAA security is a team effort involving the participation and support of every River Hills CHC employee and affiliate that interacts with information and/or information systems. It is the responsibility of every computer user to know these guidelines, and to conduct their activities accordingly. Any time that protected health information (PHI) is referenced in this policy, it is referencing the HIPAA Privacy Rule; when electronic protected health information (EPHI) is referenced in this policy, it is referencing the HIPAA Security Rule. Scope This policy applies organization-wide. Definitions 1. Emancipated Minor. The determination of whether a minor is emancipated is based on local guidelines that each unit/department must follow. Such criteria include whether the minor has been adjudicated/emancipated by a governmental agency or through a judicial proceeding, whether the minor is/has been married, if the minor is/has been pregnant, or if the minor is actively serving in the military 2. Non-confidential PHI shall mean patient name, verification that patient was or is treated at a River Hills CHC facility, patient’s admission or discharge dates (cannot release both), name of patient’s attending physician. 3. Subpoena shall mean a legal document issued under the authority of the court, which directs the attendance of a witness at a trial to give testimony. 4. Subpoena Duces Tecum shall mean a subpoena that requests specific records or documents be provided to the court. General Guidance 1. Protected Health Information (PHI) identified as the property of River Hills CHC is subject to release under the terms of this policy and in compliance with all related regulations. 2. Patients have the right to amend the information contained in their PHI. Amended information will be considered a part of the PHI, and therefore will be released through any valid authorization process. 3. Any suspected privacy violation or related complaints shall be handled in accordance with HIPAA Complaint Procedure for PHI. 4. All disclosures of PHI shall be limited to the amount reasonably necessary to achieve the purpose of the disclosure. 5. River Hills CHC shall be entitled to rely (if reasonable under the circumstances) on a requested disclosure as the minimum necessary for the stated purpose when: Page 2 of 12 5.1 Making permitted disclosures to public officials if such official represents that the information requested is the minimum necessary. 5.2 The information is requested by another covered entity. 5.3 The information is requested by a licensed provider or business associate for the purpose of providing professional services to River Hills CHC provided they represent the information being requested is the minimum necessary. Statement to Accompany all Disclosures of PHI 1. This information has been disclosed to you from records whose confidentiality is protected by state and federal law. Federal regulations (45 CFR Part 2) prohibit you from making any further disclosure of this information without the specific written authorization of the person to whom it pertains or as otherwise permitted by such regulations. A general authorization for the release of medical or other information is not sufficient for this purpose. Additional Statement to Accompany all Disclosures of Sensitive PHI - Drug and Alcohol, HIV and Behavioral Health PHI 1. Drug/Alcohol/Behavioral Health-This information has been disclosed to you from records protected by state and federal law (42 CFR Part 2). State and federal laws prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written authorization of the person to whom it pertains. A general authorization for the release of medical or other information is not sufficient for this purpose. The federal rules restrict any use of drug and/or alcohol information to criminally investigate or prosecute any alcohol or drug abuse case. 2. HIV - This information has been disclosed to you from records protected by state and federal law. State and federal laws prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written authorization of the person to whom it pertains or is authorized by the confidentiality of HIV-related information act. A general authorization for the release of medical or other information is not sufficient for this purpose. Authorizations 1. A valid authorization must include, at a minimum: 1.1 The patient’s full name at the time of treatment 1.2 Identification information (i.e., date of birth, social security number, medical record number) 1.3 Specific purpose of the disclosure 1.4 The unit/department in which the encounter occurred 1.5 The name of the person, company or agency to whom the information is to be released 1.6 Dates of treatment Page 3 of 12 1.7 Authorizations are valid for 90-days from date of signature unless otherwise noted by the patient but not to exceed one year 1.8 The exact information to be released must be specified, including the type of information such as behavioral health, drug and alcohol, and HIV 1.9 Be signed and dated by the patient or their legal representative. When legal representation is utilized, a description of the representative’s name and authority to act on behalf of the patient must be included 1.10 Revocation statement that explains the procedure to effect such revocation 1.11 Statement to notify authenticator of River Hills CHC release of liability for subsequent re-disclosures Special Authorization Requirements 1. Deceased Patients 1.1 If an Authorization for Release of Protected Health Information form or letter is received regarding a deceased patient, it must be signed by the administrator or executor of the decedent’s estate or the person who is listed as next of kin. A copy of the court order appointing the administrator or executor must also accompany the form or letter. 2. Incapacitated/Guardian Appointed Patients 2.1 If an Authorization for Release of Protected Health Information form or letter is received regarding a patient who is unable to approve the release of their information, it should be signed by a properly designated surrogate or legally appointed guardian. 3. Minors 3.1 If a signed Authorization for Release of Protected Health Information form or letter is received regarding a patient who is not an emancipated minor, it should be signed by their parent or legal guardian who is serving as their legal representative. 3.2 Despite divorce proceedings or an actual divorce, either parent may be provided access to the PHI unless otherwise noted by court order. Legal counsel should be consulted if there are concerns about the purpose of the request or if providing such access is not in the child’s best interest. 4. Minors -Pregnancy, Contraception, or Sexually Transmitted Disease. 4.1 Minors can give authorization to treatment and/or release of information for detection or treatment of pregnancy, sexually transmitted disease, or any other reportable condition. Page 4 of 12 Release of PHI without an Authorization 1. Information may be released by River Hills CHC without an authorization in the following circumstances. 1.1 For the purpose of conducting treatment, payment and healthcare operations. 1.2 Direct transfer of the patient to the care of the patient-designated treating physician. 1.3 To River Hills CHC provider entities which are affiliated covered entities 1.4 True health care emergencies in which the need to know clearly outweighs confidentiality considerations. 1.5 Unusual, rare circumstances where serving the common good outweighs confidentiality considerations. Such requests may not be processed without the permission of the Compliance Officer and/or legal counsel. 1.6 Licensure, accreditation, audits and other oversight activities by or in compliance with federal or state regulations, Health Care Cost Containment Council, TJC and other accrediting agencies and contracted entities. 1.7 Pursuant to federal, state or local mandatory reporting requirements. Copies of Authorizations 1. Copies of signed authorizations shall be provided to the patient upon request. Patient Access 1. A patient or their designee (including their legal representative) has the right to access the information contained in their medical record in accordance with these guidelines. If a patient is denied access to all or part of their medical record, this fact and the basis for the denial shall be noted in the patient’s record. Release of Information Requests 1. Insurance Companies for Non-Payment Purposes - Without a valid authorization, only non-confidential information may be released to insurance companies to verify treatment or visit dates. Under no circumstances will any diagnostic information be released without a valid authorization. 2. Regulatory Agencies defined as those with Governmental or Municipal operational interest in care delivery but may not be direct processors of health care claims. Such agencies include, but are not limited to, The Joint Commission, American Osteopathic Association, and Centers for Medicare/Medicaid Services and World Health Organization. 3. Third Party Payers/Fiscal Intermediaries - The reviews of Medicare and medical assistance admissions are initiated by federal and state organizations and do not require Page 5 of 12 an authorization. Authorizations for release of information to third party payers for the purpose of reimbursement are signed at the time of admission. These authorizations are valid for all confidential information. 4. Employers - All PHI released to employers will require a valid authorization except in the case of Workers’ Compensation. 5. Workers’ Compensation - The Workers’ Compensation Law permits the employer to be furnished with, or have made available to it, the parts of the medical record of the employee who has received medical, surgical or hospitalization services under the Workers’ Compensation statute without a patient authorization. 6. Employees - No employee medical information or family medical information will be released to a River Hills CHC employee without a valid authorization. 7. Government Agencies/Public Health - Government agencies are not entitled to confidential information unless specifically authorized by law such as in the case of those regulations governing, but not limited to, those identified below. 7.1 Child and elder protective service laws require reporting to the state agency. 7.2 Communicable diseases. 7.3 Registries reporting laws require reporting to the government agencies. 7.4 Criminally inflicted injuries require reporting to local police departments. 7.5 Sudden, violent and suspicious deaths where cause cannot be identified are to be reported to the local coroner 8. Attorneys - Except for legal activities undertaken by River Hills CHC, requests for PHI will require a valid authorization. 9. Law Enforcement Officials –Generally, confidential information will not be released to any law enforcement official unless a valid authorization is present or a court order or search warrant has been obtained. 9.1 Criminally inflicted injuries require reporting to local police departments and do not require valid authorization. 9.2 Blood alcohol levels requested by law enforcement officials with the proper certification mentioned above will be released upon request without the written authorization of the patient. 9.3 Blood alcohol levels requested by the physician for medical purposes may be released to law enforcement agents upon receipt of the patient’s signed authorization or a search warrant. 10. Court Order, Subpoena/Subpoena Duces Tecum, and Search Warrant 10.1 Court Order - A court order presented for the release of information is a certified, legal document and must include the following: Page 6 of 12 10.1.1 10.1.2 10.1.3 10.1.4 10.1.5 10.1.6 10.1.7 10.1.8 10.1.9 Case name and docket number Date issued Specific items to be released Time frame in which items are to be produced Issuing court identification Signature of issuing judge Where a copy of the court order is provided, the original seal must be affixed and documentation of such observation must be noted Patient authorization is not required. All requested information must be released, regardless of whether it contains sensitive information or not. A copy of the original subpoena must be placed in the medical record for tracking purposes 11. Subpoena/Subpoena Duces Tecum - A valid subpoena will contain at least the following information: 11.1 11.2 11.3 11.4 11.5 11.6 11.7 The name of the individual or organization to whom the subpoena is issued The location, including when/where the witness is to appear, if required Specific items to be produced/released Date of issuance of the subpoena The signature of a judge or coroner The seal of the court When a copy of the subpoena is served, the server must present the original subpoena with raised seal for verification 11.8 The case name and docket number A valid subpoena does not require an authorization. However, in cases of behavioral health, whenever a patient’s records are subpoenaed in a court proceeding and the patient has not authorized the release of such records, an additional court order shall be obtained prior to releasing any such records. Out-of-state subpoenas will not be honored without a valid patient authorization Exception: this rule does not apply to a Subpoena Duces Tecum 12. Search Warrant 12.1 A search warrant is served personally by a law enforcement officer 12.2 The official’s identity must be verified with a badge and government issued identification before information may be released 12.3 The law enforcement official must state who they are, what authority they have under the warrant, and show proof of the warrant in order to receive information 12.4 Consult with River Hills CHC legal counsel for processing all search warrants 12.5 Patient authorization is not required to comply with a valid search warrant Page 7 of 12 13. Subpoena, Discovery Requests and Lawful Processes 13.1 PHI can be disclosed in response to subpoenas, discovery requests or other lawful processes, that are not accompanied by a court order, if River Hills receives satisfactory assurance from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the PHI has been given notice of the request. 14. Media - No disclosure of PHI shall be made to the media. If the media requests such information or disclosure of PHI, they shall be directed to River Hills CHC legal counsel. 15. Coroners, Medical Examiners and Funeral Directors 15.1 PHI can be released to a coroner or medical examiner as needed to identify a deceased person or to determine a cause of death. PHI may also be released to funeral directors, as necessary, so they can carry out their duties. 16. Threats to Health or Safety 16.1 PHI can be used and disclosed when necessary to prevent a serious threat to the health or safety of a person or to the public. However, the PHI disclosed shall only be disclosed to someone able to help prevent the threat. 17. Military and Veterans 17.1 PHI of members of the armed forces can be released as military authorities require. PHI can also be released about foreign military personnel to a foreign military authority. 18. Organ and Tissue Donation 18.1 PHI may be released to organizations that procure organs or tissue, handle organ or tissue transplants or bank organs or tissues. 19. National Security and Intelligence 19.1 PHI may be released to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law. 20. Protective Services for President and Others 20.1 PHI may be disclosed to authorized federal officials in order to protect the President of the U.S., other authorized persons, foreign heads of state or to conduct special investigations. Page 8 of 12 21. Inmates 21.1 PHI may be released about an inmate of a correctional institution or under the custody of a law enforcement official to such institution or official: 21.1.1 For the institution to provide the individual with health care. 21.1.2 To protect the individual’s or another individual’s health and safety. 21.1.3 For the safety and security of the correctional institution Sensitive Information Requests 1. Drug and Alcohol Abuse Information 1.1 All information pertinent to drug and alcohol abuse will be treated as highly confidential and shall not be disclosed without a valid authorization 1.2 With a valid authorization, this information shall only be released to medical personnel for treatment and diagnosis purposes of the patient or to government or other officials exclusively for the purposes of obtaining benefits for the patient 1.3 PHI may be released without the patient’s authorization in extreme emergency situations, to proper medical authorities solely for the purpose of providing medical treatment to the patient and pursuant to a court order upon a showing of good cause. If the patient’s life is in immediate jeopardy, information pertaining to the treatment of the patient may be released to the treating physician. In any such instance, the Privacy Officer or legal counsel must be consulted before the release is made. 2. Behavioral Health (also referred to as “Mental Health”) Information 2.1 Behavioral Health for purposes of this policy will consist of ANY licensed provider that documents as a final diagnosis a behavioral health diagnosis code for the visit. Medical symptoms as diagnoses will not be considered behavioral health nor will notations of ruling out a behavioral health condition. 2.2 All information pertinent to behavioral health will be treated as highly confidential. 2.3 A patient treated or being treated has the right to access his or her treatment records unless: 2.3.1 Upon documentation by the treatment team, it is determined that disclosure of the documents concerning treatment will constitute a substantial detriment to the patient. Page 9 of 12 2.3.2 2.3.3 Disclosure of the documents will reveal the identity of persons or breach the trust or confidentiality of persons who have provided information on an agreement to remain anonymous. The patient who is less than 14 years of age or has been adjudicated legally incompetent. In such cases, control of the release of medical information shall be exercised by a parent or legal guardian. A minor patient, 14 years of age or older, who understands the nature and purpose of the information being released will control the release of their records. A behavioral health patient, age 14 or older, may authorize the release of records. 2.4 The records of individuals engaged in treatment may be released without authorization for the following reasons: 2.4.1 2.4.2 2.4.3 2.4.4 2.4.5 2.4.6 2.4.7 2.4.8 2.4.9 2.4.10 2.4.11 2.4.12 2.4.13 2.4.14 To provide continuity of care and treatment. For commitment hearing proceedings. To the court in the course of legal proceedings for involuntary treatment or evaluation. In response to a court order, when production of the documents is ordered by a court. For mandatory reporting of child/patient abuse, neglect or violence. Licensure, certification, and re-credentialing of the behavioral health program. The Department of Public Welfare requires the records. In response to an emergency medical situation or when required to prevent serious bodily harm. Legal defense (attorneys) at the client’s commitment hearing. To defense counsel when River Hills CHC personnel are sued for malpractice by patients. Third party reimbursement only to the extent authorized in the regulation. Pursuant to federal rules where treatment is undertaken in a federal agency. To those participating in utilization reviews. To parents or guardians and others when necessary to obtain authorization to medical treatment These excepted disclosures shall be limited to that information which is relevant and necessary for the purposes for which the information is sought. 3. HIV Information 3.1 HIV-related information is any information concerning whether an individual has been the subject of an HIV-related test, or has HIV, HIV-related illness or AIDS; or any information which identifies or reasonably could identify an individual as Page 10 of 12 having one of these conditions, including information pertaining to the individual’s contacts. 3.2 A valid authorization will be required for the release of all HIV-related information except for the following: 3.2.1 3.2.2 3.2.3 3.2.4 3.2.5 3.2.6 3.2.7 3.2.8 3.2.9 3.2.10 3.2.11 3.2.12 3.2.13 The attending physician or their designee An agent, employee or medical staff member involved in the care of the patient Health care providers when knowledge of the condition is necessary to provide emergency care or treatment To the patient To known contacts A funeral director Approved accrediting, licensure and peer review agencies or organizations Third party payers, to the extent necessary for reimbursement The Department of Health for purpose of vital statistics processing The Department of Health as required for reportable diseases and conditions Any individual in possession of a court order or search warrant To AIDS reporting To residential placement of children 4. Adoption Information 4.1 A valid authorization will be required for the release of confidential information. 4.2 Requests by adoptees for records relating to the identity of biological parents will be referred to Iowa’s Department of Public Health, Bureau of Health Statistics. 4.3 The medical history and other material relevant to the adoptee’s health care may be provided to the adopting parents. The request must be reviewed and approved by the Medical Director. 4.4 All data that could identify the adoptee’s natural parents will be deleted. The information to be released will be prepared by River Hills CHC personnel and reviewed and approved by the Medical Director as a safeguard of the protection of this potentially identifiable information. 5. Child Or Elder Abuse Information 5.1 Child Abuse Cases 5.1.1 In cases where the parents request access to or information from a minor’s record and the case involves known or suspected child abuse, Page 11 of 12 River Hills CHC personnel will refer the matter to legal counsel for review and response. 5.1.2 Information pertaining to child abuse reporting and treatment is considered confidential and can be released in limited circumstances, including: a. b. c. d. To the physician examining or treating the patient To such persons specifically designated within an institution As required due to reporting requirements To protect children from abuse, the reporting requirements take precedence over professional responsibilities and any other client confidentiality, ethical principles or professional standards that might otherwise apply. 6. Older Adults Abuse Cases 6.1 In cases where the adult, children, or guardian request access to or information from a record and the case involves known or suspected older adult abuse, River Hills CHC personnel will refer the matter to legal counsel for review and response. 6.2 Informing the Individual 6.2.1 For any disclosures made by River Hills CHC in connection with this section on abuse, River Hills CHC shall promptly inform the individual that such a report has been or will be made, except if: a. River Hills CHC believes informing the individual would place the individual at risk of serious harm. b. River Hills CHC would be informing a personal representative and reasonably believes such representative is responsible for the abuse and that informing such person would not be in the best interest of the individual. 7. Enforcement. Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. 8. Reference(s) 8.1 Health Insurance Portability and Accountability Act of 1996 (HIPAA) at 45 C.F.R. § 164.308; § 164.530. 8.2 The American Recovery and Reinvestment Act of 2009 (ARRA) Division A, Title XIII, Part 2, Subtitle D-Privacy Sec. 13400; Sec. 13402 of the HITECH Act 8.3 HIPAA Complaint Procedure for PHI policy. Page 12 of 12