Download Release of Information Policy

RIVER HILLS COMMUNITY HEALTH CENTER
POLICY
ON
RELEASE OF INFORMATION
Submitted by: Curt Meeks, CO
Policy #
Approved By:
Policy Supersedes:
Date:
Revised/Reviewed:
Policy
It shall be the policy of River Hills CHC that the release of medical information will be
permitted only in accordance with the legal requirements governing the release of medical
information as outlined in the Health Insurance Portability and Accountability Act of 1996
(HIPAA) privacy and security regulations, other federal or state statutory and regulatory
provisions and as provided in this policy.
Purpose
The purpose of this policy is to comply with the HIPAA Privacy Rule and HIPAA Security
Rule’s requirements pertaining to the acceptable use of River Hills CHC IT resources regarding
protected health information (PHI) and electronic protected health information (EPHI).
River Hills CHC policies regarding privacy and security of PHI/EPHI reflect its commitment to
protecting the confidentiality of patients’ medical records, patient accounts, clinical information
from management information systems, confidential conversations, and any other sensitive
material as a result of doing business. While a commitment to privacy and security of PHI/EPHI
is the expectation, there remains a possibility that an inappropriate or unintended disclosure of
PHI/EPHI may result in a privacy breach. This policy outlines the procedure to mitigate
breaches, both willful violations and unintended actions, consistent with guidance described by
the HIPAA and HITECH laws.
Overview
River Hills CHC’s intention for publishing this HIPAA Release of Information Policy is not to
impose restrictions that are contrary to River Hills CHC’s established culture of openness, trust
and integrity. River Hills CHC is committed to protecting employees, patients, partners and
itself from illegal or damaging actions by individuals, either knowingly or unknowingly.
Effective HIPAA security is a team effort involving the participation and support of every River
Hills CHC employee and affiliate that interacts with information and/or information systems. It
is the responsibility of every computer user to know these guidelines, and to conduct their
activities accordingly.
Any time that protected health information (PHI) is referenced in this policy, it is referencing the
HIPAA Privacy Rule; when electronic protected health information (EPHI) is referenced in this
policy, it is referencing the HIPAA Security Rule.
Scope
This policy applies organization-wide.
Definitions
1. Emancipated Minor. The determination of whether a minor is emancipated is based on
local guidelines that each unit/department must follow. Such criteria include whether the
minor has been adjudicated/emancipated by a governmental agency or through a judicial
proceeding, whether the minor is/has been married, if the minor is/has been pregnant, or
if the minor is actively serving in the military
2. Non-confidential PHI shall mean patient name, verification that patient was or is treated
at a River Hills CHC facility, patient’s admission or discharge dates (cannot release
both), name of patient’s attending physician.
3. Subpoena shall mean a legal document issued under the authority of the court, which
directs the attendance of a witness at a trial to give testimony.
4. Subpoena Duces Tecum shall mean a subpoena that requests specific records or
documents be provided to the court.
General Guidance
1. Protected Health Information (PHI) identified as the property of River Hills CHC is
subject to release under the terms of this policy and in compliance with all related
regulations.
2. Patients have the right to amend the information contained in their PHI. Amended
information will be considered a part of the PHI, and therefore will be released through
any valid authorization process.
3. Any suspected privacy violation or related complaints shall be handled in accordance
with HIPAA Complaint Procedure for PHI.
4. All disclosures of PHI shall be limited to the amount reasonably necessary to achieve the
purpose of the disclosure.
5. River Hills CHC shall be entitled to rely (if reasonable under the circumstances) on a
requested disclosure as the minimum necessary for the stated purpose when:
Page 2 of 12
5.1 Making permitted disclosures to public officials if such official represents that the
information requested is the minimum necessary.
5.2 The information is requested by another covered entity.
5.3 The information is requested by a licensed provider or business associate for the
purpose of providing professional services to River Hills CHC provided they
represent the information being requested is the minimum necessary.
Statement to Accompany all Disclosures of PHI
1. This information has been disclosed to you from records whose confidentiality is
protected by state and federal law. Federal regulations (45 CFR Part 2) prohibit you from
making any further disclosure of this information without the specific written
authorization of the person to whom it pertains or as otherwise permitted by such
regulations. A general authorization for the release of medical or other information is not
sufficient for this purpose.
Additional Statement to Accompany all Disclosures of Sensitive PHI - Drug and Alcohol, HIV
and Behavioral Health PHI
1. Drug/Alcohol/Behavioral Health-This information has been disclosed to you from
records protected by state and federal law (42 CFR Part 2). State and federal laws
prohibit you from making any further disclosure of this information unless further
disclosure is expressly permitted by the written authorization of the person to whom it
pertains. A general authorization for the release of medical or other information is not
sufficient for this purpose. The federal rules restrict any use of drug and/or alcohol
information to criminally investigate or prosecute any alcohol or drug abuse case.
2. HIV - This information has been disclosed to you from records protected by state and
federal law. State and federal laws prohibit you from making any further disclosure of
this information unless further disclosure is expressly permitted by the written
authorization of the person to whom it pertains or is authorized by the confidentiality of
HIV-related information act. A general authorization for the release of medical or other
information is not sufficient for this purpose.
Authorizations
1. A valid authorization must include, at a minimum:
1.1 The patient’s full name at the time of treatment
1.2 Identification information (i.e., date of birth, social security number, medical
record number)
1.3 Specific purpose of the disclosure
1.4 The unit/department in which the encounter occurred
1.5 The name of the person, company or agency to whom the information is to be
released
1.6 Dates of treatment
Page 3 of 12
1.7 Authorizations are valid for 90-days from date of signature unless otherwise noted
by the patient but not to exceed one year
1.8 The exact information to be released must be specified, including the type of
information such as behavioral health, drug and alcohol, and HIV
1.9 Be signed and dated by the patient or their legal representative. When legal
representation is utilized, a description of the representative’s name and authority
to act on behalf of the patient must be included
1.10 Revocation statement that explains the procedure to effect such revocation
1.11 Statement to notify authenticator of River Hills CHC release of liability for
subsequent re-disclosures
Special Authorization Requirements
1. Deceased Patients
1.1 If an Authorization for Release of Protected Health Information form or letter is
received regarding a deceased patient, it must be signed by the administrator or
executor of the decedent’s estate or the person who is listed as next of kin. A
copy of the court order appointing the administrator or executor must also
accompany the form or letter.
2. Incapacitated/Guardian Appointed Patients
2.1 If an Authorization for Release of Protected Health Information form or letter is
received regarding a patient who is unable to approve the release of their
information, it should be signed by a properly designated surrogate or legally
appointed guardian.
3. Minors
3.1 If a signed Authorization for Release of Protected Health Information form or
letter is received regarding a patient who is not an emancipated minor, it should
be signed by their parent or legal guardian who is serving as their legal
representative.
3.2 Despite divorce proceedings or an actual divorce, either parent may be provided
access to the PHI unless otherwise noted by court order. Legal counsel should be
consulted if there are concerns about the purpose of the request or if providing
such access is not in the child’s best interest.
4. Minors -Pregnancy, Contraception, or Sexually Transmitted Disease.
4.1 Minors can give authorization to treatment and/or release of information for
detection or treatment of pregnancy, sexually transmitted disease, or any other
reportable condition.
Page 4 of 12
Release of PHI without an Authorization
1. Information may be released by River Hills CHC without an authorization in the
following circumstances.
1.1 For the purpose of conducting treatment, payment and healthcare operations.
1.2 Direct transfer of the patient to the care of the patient-designated treating
physician.
1.3 To River Hills CHC provider entities which are affiliated covered entities
1.4 True health care emergencies in which the need to know clearly outweighs
confidentiality considerations.
1.5 Unusual, rare circumstances where serving the common good outweighs
confidentiality considerations. Such requests may not be processed without the
permission of the Compliance Officer and/or legal counsel.
1.6 Licensure, accreditation, audits and other oversight activities by or in compliance
with federal or state regulations, Health Care Cost Containment Council, TJC and
other accrediting agencies and contracted entities.
1.7 Pursuant to federal, state or local mandatory reporting requirements.
Copies of Authorizations
1. Copies of signed authorizations shall be provided to the patient upon request.
Patient Access
1. A patient or their designee (including their legal representative) has the right to access the
information contained in their medical record in accordance with these guidelines. If a
patient is denied access to all or part of their medical record, this fact and the basis for the
denial shall be noted in the patient’s record.
Release of Information Requests
1. Insurance Companies for Non-Payment Purposes - Without a valid authorization, only
non-confidential information may be released to insurance companies to verify treatment
or visit dates. Under no circumstances will any diagnostic information be released
without a valid authorization.
2. Regulatory Agencies defined as those with Governmental or Municipal operational
interest in care delivery but may not be direct processors of health care claims. Such
agencies include, but are not limited to, The Joint Commission, American Osteopathic
Association, and Centers for Medicare/Medicaid Services and World Health
Organization.
3. Third Party Payers/Fiscal Intermediaries - The reviews of Medicare and medical
assistance admissions are initiated by federal and state organizations and do not require
Page 5 of 12
an authorization. Authorizations for release of information to third party payers for the
purpose of reimbursement are signed at the time of admission. These authorizations are
valid for all confidential information.
4. Employers - All PHI released to employers will require a valid authorization except in the
case of Workers’ Compensation.
5. Workers’ Compensation - The Workers’ Compensation Law permits the employer to be
furnished with, or have made available to it, the parts of the medical record of the
employee who has received medical, surgical or hospitalization services under the
Workers’ Compensation statute without a patient authorization.
6. Employees - No employee medical information or family medical information will be
released to a River Hills CHC employee without a valid authorization.
7. Government Agencies/Public Health - Government agencies are not entitled to
confidential information unless specifically authorized by law such as in the case of those
regulations governing, but not limited to, those identified below.
7.1 Child and elder protective service laws require reporting to the state agency.
7.2 Communicable diseases.
7.3 Registries reporting laws require reporting to the government agencies.
7.4 Criminally inflicted injuries require reporting to local police departments.
7.5 Sudden, violent and suspicious deaths where cause cannot be identified are to be
reported to the local coroner
8. Attorneys - Except for legal activities undertaken by River Hills CHC, requests for PHI
will require a valid authorization.
9. Law Enforcement Officials –Generally, confidential information will not be released to
any law enforcement official unless a valid authorization is present or a court order or
search warrant has been obtained.
9.1 Criminally inflicted injuries require reporting to local police departments and do
not require valid authorization.
9.2 Blood alcohol levels requested by law enforcement officials with the proper
certification mentioned above will be released upon request without the written
authorization of the patient.
9.3 Blood alcohol levels requested by the physician for medical purposes may be
released to law enforcement agents upon receipt of the patient’s signed
authorization or a search warrant.
10. Court Order, Subpoena/Subpoena Duces Tecum, and Search Warrant
10.1 Court Order - A court order presented for the release of information is a
certified, legal document and must include the following:
Page 6 of 12
10.1.1
10.1.2
10.1.3
10.1.4
10.1.5
10.1.6
10.1.7
10.1.8
10.1.9
Case name and docket number
Date issued
Specific items to be released
Time frame in which items are to be produced
Issuing court identification
Signature of issuing judge
Where a copy of the court order is provided, the original seal must
be affixed and documentation of such observation must be noted
Patient authorization is not required. All requested information
must be released, regardless of whether it contains sensitive
information or not.
A copy of the original subpoena must be placed in the medical
record for tracking purposes
11. Subpoena/Subpoena Duces Tecum - A valid subpoena will contain at least the following
information:
11.1
11.2
11.3
11.4
11.5
11.6
11.7
The name of the individual or organization to whom the subpoena is issued
The location, including when/where the witness is to appear, if required
Specific items to be produced/released
Date of issuance of the subpoena
The signature of a judge or coroner
The seal of the court
When a copy of the subpoena is served, the server must present the original
subpoena with raised seal for verification
11.8 The case name and docket number
A valid subpoena does not require an authorization. However, in cases of behavioral
health, whenever a patient’s records are subpoenaed in a court proceeding and the patient
has not authorized the release of such records, an additional court order shall be obtained
prior to releasing any such records.
Out-of-state subpoenas will not be honored without a valid patient authorization
Exception: this rule does not apply to a Subpoena Duces Tecum
12. Search Warrant
12.1 A search warrant is served personally by a law enforcement officer
12.2 The official’s identity must be verified with a badge and government issued
identification before information may be released
12.3 The law enforcement official must state who they are, what authority they have
under the warrant, and show proof of the warrant in order to receive information
12.4 Consult with River Hills CHC legal counsel for processing all search warrants
12.5 Patient authorization is not required to comply with a valid search warrant
Page 7 of 12
13. Subpoena, Discovery Requests and Lawful Processes
13.1 PHI can be disclosed in response to subpoenas, discovery requests or other
lawful processes, that are not accompanied by a court order, if River Hills
receives satisfactory assurance from the party seeking the information that
reasonable efforts have been made by such party to ensure that the individual
who is the subject of the PHI has been given notice of the request.
14. Media - No disclosure of PHI shall be made to the media. If the media requests such
information or disclosure of PHI, they shall be directed to River Hills CHC legal counsel.
15. Coroners, Medical Examiners and Funeral Directors
15.1 PHI can be released to a coroner or medical examiner as needed to identify a
deceased person or to determine a cause of death. PHI may also be released to
funeral directors, as necessary, so they can carry out their duties.
16. Threats to Health or Safety
16.1 PHI can be used and disclosed when necessary to prevent a serious threat to the
health or safety of a person or to the public. However, the PHI disclosed shall
only be disclosed to someone able to help prevent the threat.
17. Military and Veterans
17.1 PHI of members of the armed forces can be released as military authorities
require. PHI can also be released about foreign military personnel to a foreign
military authority.
18. Organ and Tissue Donation
18.1 PHI may be released to organizations that procure organs or tissue, handle organ
or tissue transplants or bank organs or tissues.
19. National Security and Intelligence
19.1 PHI may be released to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law.
20. Protective Services for President and Others
20.1 PHI may be disclosed to authorized federal officials in order to protect the
President of the U.S., other authorized persons, foreign heads of state or to
conduct special investigations.
Page 8 of 12
21. Inmates
21.1 PHI may be released about an inmate of a correctional institution or under the
custody of a law enforcement official to such institution or official:
21.1.1 For the institution to provide the individual with health care.
21.1.2 To protect the individual’s or another individual’s health and safety.
21.1.3 For the safety and security of the correctional institution
Sensitive Information Requests
1. Drug and Alcohol Abuse Information
1.1 All information pertinent to drug and alcohol abuse will be treated as highly
confidential and shall not be disclosed without a valid authorization
1.2 With a valid authorization, this information shall only be released to medical
personnel for treatment and diagnosis purposes of the patient or to government or
other officials exclusively for the purposes of obtaining benefits for the patient
1.3 PHI may be released without the patient’s authorization in extreme emergency
situations, to proper medical authorities solely for the purpose of providing
medical treatment to the patient and pursuant to a court order upon a showing of
good cause. If the patient’s life is in immediate jeopardy, information pertaining
to the treatment of the patient may be released to the treating physician. In any
such instance, the Privacy Officer or legal counsel must be consulted before the
release is made.
2. Behavioral Health (also referred to as “Mental Health”) Information
2.1 Behavioral Health for purposes of this policy will consist of ANY licensed
provider that documents as a final diagnosis a behavioral health diagnosis code
for the visit. Medical symptoms as diagnoses will not be considered behavioral
health nor will notations of ruling out a behavioral health condition.
2.2 All information pertinent to behavioral health will be treated as highly
confidential.
2.3 A patient treated or being treated has the right to access his or her treatment
records unless:
2.3.1
Upon documentation by the treatment team, it is determined that
disclosure of the documents concerning treatment will constitute a
substantial detriment to the patient.
Page 9 of 12
2.3.2
2.3.3
Disclosure of the documents will reveal the identity of persons or
breach the trust or confidentiality of persons who have provided
information on an agreement to remain anonymous.
The patient who is less than 14 years of age or has been adjudicated
legally incompetent. In such cases, control of the release of medical
information shall be exercised by a parent or legal guardian. A minor
patient, 14 years of age or older, who understands the nature and
purpose of the information being released will control the release of
their records. A behavioral health patient, age 14 or older, may
authorize the release of records.
2.4 The records of individuals engaged in treatment may be released without
authorization for the following reasons:
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.4.9
2.4.10
2.4.11
2.4.12
2.4.13
2.4.14
To provide continuity of care and treatment.
For commitment hearing proceedings.
To the court in the course of legal proceedings for involuntary
treatment or evaluation.
In response to a court order, when production of the documents is
ordered by a court.
For mandatory reporting of child/patient abuse, neglect or violence.
Licensure, certification, and re-credentialing of the behavioral health
program.
The Department of Public Welfare requires the records.
In response to an emergency medical situation or when required to
prevent serious bodily harm.
Legal defense (attorneys) at the client’s commitment hearing.
To defense counsel when River Hills CHC personnel are sued for
malpractice by patients.
Third party reimbursement only to the extent authorized in the
regulation.
Pursuant to federal rules where treatment is undertaken in a federal
agency.
To those participating in utilization reviews.
To parents or guardians and others when necessary to obtain
authorization to medical treatment
These excepted disclosures shall be limited to that information which is relevant
and necessary for the purposes for which the information is sought.
3. HIV Information
3.1 HIV-related information is any information concerning whether an individual has
been the subject of an HIV-related test, or has HIV, HIV-related illness or AIDS;
or any information which identifies or reasonably could identify an individual as
Page 10 of 12
having one of these conditions, including information pertaining to the
individual’s contacts.
3.2 A valid authorization will be required for the release of all HIV-related
information except for the following:
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.2.10
3.2.11
3.2.12
3.2.13
The attending physician or their designee
An agent, employee or medical staff member involved in the care of
the patient
Health care providers when knowledge of the condition is necessary to
provide emergency care or treatment
To the patient
To known contacts
A funeral director
Approved accrediting, licensure and peer review agencies or
organizations
Third party payers, to the extent necessary for reimbursement
The Department of Health for purpose of vital statistics processing
The Department of Health as required for reportable diseases and
conditions
Any individual in possession of a court order or search warrant
To AIDS reporting
To residential placement of children
4. Adoption Information
4.1 A valid authorization will be required for the release of confidential information.
4.2 Requests by adoptees for records relating to the identity of biological parents will
be referred to Iowa’s Department of Public Health, Bureau of Health Statistics.
4.3 The medical history and other material relevant to the adoptee’s health care may
be provided to the adopting parents. The request must be reviewed and approved
by the Medical Director.
4.4 All data that could identify the adoptee’s natural parents will be deleted. The
information to be released will be prepared by River Hills CHC personnel and
reviewed and approved by the Medical Director as a safeguard of the protection
of this potentially identifiable information.
5. Child Or Elder Abuse Information
5.1 Child Abuse Cases
5.1.1
In cases where the parents request access to or information from a
minor’s record and the case involves known or suspected child abuse,
Page 11 of 12
River Hills CHC personnel will refer the matter to legal counsel for
review and response.
5.1.2
Information pertaining to child abuse reporting and treatment is
considered confidential and can be released in limited circumstances,
including:
a.
b.
c.
d.
To the physician examining or treating the patient
To such persons specifically designated within an institution
As required due to reporting requirements
To protect children from abuse, the reporting requirements take
precedence over professional responsibilities and any other client
confidentiality, ethical principles or professional standards that
might otherwise apply.
6. Older Adults Abuse Cases
6.1 In cases where the adult, children, or guardian request access to or information
from a record and the case involves known or suspected older adult abuse, River
Hills CHC personnel will refer the matter to legal counsel for review and
response.
6.2 Informing the Individual
6.2.1
For any disclosures made by River Hills CHC in connection with this
section on abuse, River Hills CHC shall promptly inform the
individual that such a report has been or will be made, except if:
a. River Hills CHC believes informing the individual would place
the individual at risk of serious harm.
b. River Hills CHC would be informing a personal representative
and reasonably believes such representative is responsible for the
abuse and that informing such person would not be in the best
interest of the individual.
7. Enforcement. Any employee found to have violated this policy may be subject to
disciplinary action, up to and including termination of employment.
8. Reference(s)
8.1 Health Insurance Portability and Accountability Act of 1996 (HIPAA) at 45
C.F.R. § 164.308; § 164.530.
8.2 The American Recovery and Reinvestment Act of 2009 (ARRA) Division A,
Title XIII, Part 2, Subtitle D-Privacy Sec. 13400; Sec. 13402 of the HITECH Act
8.3 HIPAA Complaint Procedure for PHI policy.
Page 12 of 12