Central Maine Healthcare

Transcription

1 Central Maine Healthcare Administrative Policy No. HC-HI-5004(R2) HIPAA SUBJECT: Disclosures of Protected Health Information Policy Statement/Purpose: This policy sets forth the circumstances in which Central Maine Healthcare (CMH), its affiliates and its personnel are allowed to disclose protected health information without patient authorization and when an authorization is required. This policy also sets forth the requirements for a valid authorization. Performed by: Location/Area: Equipment: Policy: A. Requirements for a Valid Authorization, 45 CFR : 1. Patient authorizations are required to contain all of the following items: a. A specific and meaningful description of the PHI to be used or disclosed; b. CMH and its affiliates name (or the name of the person, class of persons, or organization that will be making the disclosure of PHI); c. The name or other identification of the person, class of persons, or organization to whom CMH and its affiliates is making the disclosure (or the name of CMH and its affiliates, if it is for an internal purpose); d. A description of the each purpose of the use or disclosure of PHI; e. An expiration date or an expiration event of the authorization that relates to the purpose of the use or disclosure (not exceeding 30 months); f. A statement that the patient does not have to sign the authorization and that CMH and its affiliates cannot condition treatment on whether the patient signs the authorization. (However, if CMH and its affiliates is allowed to condition treatment on obtaining authorization the authorization form must include a statement of the consequences to the individual for refusing to sign the authorization); g. A statement that, if the patient refuses to sign the authorization, it may result in improper diagnosis or treatment, denial of coverage or a claim for benefits, or other insurance or other adverse consequences; Page 1 of 12

2 h. A statement that the patient has a right to revoke the authorization; i. A statement that the patient s revocation of the authorization may be the basis for denial or health benefits or other insurance coverage or benefits; j. The potential that the patient s PHI may be re-disclosed by the recipient and no longer be protected by the federal privacy regulations; k. The individual s (or personal representative s) signature and the date of signature; l. If the authorization is executed by a personal representative, a description of that person s authority to act for the individual; m. If the authorization is for the purpose of using PHI for marketing and CMH and its affiliates will receive either direct or indirect payment, tell the patient in the authorization form; n. A statement that the patient is entitled to a copy of the authorization form; and 2. If CMH and its affiliates receive an authorization form from a source outside CMH and its affiliates, CMH and its affiliates personnel will ensure that the outside authorization form meets the requirements set forth above. 3. If the patient signed an authorization, release, or other permission form before April 14, 2003 that does not comply with the authorization requirements set forth above, CMH and its affiliates personnel may continue to use or disclose the patient s PHI collected or received before April 14, CMH and its affiliates personnel will follow the terms of that previous authorization, release or other permission. However, to use or disclose PHI collected or received after April 14, 2003 from the same patient, CMH and its affiliates personnel will obtain a new patient authorization that complies with the requirements above. 4. CMH and its affiliates personnel may not combine authorizations for different purposes. The only exception is that, if the authorization is for use and disclosure of PHI for treatment involved in a research study, personnel may combine the informed consent to participate in the study with the authorization to use and disclose the PHI for that study. (See Policy: Use and Disclosure of Protected Health Information in Research.) 5. CMH and its affiliates personnel will not require a patient to sign an authorization, and will not condition treatment on obtaining authorization, except in the following circumstances: a. The patient is participating in research, and the authorization is sought in connection with that research. (See Policy: Uses and Disclosures of Protected Health Information in Research HC-HI-5001.) b. The patient has requested CMH and its affiliates personnel to do an examination or provide other treatment, in order to disclose that information Page 2 of 12

3 to a third party. For instance, if a patient asks CMH and its affiliates to conduct an employment physical for the purpose of giving that information to the patient s employer, CMH and its affiliates personnel may refuse to do the examination unless the patient signs an appropriate authorization form. B. Uses and Disclosures Requiring an Authorization, 45 CFR and 45 CFR : CMH and its affiliates personnel are required to obtain patient or patient representative s authorization to use or disclose a PHI. 1. Deceased Patient s PHI. A deceased patient s PHI is entitled to the same protection as that of a live person. a. Disclosures to the estate or family members or guardians. CMH and its affiliates personnel may release the PHI of a deceased patient to the personal representative or administrator of the estate. If a personal representative or administrator has not been appointed, CMH and its affiliates personnel may release the records to the persons in the order of priority as authorized by Maine law and stated in Informed Consent/Consent (Advance Directives, Invasive Procedures) MC-PA However, CMH and its affiliates personnel will not release the deceased patient s PHI to an individual if the deceased patient or a person in a higher order of priority notified CMH and its affiliates in writing that he or she opposes the release of medical records to that person. b. A patient who has been deceased for a period greater than 50 years is NOT protected under the privacy rule and disclosure of their information is permitted. 2. HIV-Related Information Requires Special Confidentiality Treatment. CMH and its affiliates personnel will maintain the confidentiality of HIV-related information. CMH and its affiliates personnel will obtain patient authorization before disclosing HIV-related information unless it is to a Public Health Authorities as Section 5.a. above. 3. Fundraising: CMH and affiliates is required to provide the recipient of any fundraising communication with a clear and conspicuous opportunity to opt out of receiving further fundraising communications. a. If an individual does opt, out then the individual's choice to opt out must be treated as a revocation of authorization under the of the HIPAA Privacy rule. 4. Marketing by or on behalf of CMH and its affiliates, 45 CFR a. Definitions, 45 CFR i) Marketing includes a communication with a patient to encourage the patient to purchase or use a product or service, with the exceptions set forth in paragraph 2. ii) Marketing does not include the following communications to a patient: Page 3 of 12

4 01) Those describing a health-related product or service of CMH and its affiliates, including communications about entities participating in a health care (or health plan) network; or 02) Those made for treatment of a patient, for case management or care coordination for the patient, or to direct or recommend treatment alternatives, therapies, health care providers or settings of care. b. Authorization Required. When CMH and its affiliates personnel conduct communications with patients that fall within the definition of marketing above, CMH and its affiliates personnel must first obtain written patient authorization. c. Authorization Form. If the marketing communication will result in either direct or indirect payment to the CMH and its affiliates, the authorization form must state that such payment is expected. d. Oral Authorization. CMH and its affiliates personnel may get an oral authorization from the patient in two circumstances: i) The marketing is in a face-to-face communication with the patient; or ii) The marketing is a promotional gift to the patient worth less than [$5]. e. Business Associates. If CMH and its affiliates discloses patient names or other patient PHI to a third party for assistance in CMH and its affiliates marketing efforts, CMH and its affiliates must have a business associate agreement in place with that third party before CMH and its affiliates disclose any PHI to the third party. This business associate agreement must prohibit the third party from using or disclosing the patient information provided to them for purposes other than the marketing for CMH and its affiliates. Direct business associates shall verify in writing they are compliant with HIPAA. Subcontractors of direct business associates, or subcontracted business associates, must have business associates agreements as well, become directly liable for compliance with certain of the HIPAA Privacy and security requirements. f. CMH and its affiliates will not disclose any sort of genetic information for underwriting purposes. g. The selling of any protected health information will require individual authorization. 5. Mental Health Records Definitions, 45 CFR Page 4 of 12

5 a. Psychotherapy notes: Psychotherapy notes are those recorded (in any medium) by a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and, that are separated from the rest of the individual s medical record. These are records that are kept as private records of a mental health professional. Psychotherapy notes do not include medical records concerning psychiatric or psychological consultations in CMH or its affiliates, or records made by CMH and its affiliates personnel concerning the mental health, well being, or complaints by patients. Psychotherapy notes do not include medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies or treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date. b. Client: A person receiving services from the department, from any state institution or agency licensed or funded to provide services falling under the jurisdiction of the department. c. Mental health information: Orders of commitment, medical and administrative records, and application and reports related to a client. d. Use and disclosure of psychotherapy notes. CMH and its affiliates' personnel will obtain patient authorization to use or disclose psychotherapy notes, except in the following circumstances: 01) The originator of the psychotherapy notes may use those notes for treatment of the patient. 02) CMH and its affiliates personnel may use psychotherapy notes to carry out training programs in mental health under supervision. 03) The psychotherapy notes will not be included in the patient s medical records. The students or trainees in the training programs may examine psychotherapy notes under supervision but will not obtain copies of the psychotherapy notes. 04) CMH and its affiliates personnel may use or disclose psychotherapy notes to defend a legal action or other proceeding brought by the patient. 05) CMH and its affiliates personnel will use or disclose psychotherapy notes when they are required by another law to do so. 06) CMH and its affiliates personnel will disclose psychotherapy notes to the Secretary of DHHS during DHHS investigations of CMH and its affiliates compliance with the HIPAA Privacy Standards, if DHHS specifically requests to see psychotherapy notes or the mental health professional s personal notes. 07) CMH and its affiliates personnel will disclose psychotherapy notes to health oversight agencies if a health oversight agency specifically requests to see psychotherapy notes or the mental health professional s personal notes. Page 5 of 12

6 08) CMH and its affiliates personnel may disclose psychotherapy notes to coroners and medical examiners regarding deceased patients, if they represent to CMH and its affiliates personnel that those notes are necessary for them to perform their functions. 09) CMH and its affiliates personnel may use or disclose psychotherapy notes where necessary to avert a serious and imminent threat to safety. In this circumstance, CMH and its affiliates personnel first will consult with legal counsel. e. Disclosure to quality improvement councils and local services networks. CMH and its affiliates personnel may disclose mental health information to quality improvement councils and local services networks only if those organizations are exercising an oversight function, the disclosures are required by another Maine law, or are for CMH and its affiliates quality assurance purposes. 6. Organ, Eye and Tissue Donation. CMH and its affiliates personnel will obtain patient (or patient representative) authorization before disclosing PHI to organ procurement organizations or others engaged in the procurement, banking, or transplantation of organs, eyes or tissues. C. Disclosures Allowed without Patient Authorization, 45 CFR : All disclosures of patient s PHI require an authorization except as outlined below: 1. Avert a serious threat to health and public safety a. If CMH and its affiliates personnel have a good faith belief that disclosing a patient s PHI will prevent or lessen a serious and immediate threat to the patient, another person, or the public, CMH and its affiliates personnel may make the disclosure of PHI. CMH and its affiliates personnel will make this disclosure only if it is consistent with their professional standards of ethical conduct. b. CMH and its affiliates personnel may make this disclosure only to a person (including the target of the harm) who is reasonably able to prevent or lessen the threat. c. Unless immediate disclosure is required to prevent or lessen the threat, CMH and its affiliates personnel first will consult with Legal Counsel. 2. Correctional institutions & government officials with custody over an inmate Definitions (45 CFR ): a. Inmate: A person incarcerated in or otherwise confined to a correctional institution, including jails, prisons, and Immigration and Naturalization Service detention centers. b. Law enforcement official: A federal, state, tribal, county or local officer or agent, who investigates, enforces or prosecutes laws. Page 6 of 12

7 c. Permitted Disclosures: CMH and its affiliates personnel may disclose an inmate s PHI to a correctional institution or a law enforcement official having lawful custody of an inmate, if the correctional institution or such law enforcement official represents that such PHI is necessary for: i) the provision of health care to the inmate; ii) the health and safety of the inmate, other inmates, officers or employees at the correctional institution, or persons responsible for the transporting inmates; iii) law enforcement on the premises of the correctional institution; or iv) the administration and maintenance of the safety, security, and good order of the correctional institution. d. CMH and its affiliates personnel will request the correctional institution or law enforcement official to make the representations in writing. If they refuse or are unable to do so, CMH and its affiliates personnel will get the representations verbally, and will document those representations in the patient s medical record. e. CMH and its affiliates personnel may disclose PHI to correctional officials or law enforcement officials if they believe in good faith that the officials need the information to identify or apprehend a person who it appears has escaped from a correctional institution or from lawful custody. 3. Decedents - Disclosures to Medical Examiners/Coroners. CMH and its affiliates personnel may disclose PHI to a coroner or medical examiner for the purposes of identifying a deceased patient, determining a cause of death, or for other duties of the coroner or medical examiner. 4. FDA for Reporting Obligations. CMH and its affiliates personnel may report PHI to the FDA regarding an FDA-regulated product or activity in the following five circumstances: a. To collect or report adverse events (or similar activities with respect to food or dietary supplements), product defects or problems (including problems with the use or labeling of a product), or biological product deviations; b. To track FDA-regulated products; c. To enable product recalls, repairs, or replacement, or look-back (including locating and notifying individuals who have received products) that have been recalled, withdrawn, or are the subject of look-back; d. To conduct post marketing surveillance; or e. As required by another law. 5. Government officials a. Communicable Diseases including HIV reporting to Public Health Authorities. CMH and its affiliates personnel may disclose information concerning communicable diseases including HIV-related information to Page 7 of 12

8 public health authorities. For these disclosures, CMH and its affiliates personnel should follow the requirements of 5 M.R.S.A and Policy ICM2-10,204 Reporting Notifiable Diseases in Patients and Staff. b. Health Oversight Activities. CMH and its affiliates personnel may disclose PHI to health oversight agencies for oversight activities authorized by law. For instance, CMH and its affiliates personnel may allow government officials access to PHI for audits, inspections, licensure, disciplinary actions, or enforcement of regulatory compliance. c. Government Officials for Other Purposes. If this policy or another CMH and its affiliates policy does not address a particular disclosure to a government official, CMH and its affiliates personnel will consult legal counsel before making the disclosure. d. Special Rules for Disclosures Concerning Adult Victims of Abuse or Neglect. If a disclosure to a government official is about an adult victim of abuse or neglect (or domestic violence), CMH and its affiliates personnel must promptly inform the patient (or the patient s representative) that a report has been made, unless CMH and its affiliates personnel believe that informing the patient or patient s representative would place the patient at risk of serious harm, or if personnel believe that the personal representative is responsible for the abuse or neglect and that it would not be in the best interest of the patient to inform the personal representative. 6. Judicial & Administrative Proceedings a. Court Orders. CMH and its affiliates personnel will comply with orders to produce PHI from any court with appropriate jurisdiction over CMH and its affiliates. CMH and its affiliates personnel will disclose only the PHI demanded by the order. A subpoena is not a court order. When CMH and its affiliates personnel receive a subpoena, they will follow Section b and Legal Document and Inquiry Management HC-GA-1024(R1) and Patients Rights and Responsibilities MC-PA b. Responding to Subpoenas, Protective Orders and Discovery Requests. If CMH and its affiliates do not receive a court order or patient authorization to disclose PHI, CMH and its affiliates personnel should consult legal counsel. 7. Law enforcement officials. Law enforcement officials include federal, state, tribal, county and local officers or agents that investigate, enforce, and prosecute laws. a. Required by Other Law. CMH and its affiliates personnel will disclose PHI to law enforcement officials if required by law to do so. If the disclosure concerns adult abuse, neglect, or domestic violence, CMH and its affiliates personnel will follow sections noted below. b. Assist in Identifying or Locating an Individual. When law enforcement officials request information to identify or locate a specific suspect named by police, CMH and its affiliates personnel may disclose limited information to Page 8 of 12

9 the requesting law enforcement official, address and whether or not the person is currently a patient. i) CMH and its affiliates personnel will not disclose PHI related to the patient s DNA or DNA analysis, dental records, or typing, samples or analysis of body fluids or tissue. ii) CMH and its affiliates personnel will not disclose any part of the patient s medical record without receiving a court order, warrant, grant jury subpoena, or valid subpoena, as required by another law or as authorized by the patient. c. Concerning Crime Victims i) Child Abuse and Neglect. CMH and its affiliates personnel will follow CMH and its affiliates Admission or Out-Patient Treatment of Physically Abused or Neglected Children MC-PA-2006 on reporting child abuse and neglect. ii) Adult Abuse and Neglect. 01) CMH and its affiliates personnel will follow the CMH and its affiliates Policy Reporting Cases of Adult Abuse MC-PA-2015, on reporting adult abuse and neglect. 02) CMH and its affiliates personnel will inform the patient (or the patient s representative) that CMH and its affiliates are required to report the abuse. However, if CMH and its affiliates personnel believe that informing the patient would place him or her at risk of serious harm, or CMH and its affiliates personnel would be informing a personal representative that personnel believe is responsible and it would not be in the patient s best interests, CMH and its affiliates personnel will not inform the patient about the disclosure. d. Other Crime Victims. CMH and its affiliates personnel may disclose PHI in response to law enforcement requests for information about a patient who is or is suspected to be a victim of a crime in the following circumstances: i) The patient agrees to the disclosure. If the patient will not agree to the disclosure, CMH and its affiliates personnel may not disclose PHI unless the requirements of paragraph 2 are met. ii) If CMH and its affiliates personnel is unable to obtain the patient s agreement because of incapacity or other emergency circumstance, CMH and its affiliates personnel may disclose the PHI if: iii) The law enforcement official represents that he or she needs the information to determine whether a person other than the victim (patient) has violated the law and that the law enforcement officials do not intend to use such information against the victim (patient); 01) The law enforcement official represents that immediate law enforcement activity depending on the information would be materially and adversely affected by waiting until the individual is able to agree; and 02) CMH and its affiliates personnel determine that the disclosure is in the best interest of the individual. Page 9 of 12

10 e. Information Relating to a Crime on CMH and its affiliates Premises. CMH and its affiliates personnel may disclose PHI to law enforcement officials if CMH and its affiliates personnel believe in good faith the PHI is evidence of criminal conduct that occurred on CMH and its affiliates premises. f. Disclosures of Patient Admissions of Participation in Violent Crime. If a patient admits participation in a violent crime to CMH and its affiliates personnel, CMH and its affiliates personnel will report the patient admission to the Director of Health Information Management who will then consult with Legal Counsel. i) Director of Health Information Management will not make the disclosure if the patient admission was obtained in the course of treatment to affect the propensity to commit the criminal conduct, through counseling or therapy, or through a request by the patient to initiate or be referred to treatment, counseling or therapy. g. Escape from Custody. CMH and its affiliates personnel may disclose PHI to law enforcement officials if they believe in good faith that the officials need the information to identify or apprehend a person who it appears has escaped from a correctional institution or from lawful custody. h. Information Regarding Deaths. CMH and its affiliates personnel may report to law enforcement the death (and related PHI) of an individual where it is suspected that the death is a result of criminal conduct. i. Military, national security and intelligence activities. CMH and its affiliates personnel may disclose the PHI of a member of the United States Armed Forces to a military official if the official executes the certification of proper use and determines that the disclosure is necessary to protect the public health and welfare. j. Disclosures for National Security and Intelligence Activities. CMH and its affiliates personnel may disclose a patient s PHI to a federal official who certifies in writing that the government s collection of the information is necessary for the conduct of intelligence, counter-intelligence, and other national security activities and is necessary to protect the public health and welfare. 8. Disclosures of proof of immunization to a school: Where state or other laws require the school have proof of immunization prior to admitting a student, written authorization is no longer required to permit this disclosure and use of information. a. Covered entities will still be required to obtain documented agreement, which may be oral, from a parent, guardian, or individual him or herself if the individual is an adult or emancipated minor. This agreement is effective until revoked. D. Invalid Authorizations, 45 CFR Page 10 of 12

11 1. CMH and its affiliates personnel will not use or disclose PHI if the patient s authorization is invalid. An authorization is invalid if: a. The authorization has expired, because the expiration date has passed or the expiration event has passed; b. The authorization form lacks a required element or has not been filled out completely; c. CMH and its affiliates is aware that the patient has revoked the authorization; d. CMH and its affiliates knows that the form contains material false information; or e. The authorization is combined with another authorization (except for research purposes). 2. If they become aware of information that would render a patient s authorization invalid, CMH and its affiliates personnel will report that information to CMH and its affiliates Director of Health Information Management. This includes information that a patient has revoked his or her authorization, has expressed the desire to revoke his or her authorization, or that an authorization form contains false information. 3. A patient may revoke his or her authorization at any time by submitting a written request to CMH and its affiliates personnel. CMH and its affiliates personnel that receive a patient s written revocation of authorization will send a copy of the revocation to the Director of Health Information Management. 4. Upon revocation of patient authorization, CMH and its affiliates personnel will stop using or disclosing patient s PHI for the purposes covered by that authorization. However, if there is an important reason to continue to use or disclose that PHI (for example, the patient s PHI must be used for quality assurance purposes or CMH and its affiliates must submit that PHI to obtain payment for the patient s care), CMH and its affiliates personnel should contact CMH and its affiliates Privacy Official for further guidance. E. Verifying Identity and Authority of Recipient. CMH and its affiliates personnel will verify the identity and authority of a person requesting PHI before disclosing the PHI. F. Disclosing the Minimum Necessary Amount of PHI, 45 CFR , 45 CFR and 45 CFR CMH and its affiliates personnel will disclose only the minimum amount of PHI necessary for the purpose. G. Retention of Authorizations, 45 CFR CMH and its affiliates will retain copies of all patient authorizations for at least six years. All patient authorizations will be kept in the medical record. Page 11 of 12

12 Special Considerations: We are required by law to notify any affected individual if there has been a breach of protected health information. This also applies to business associates. Cross References: HC-GA- 1024(R1) MC-GA-1026 ICM2-10,204 MC-PA-2015 MC-PA-2014 MC-PA-2003 MC-PA-2006 References: 45 CFR CFR CFR CFR CFR CFR Legal Document and Inquiry Management, including Service of Legal Process by Law Enforcement Officials, Private Investigators, Attorneys, Insurance Adjustors, DHHS Case Workers, Etc. Confidentiality of Patient Information and Other Information Reporting Notifiable Diseases in Patients and Staff Reporting Adult Abuse and Neglect Identification and Treatment of Victims of Domestic Violence (Battered Men/Women) Informed Consent-Consent (Advance Directives, Invasive Procedures) Admission or Out-Patient Treatment of Physically Abused or Neglected Children Definitions Uses and disclosures of protected information: general rules Uses and disclosures: organizational requirements Uses and disclosures for which an authorization is required Uses and disclosures for which consent, an authorization, or opportunity to agree or object is not required Other requirements relating to uses and disclosures of protected health information Peter E. Chalke President (Signature on File) Effective: April 1, 2003 Supersedes: Revised: September 25, 2003 March 24, 2010 September 26, 2013 Reviewed: May 29, 2007 Page 12 of 12