3 PROCEDURES

3.1 Use and disclosure of PHI

3.1.1 Receiving a Request for Health records:

• Requests for Health records shall be managed by the Company HIPAA Compliance Officer.

• Other staff members will not release PHI without approval of the Company HIPAA Compliance Officer.

• Only emergency release of information will be done after hours or on weekends.

• After hours and on weekends, release of information for continuing care is allowed.

  
  

3.1.2 Responding to Specific Types of Disclosures:

• See the “Request and Disclosure Table” following this Policy for applicable requirements in responding to requests by specific entities/individuals.

• Media: No PHI shall be released to the news media or commercial organizations without the authorization of the patient or his personal representative.

• Telephone Requests: Staff members receiving requests for PHI via the telephone will make reasonable efforts to identify and verify that the requesting party is entitled to receive such information.

  
  

3.1.3 Disclosures to Persons Involved with a Patient’s Care:

• The Company may disclose to a family member, other relative, close friend, or any other person identified by the patient, PHI:

  ○ That is directly relevant to

  that person’s involvement

  with the patient’s care or

  payment for care; or

  ○ To notify such person of

  the patient’s location,

  general condition, or

  death.

• Conditions if the Patient is Present: If the patient is present for, or otherwise available, prior to a permitted disclosure, then the Company may use or disclose the PHI only if the Company:

  ○ Obtains the patient’s

  agreement

  ○ Provides the patient with

  an opportunity to object

  to the disclosure, and the

  patient does not express

  an objection (this

  opportunity to

  object and the patient’s

  response may be done

  orally)

  ○ May reasonably infer from

  the circumstances, based

  on the exercise of

  professional judgment,

  that the patient does not

  object to the disclosure

• Conditions if the Patient is Not Present or is Incapacitated. The Company may, in the exercise of professional judgment, determine whether the disclosure is in the best interest of the patient, and, if so, disclose only that PHI which is directly relevant to the person’s involvement with the patient’s care if:

  ○ The patient is not present

  ○ The opportunity to

  agree/object to the use or

  disclosure cannot

  practicably be provided

  because of the patient’s

  incapacity

  ○ In an emergency

• Confirming Identity. The Company shall take reasonable steps to confirm the identity of a patient’s family member or friend. The Company is permitted to rely on the circumstances as confirmation of involvement in care. For example, the fact that a person admits a patient to the Company and visits weekly is sufficient confirmation of involvement in the patient’s care.

  
  

3.2 Minimum Necessary Principle

• The Company will identify role-based access to PHI per job description, including:

○ People or classes of people
in its workforce who need
access to PHI to carry out
their duties

○ The category or categories
of PHI to which access is
needed, including any
conditions that may be
relevant to such access

• The Company, for any type of disclosure or request for disclosure that is made on a routine and recurring basis, will limit the disclosed PHI, or the request for disclosure, to that which is reasonably necessary to achieve the purpose of the disclosure or request.

• The Company, for disclosures or requests for that are not made on a routine and recurring basis (non-routine disclosures), will review the request to verify that PHI disclosed or requested is the minimum necessary.

• All requests for non-routine disclosures or requests that do not meet an exception will be reviewed using standard criteria.

• Exceptions to minimum necessary requirements: The Company will release information without concern for the minimum necessary standard as follows:

○ Disclosures to or requests
by a health care provider
for treatment

○ Uses or disclosures made
to the individual who is the
subject of the PHI

○ Uses or disclosures made
pursuant to an
authorization signed by the
individual

○ Disclosures made to the
Secretary of the
Department of Health and
Human Services

○ Disclosures that are
required by law (such as
for Department of Health
state surveys, federal
surveys, public health
reportable events, FDA as
related to product quality,
safety, effectiveness or
recalls etc.).

○ Uses and disclosures that
are required for
compliance with the HIPAA
Privacy Rule

• The Company may use or disclose an individual’s entire Health record only when such use or disclosure is specifically justified as the amount that is reasonably necessary to accomplish the intended purpose or one of the exceptions noted above applies.

• Requests for entire Health records that are not covered by an exception will be reviewed using standard criteria.

• Reasonable Reliance: The Company may rely on a requested disclosure as minimum necessary for the stated purpose(s) when:

○ Making disclosures to
public officials, if the official
represents that the
information is the
minimum necessary for the
stated purpose(s)

○ The information is
requested by another
covered entity (health care
provider, clearinghouse or
health plan)

○ The information is
requested by a professional
who is a member of the
Company’s workforce or is
a Business Associate of the
Company for the purpose
of providing professional
services to the Company, if
the professional represents
that the information
requested is the
minimum necessary for the
stated purpose(s)

• The Company, upon determination that the use, disclosure or request for PHI is the minimum necessary or one of the above exceptions apply, will release the PHI to the requestor.

• Company Requests for PHI from Another Covered Entity: When requesting PHI from another Covered Entity, the Company must limit its request for PHI to the amount reasonably necessary to accomplish the purpose for which the request is made. For requests that are made on a routine and recurring basis, the Company shall take reasonable steps to ensure that the request is limited to the amount of PHI reasonably necessary to accomplish the purpose for which the request is made.

For requests that are not on a routine or recurring basis, the Company shall evaluate the request according to the following criteria:

• Is the purpose for the request stated with specificity?

• Is the amount of PHI to be disclosed limited to the intended purpose?

• Have the requirements for supporting documentation, statements, or representations been satisfied?

• Have all applicable requirements of the HIPAA Privacy Rule been satisfied with respect to the request?

3.3 Designated Record Set

• The Designated Record Set is a group of records maintained by or for the Company that consists of the Health records and delivery history of the patient. The term record means any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for the Company.

• The Company maintains the following as the Designated Record Set:

○ The patient’s delivery
information

○ The patient’s prescription
delivery history

○ The patient’s Personal
Health Records

○ The company does not
maintain the patient’s
Personal Health Records,
nor source data, including
photographs, films,
monitoring strips,
videotapes, slides,
worksheets and daily
communication sheets, and
shadow files or charts,
unless such data is used to
make decisions
related to the patient’s
care.

• If records from other providers are used by the Company to make decisions related to prescription delivery to the patient, then these records are considered part of the Designated Record Set as well as the Health record

• The Patient’s Office File includes, for example, the following:

○ Delivery address

○ Prescription ordering
records

○ Special delivery
instructions

• Personal Health Records consist of the patient’s personal health information provided to the Company by the patient. If such records are used by the Company to make health care related decisions, provide care services, or document observations, actions or instructions, then the records will be considered part of the Designated Record Set.

• The following are excluded from the Designated Record Set:

○ Administrative data, such
as audit trails, appointment
schedules and practice
guidelines that do not
imbed PHI.

○ Also excluded are incident
reports, quality assurance
data, vital certificate
worksheets, and derived
data such as accreditation
reports, anonymous
patient data for research
purposes, public health
records and statistical
reports.

• The Designated Record Set is to be retained according to state and federal regulations and following Company or company retention procedures.

  
  

3.4 Emailing PHI

• Email users will be set up with a unique identity complete with unique password and file access controls.

• Email users may not intercept, disclose or assist in intercepting and disclosing email communications.

• Patient specific information regarding highly sensitive health information must not be sent via email

• Users will restrict their use of email for communicating normal business information such as information about delivery disruptions, and other operational and administrative matters.

• Users should verify the accuracy of the email address before sending any PHI and, if possible, use email addresses loaded in the system address book.

• PHI may be sent unprotected via email within a properly secured, internal network of the organization. When sending PHI outside of this network, such as over the Internet, every effort should be made to secure the confidentiality and privacy of the information. Sample security measures include password protecting the document(s) being sent or encrypting the message.

• All email containing PHI will contain a confidentiality statement (see sample below).

• Users should exercise extreme caution when forwarding messages. Sensitive information, including patient information, must not be forwarded to any party outside the organization without using the same security safeguards as specified above.

• Users should periodically purge email messages that are no longer needed for business purposes, per the organization’s records retention policy.

• Employee email access privileges will be removed promptly following their departure from the organization.

• Email messages, regardless of content, should not be considered secure and private. The amount of information in any email will be limited to the minimum necessary to meet the needs of the recipient.

• Employees should immediately report any violations of this guideline to their supervisor, Administrator or Company HIPAA Compliance Officer.

• Sample Confidentiality Statement

  
  

The information contained in this email is legally privileged and confidential information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any viewing, dissemination, distribution, or copy of this email message is strictly prohibited. If you have received and/or are viewing this email in error, please immediately notify the sender by reply email, and delete this email from your system. Thank you.

3.5 Faxing PHI

• The fax machine should be located in an area that is not easily accessible to unauthorized persons. If possible, the fax machine should not be located in a public area where confidentiality of PHI might be compromised.

• Received documents will be removed promptly from the fax machine.

• Unless otherwise prohibited by state law, information transmitted via facsimile is acceptable and may be included in the patient’s Health record.

• Steps should be taken to ensure that the fax transmission is sent to the appropriate destination. These include:

○ Pre-programming and
testing destination
numbers whenever
possible to eliminate errors
in transmission due to
misdialing.

○ Asking frequent recipients
to notify the Company of a
fax number change.

○ Confirming the accuracy of
the recipient’s fax number
before pressing the
send/start key.

○ If possible, printing a
confirmation of each fax
transmission.

• A cover page should be attached to any facsimile document that includes PHI. The cover page should include:

○ Destination of the fax,
including name, fax
number and phone
number

○ Name, fax number and
phone number of the
sender

○ Date

○ Number of pages
transmitted

○ Confidentiality Statement
(See sample below)

• If a fax transmission fails to reach a recipient or if the sender becomes aware that a fax was misdirected, the internal logging system should be checked to obtain incorrect recipient’s fax number. Fax a letter to the receiver and ask that the material be returned or destroyed.

• A written Authorization for any use or disclosure of PHI will be obtained when the use or disclosure is not for treatment, payment or healthcare operations or required by federal or state law or regulation.

• The PHI disclosed will be the minimum necessary to meet the requestor’s needs.

• Highly sensitive health information should not be sent by fax.

Sample Confidentiality Statement:

The documents accompanying this transmission contain confidential protected health information that is legally privileged. This information is intended only for the use of the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information to any other party unless required to do so by law or regulation and is required to destroy the information after its stated need has been fulfilled.

If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or action taken in reliance on the contents of these documents is strictly prohibited. If you have received this information in error, please notify the sender immediately and arrange for the return or destruction of these documents.

3.6 De-identification of PHI

• The Company will convert patient PHI into a format that does not identify the patient (de-identify) when:

○ PHI is used or shared for
purposes other than
treatment, payment or
health care operations (OR)

○ Information is used or
shared without patient
authorization.

• The Company will de-identify the PHI by one of the following methods:

• Elimination of the 18
identifiers of PHI:

• Names

• All geographic
subdivisions smaller
than a state, including
street address, city,
county, precinct, zip
code and their
equivalent geocodes,
except for the initial
three digits of a zip code
if the geographic area
contains more than
20,000 people. If less
than 20,000 people are
found to be in this area
based on the first three
digits of the zip code,
the code must be
changed to 000

• All elements of dates
(except year) for date
directly related to a
patient including birth
date, admission date,
discharge date, date of
death: and all ages over
90 and al elements of
dates (including year)
indicative of such age,
except that such ages
and elements may
be aggregated into a
single category of age
90 or older

• Telephone numbers

• Fax numbers

• Electronic mail address

• Social security numbers

• Health record numbers

• Health plan beneficiary
numbers

• Account numbers

• Certificate/license
numbers

• Vehicle identifiers and
serial numbers,
including license plate
numbers

• Device identifiers and
serial numbers

• Web Universal Resource
Locators (URLs)

• Internet Protocol (IP)
address numbers

• Biometric identifiers,
including finger and
voiceprints

• Full face photographic
images and any
comparable images

• Any other unique
identifying number,
characteristic, or code

Note: In addition to removing the above identifiers, the Company must not have actual knowledge that the information could be used alone or in combination with other information to identify a patient who is a subject of the information.

• Statistical De-Identification: A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable applies such principles and determines that the risk is very small that the information could be used to identify the patient. The methods and the results of the analysis must be documented.

• Re-Identification: The Company may assign a code that would allow the information to be re-identified by the Company if the code is not derived from or related to information about the patient and is not otherwise capable of being translated so as to identify the patient. The Company must not use or disclose the code or any other means of record identification for any other purpose and must not disclose the mechanism for re-identification.