Health Information Management<\/p>\n
Review the HIPAA and ROI material provided on the Release of Information (ROI) page this week. It is a HIPAA rule that all health information release must be tracked.<\/p>\n
It is technically called an Accounting of Disclosure. The materials suggest what type of information must be tracked. Some HIM department have an HIM software<\/p>\n
application that can be used to do this, while others simply use Excel or Word to set up a tracking system.<\/p>\n
For this assignment, design a ROI Tracking document using an Excel spreadsheet or a Word table or form document. Be sure it includes each of the areas that are<\/p>\n
required on an Accounting of Disclosure.<\/p>\n
One you have your form designed, fill in the information for one patient simply using made up information.<\/p>\n
Rasmussen Medical Center<\/p>\n
Health Information Department
\nRelease of Information Policies<\/p>\n
Release of Information Overview
\nThis should serve as a resource for those individuals responsible for manageing or performing the process of release of information. Health care providers have a duty<\/p>\n
to maintain patient privacy and to release information when appropriate. Patient health information should be considered confidential, and should be released only in<\/p>\n
accordance with a health care information disclosure policy. The policy must define when a patient\u2019s authorization is required and should comply with state and<\/p>\n
federal statutes, the Health Insurance Portability and Accountability Act (HIPAA), Patient Bill of Rights, court rulings, administrative rules, and accrediting and<\/p>\n
regulatory agency requirements.
\nThe HIM professional is considered the key individual in developing, implementing and maintaining privacy policies and procedures due to their specific training in<\/p>\n
handling these particular situations. An HIM professional\u2019s education and experience includes confidentiality, legal issues, and critical thinking in a variety of<\/p>\n
situations.
\nPatient information must be protected from unauthorized, inappropriate, or unnecessary access. Federal regulations under HIPAA established national requirements for<\/p>\n
confidentiality.
\nConsiderations for Disclosure
\nThe principal considerations for determining when information may be disclosed are:
\n\u2022\tWhether a patient authorization is required
\n\u2022\tThe nature of the information requested
\n\u2022\tWhether it is confidential or non-confidential
\n\u2022\tThe purpose of the request
\n\u2022\tThe authority of the person or agency requesting the information
\n\u2022\tWhether any revocations or notices to withhold information are on file
\nState Law
\nThis state has a statute that identifies provisions for access to health care records. The basic provisions of the law are:
\nA.\t The patient has a right to access health care information that pertains to the patient\u2019s examination or treatment of a medical, psychiatric or mental<\/p>\n
condition.
\nB.\tUpon written request from the patient, a health care provider has an obligation to supply the patient with health care information.
\nC.\tA signed and dated patient authorization is required for release of health care information except under the following circumstances:
\na.\tDisclosure is authorized by law
\nb.\tDisclosure of immunization date
\nc.\tMedical emergency
\nD.\tHealth care information may be release without patient authorization for medical or scientific research unless the patient has specifically objected to<\/p>\n
disclosure for research purposes. The health care provider must make a \u201creasonable effort to determine\u201d that the researcher or organization will protect the rocor<\/p>\n
from unauthorized disclosure or misuse.
\nE.\tHealth care information may not be re-released without a signed and dated authorization from the patient or patient\u2019s legally authorized representative, unless<\/p>\n
the release is specifically authorized by law.
\nF.\tAn authorization is valid for one year or for a lesser period if specified in the authorization. The authorization does not expire after one year for:
\na.\tOther health care providers
\nb.\tHealth insurance plans
\nc.\tLife insurance
\nG.\tWith patient\u2019s authorization, the provider may furnish a summary of the record, or copies of pertinent portions of the record, in lieu of the entire record.
\nH.\tThe provider may charge a reasonable fee for the copies.
\nI.\tInformation may be withheld if a provider determines that information in the record is detrimental to the physical or mental health of the patient, or is<\/p>\n
likely to cause the patient to inflict self-harm or to harm another.
\na.\tIn a licensed health care facility, this determination to withhold information must be made by the health care provider before a request is received, otherwise<\/p>\n
the request must be honored.
\nb.\tIf the patient is a subject of a competency hearing, full access must be allowed.
\nJ.\tA person who released health records in violation of this statute, or who alters the authorization from of another person without the person\u2019t consent, is<\/p>\n
liable to the patient for damages.
\nK.\tA provider who inappropriately charges ofr health care information may be subject to disciplinary action by the Board of Medical Practice for Physicians, or<\/p>\n
the State Health Department for other providers.
\nL.\tA health care provider should develop procedures for documenting access restrictions. The restrictions should be visibly documented in the patient health<\/p>\n
record. When information is withheld from the patient, the provider may release the information to an appropriate third party or to another health care provider, who<\/p>\n
may then release the information to the patient.<\/p>\n
Authorization Requirements
\nWritten patient authorization is required to release health care information. The authorization may be an original, a facsimile\/scanned image or a photocopy. Some<\/p>\n
facilities will not accept a photocopy or fax or scanned image as the original unless a statement is present on the authorization states a photocopy or image is<\/p>\n
treated ion the same manner as the original.
\nThe authorization should include the following components or elements:
\n\u2022\tPlain language
\n\u2022\tName of institution or provider that is to release the information
\n\u2022\tName of individual or institution that is to receive the information
\n\u2022\tPatient\u2019s full name, address, and date of birth
\n\u2022\tA description of the information to be disclosed with sufficient specificity to allow the facilty or provider to know which information the authorization<\/p>\n
references
\n\u2022\tThe name or other specific identification of the person that is authorized to make the disclosure
\n\u2022\tA specific expiration date, a specific expiration time period, or an event at which the authorization will expire that is directly relevant to the individual<\/p>\n
or the purpose of the disclosure
\n\u2022\tA statement of the individual\u2019s right may revoke the authorization in writing
\n\u2022\tInstructions on how the individual may revoke the authorization in writing
\n\u2022\tA statement informing the individual may be subject to re-disclosure by the recipient and may no longer be protected by the HIPAA rule
\n\u2022\tA statement that the record may include provider records from other facilities or providers of care
\n\u2022\tThe individual\u2019s signature and date of signature
\n\u2022\tIf the authorization is signed by a personal representative of the individual, the representative must indicate his or her authority to act for the individual.<\/p>\n
Specific Types of Releases
\nDeceased Patients
\nThe surviving spouse or parents of a deceased patient, or a person the patient designates in writing as a representative, may authorize release of the patient\u2019s<\/p>\n
records. If there is no surviving spouse or parents, the law does not specify who may authorize release. The provider may require legal representation be established<\/p>\n
for a party to authorize disclosure of the record. The legal representative of the patient (i.e. executor of the estate) may authorize disclosure of the records.<\/p>\n
Legal documentation from the court should be requested to provide proof of appointment.
\nThe state\u2019s ombudsman for mental health and mental retardation is not required to obtain consent for access to private data on decedents who were receiving services<\/p>\n
for mental illness, mental retardation or a related condition, or emotional disturbance.
\nRequirements:
\n\u2022\tA patient\u2019s authorization or consent does not survive his or her death. A deceased person cannot authorize in advance release of his or her own patient<\/p>\n
information.
\n\u2022\tPowers of attorney are revoked by the death of the principal (patient).
\n\u2022\tThe executor of the patient\u2019s estate should sign the authorization for release of information.
\nPrison Inmates
\nFederal Prison: health care records of an inmate of a federal prison do not belong to the patient (inmate), therefore may not be release with an authorization signed<\/p>\n
by the patient (inmate).
\nPermission from the Federal Government is required for release of any health care records of an inmate of a federal prison.
\nMentally or Physically Incompetent Patient
\nIf a patient is not competent to sign an authorization to release health care information, but has not been legally adjudicated to be incompetent, discretion must be<\/p>\n
used in obtaining an authorization. It is recommended that the next of kin authorize to release of information. If a person has been adjudicated to be incompetent,<\/p>\n
refer to Guardians and Conservators.
\nGuardian\/Conservator
\nA court may fin d that a person is incompetent to manage personal affairs. In this case a guardian or conservator will be appointed. Guardians have the authority to<\/p>\n
release health care information. Conservators may or may not have authority over an individual\u2019s health care needs. With either a guardian or conservator, proof of<\/p>\n
appointment and authority to release health care information should be presented.<\/p>\n
Custodial \/ Divorced Parents
\nWhen the parents of a child are divorced, either parent may authorize release or have access to the health care information of the minor child, regardless of which<\/p>\n
parent has been awarded legal custody. Only when the parental rights have been terminated or a cours has set specific limitations with respect to the child\u2019s health<\/p>\n
care and access to records can the parent be denied access to their minor child\u2019s health care information. The health information professional may contact the<\/p>\n
custodial parent to inform them that a request has been received from the other parent for health record information, but this is not required.
\nIf one parent requests that access be denied to the other parent, legal documentation from the court must be provided to prove termination of parental rights or other<\/p>\n
restrictions.
\nHIV\/AIDS Records
\nSpecific patient access or release statutes do not regulate health care records pertaining to HIM and AIDS testing and results. Health care providers should take<\/p>\n
extra precaution to ensure patient confidentiality of these records due to the sensitivity of information, public attitudes, and the potential consequences from an<\/p>\n
unnecessary HIV test or inappropriate release of HIV\/AIDS information. Even though law does not specifically protect this information, the sensitivity issues may<\/p>\n
merit the development of special procedures. Unless specifically asked for and authorized by the patient, HIV and AIDS records should not be released.
\nCounty Attorney Requests
\nA county attorney is allowed access to health care records of incarcerated individuals in the state prison if the Department of Corrections refers the case for<\/p>\n
commitment as a sexual psychopath or sexually dangerous person. This would apply to prison inmates who are nearing the completion of their sentence for sex crimes and<\/p>\n
whom the Corrections Department feels would be a public risk if they are released.
\nIndependent Medical Examination
\nIn an independent medical examination (IME), there is no physican-patient relationship. The results of the examination do not become part of the health care record.<\/p>\n
The original report goes directly to the third party who requested or paid for the examination. The examinee\u2019s consent is not required for the provider who performed<\/p>\n
the examination to release the report to the third party who requested and or paid for the examination.<\/p>\n
Medical Examiner \/ Coroner
\nRelease of health care records is allowed to the medical examiner \/ coroner. Health care records on the decedent whose death is being investigated shall be made<\/p>\n
promptly available to the medical examiner\/coroner upon the written request of the medical examiner\/coroner. The medical examiner\/coroner shall pay the reasonable<\/p>\n
costs for copies of records or data provided.
\nWorker\u2019s Compensation Requests
\nStatutes provide for release of medical data related to a current worker\u2019s compensation claim to the employee, employer, or insurer who are parties to the claim or to<\/p>\n
the Department of Labor and Industry. A patient authorization is not required as consent is implied when a claim is filed. A request for copies of health care<\/p>\n
records must be in writing. Health care information not directly related to the specific injury or disability should not be released without authorization of the<\/p>\n
patient. In addition, only written data, which exists at the time the request is made, shall be released. Future information may be released only with another<\/p>\n
written request.
\nBoard of Medical Practice Requests
\nPhysicans have the obligation to comply fully with the Board of Medical Practice investigations. This includes providing copies of records, for which the Board of<\/p>\n
Medical Practice will pay usual and customary charges. The Board of Medical Practice generally obtains patient authorization for release of records for all patient<\/p>\n
initiated complaints. The Board of Medical Practice is not required to obtain patient authorization in investigation of Board initiated complaints. In this case, the<\/p>\n
releasing facility or provider should delete all patient identification information from the copies being released.<\/p>\n
HIPAA\u2019S PRIVACY RULE AND RELEASE OF INFORMATION
\nAUTHORIZATIONS
\nSECTION 164.508
\nUnless otherwise permitted, PHI may not be used or disclosed without a valid authorization.
\nSpecial rules apply to:
\n\u2022\tdisclosure of psychotherapy notes
\n\u2022\tMarketing
\nSeven Core Elements of a Valid Authorization
\n1.\tA description of information to be used or disclosed
\n2.\tThe identification of the person or class of persons authorized to make the use or disclosure of the PHI
\n3.\tThe identification of the persons or class of persons to whom the covered entity is authorized to make the use or disclosure
\n4.\tA description of each purpose of the use or disclosure
\n5.\tAn expiration date or event
\n6.\tThe individual\u2019s signature and date
\n7.\tIf signed by a person representative, a description of his\/her authority to act for the individual
\nThree Required Statements of a Valid Authorization
\n1.\tAn individual may revoke an authorization in writing. Plus:
\na.\tAn additional statement regarding the exceptions to an individual\u2019s right to revoke and specific instructions on how to revoke or
\nb.\tA reference to the covered entity\u2019s Notice of Privacy Practices, if this information is included
\n2.\tTreatment, payment, enrollment, or eligibility of benefits may not be conditioned on obtaining the individual\u2019s authorization. (In other words, one cannot say<\/p>\n
\u201csign this or we won\u2019t treat you\u201d or \u201csign this or we won\u2019t cover your care.\u201d
\nOR:
\nWhere the Privacy Rule allows for such conditioning, delineation of the specific consequences to an individual if he\/she refuses to sign the authorization form
\n3.\tThe potential for the PHI to be redisclosed by the recipient and thus, no longer protected under the Privacy Rule
\nAn example of a redisclosure:
\nYou send patient information to Happy Hospital. Two years later Happy Hospital includes that information in a disclosure to an attorney. (This should not happen
\nbut it could. We should never disclose information we received from another facility. The requestor should go back to that facility for that information)
\nOther Considerations for a Valid Authorization
\n\u2022\tAll authorizations \u201cmust be in plain language\u201d
\n\u2022\tOther elements or information may be included as long as they are not in conflict with requirements
\nCombined Authorizations
\nIn general, an authorization for use and disclosure of PHI may not be combined with any other document to create a compound authorization except for:
\n\u2022\tResearch
\n\u2022\tPsychotherapy notes
\n\u2022\tAnother authorization under Section 164.508
\nDocumentation Requirements
\n\u2022\tA copy of the signed authorization form can be given to the patient or individual
\n\u2022\tCovered entities must document and retain all signed authorizations for a period of six years from date of creation or when last in effect, whichever is later.
\nRevoking an Authorization
\nRevocation of an authorization is allowed at any time as long as:
\n\u2022\tIt is requested by the individual in writing
\n\u2022\tUnless:
\n\u2022\tThe covered entity has already taken action based on the originally-signed authorization or
\n\u2022\tWhen the authorization was obtained as a condition of obtaining insurance coverage
\nWhen is Use\/Disclosure of PHI Allowed Without an Authorization
\n\u2022\tFor treatment, payment or health care operations (TPO)
\n\u2022\tFor public health or health oversight activities
\n\u2022\tWhen use is for victims of abuse, neglect or domestic violence or other persons at risk
\n\u2022\tFor judicial and administrative proceedings
\n\u2022\tTo employers (under certain conditions)
\n\u2022\tFor use by coroners, medical examiners, and funeral directors in the case of deceased persons
\n\u2022\tFor cadaveric organ, eye, or tissue donation
\n\u2022\tTo avert a serious threat to public health or safety
\nWhen is Use\/Disclosure of PHI Allowed Without an Authorization
\n\u2022\tFor law enforcement purposes
\n\u2022\tFor Workers\u2019 Compensation and specialized government functions
\n\u2022\tAs otherwise required by law
\n\u2022\tFor research (waiver approval required)
\nMINIMUM NECESSARY
\nSECTION 164.514
\n\u2022\tA covered entity must make reasonable efforts to limit access of PHI to that which is minimally necessary to meet the purpose of the use or disclosure
\n\u2022\t\u201cMinimum\u201d determination need not be made for reasonable requests made by public officials, other CE\u2019s, members of workforce, business associates, or<\/p>\n
researchers
\n\u2022\tA covered entity may not use, disclose, or request an entire medical record unless need for such is specifically justified
\nACCOUNTING OF DISCLOSURES
\nSECTION 164.528
\nMust be able to provide individuals with a record of disclosures for a period of six (or fewer) years prior to the date of their request.
\nWhat must be included in a disclosure accounting?
\n\u2022\tDate of each disclosure
\n\u2022\tName of the organization or person who received the PHI
\n\u2022\tAddress of the organization or person who received the PHI
\n\u2022\tA brief description of the information disclosed
\n\u2022\tA brief statement of the purpose of the disclosure
\nCharges for an Accounting of Disclosure
\n\u2022\tIndividuals have a right to receive one free accounting per 12 month period
\n\u2022\tFor each additional request within a 12 month period the covered entity may charge a reasonable, cost-based fee.
\n\u2022\tIf a fee is charged, the covered entity must inform the individual of the fee in advance
\nRetrieval and Copying of PHI
\n\u2022\tA \u201creasonable, cost-based fee\u201d for requested copies may be charged
\n\u2022\tFor a summary or explanation of PHI, a preparation fee may be charged
\n\u2022\tCosts associated with searching for and retrieving the requested information may not be charge to patients
\n\u2003
\nCharges for ROI
\n\u2022\tYou may charge for search and retrieval and preparation time
\n\u2022\tYou may charge per page for the copies
\n\u2022\tCheck with your state statues to find out what are considered to be reasonable charges
\n\u2022\tMany states have set guidelines on what you may charge per page<\/p>\n","protected":false},"excerpt":{"rendered":"
Health Information Management Review the HIPAA and ROI material provided on the Release of Information (ROI) page this week. It is a HIPAA rule that all health information release must be tracked. It is technically called an Accounting of Disclosure. Read More …<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-237111","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/www.benedictsol.com\/blogs\/wp-json\/wp\/v2\/posts\/237111","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.benedictsol.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.benedictsol.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.benedictsol.com\/blogs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.benedictsol.com\/blogs\/wp-json\/wp\/v2\/comments?post=237111"}],"version-history":[{"count":0,"href":"https:\/\/www.benedictsol.com\/blogs\/wp-json\/wp\/v2\/posts\/237111\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.benedictsol.com\/blogs\/wp-json\/wp\/v2\/media?parent=237111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.benedictsol.com\/blogs\/wp-json\/wp\/v2\/categories?post=237111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.benedictsol.com\/blogs\/wp-json\/wp\/v2\/tags?post=237111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}