HCA PROGRAM GUIDELINES FOR PROCESSING
PROTECTED HEALTH INFORMATION
REQUESTS
TABLE OF CONTENTS
I. Introduction
II. Restrictions to Use and Disclosure of PHI
III. Access to and Copies of PHI
IV. Amending PHI
V. Accounting for Disclosures of PHI
VI. Designated Record Set
I. INTRODUCTION
The HCA Program Guidelines for Processing Requests Related to Protected Health Information (PHI) is a step-by-step procedure intended to provide consistent and compliant instruction to staff throughout the Agency. These guidelines address the patient’s rights to request access to and control of their medical information as defined by Federal and State law.
II. RESTRICTIONS TO USE AND DISCLOSURE OF PHI
A. PROCESSING REQUESTS FOR RESTRICTIONS TO USE AND DISCLOSURE OF PHI
Federal Regulations (45 CFR §164.522) provide individuals the right to request restrictions on the use and disclosure of the protected health information in the individual’s designated record set. HCA is not required to agree to the restriction(s) requested.
HCA cannot agree to a restriction that would impede a use or disclosure required by law. If HCA agrees to a restriction, it cannot use or disclose PHI in violation of the restriction, except in an emergency treatment situation.
EXAMPLE: HCA may agree to a request not to use or disclose PHI to an individual’s private insurance with the understanding that treatment will be paid for by the individual directly.
If restricted PHI is disclosed in an emergency situation, HCA must request that the restricted information not be further used or disclosed.
45 CFR §164.522(b) provides individuals the right to request an alternative means of communication, intended to maintain the individual’s confidentiality. Such requests must be made in writing and documented in the individual’s medical record. HCA is required to agree to reasonable requests for confidential communications.
EXAMPLE: A reasonable request for alternative confidential communication might be to contact the individual via his/her cell phone, and not to call his/her home phone where family members might answer.
Processing Requests for Restrictions on Use and Disclosure of PHI
· The client or his/her personal representative must complete and sign the Request for Special Restriction on Use and Disclosure of Protected Health Information form.
· Designated program staff, working with the Custodian of Records, reviews the request and determines if the restriction request should be approved.
· The Custodian of records, using the Response to Request for Special Restriction on Use and Disclosure of Protected Health Information form, notifies the individual of the decision (whether agreed to or denied) regarding their request for special restrictions.
· The Custodian of Records and Program shall maintain a copy of the Request for Restrictions form. Program shall file its copy in the patient records.
Processing Requests to Terminate Restrictions to Use and Disclose PHI
· HCA or the individual may initiate termination of restrictions on use and disclosure of individual’s PHI.
· Termination of a special restriction must be documented on the Termination of Special Restriction form, including the method of termination (i.e. orally or in writing).
· If HCA is terminating the restriction, program staff must complete the Termination of Special Restriction form indicating that HCA is initiating this action. The signed Termination form must be provided to Custodian of Records for processing and notification to the individual.
· The affected program implements the termination effective only with respect to PHI created or received after the individual is notified of the termination.
· The Custodian of Records and program maintains copies of the Termination of Special Restrictions form. Program shall file its copy in the client’s record.
B. Requests for Restrictions on the Manner and Method of Communication
· The client or his/her personal representative must complete and sign the Request for Restriction on the Manner/Method of Confidential Communication form.
· Designated program staff reviews the request and determines if the request is reasonable and confirms that the alternative method of communication is clear.
· Documentation of the alternative communication method must be made available to all staff that may have need to communicate with the individual.
· The Custodian of Records and program maintains copies of the Request for Restrictions on the Manner/Method of Confidential Communication form. Program shall file its copy in the client’s record.
C. Documentation and Retention of Records
The State of California retention guidelines require that medical records must be maintained for seven (7) years from the last date of service for adults and for minors up to age of 19 or for seven years from the last date of service whichever is longer.
III. ACCESS TO AND COPIES OF PHI
A. PROCESSING REQUESTS FOR Access TO PROTECTED HEALTH INFORMATION (phi)
Federal and State Regulations provide individuals the right to access their PHI maintained in the designated record set, either to inspect those records or to obtain copies of those records. HCA may deny access without providing an opportunity for a review of the denial, or may deny access with an opportunity for a review of the denial.
Requests for Access to Review PHI/Medical Record
· The client or his/her personal representative must complete and sign the Authorization to Use and Disclose Protected Health Information form and submit the form to Custodian of Records.
· Designated program staff, working with Custodian of Records, will review the request and determine if access will be granted based on 45 CFR §164.524.
· When access is granted, program staff sends a signed and completed Record Release Approval Form to the Custodian of Records.
· The Custodian of Records notifies the requesting party of the access decision in writing.
· When access is granted, the requesting party is instructed to contact the designated program staff to schedule a date and time for review.
· The review of PHI takes place at the service location and must be monitored by program staff.
· The Custodian of Records and program shall maintain copies of the Authorization to Use and Disclose Protected Health Information, Record Release Approval Form and forms/letters notifying the requesting party of the approval to review PHI. Program shall its copies in the client’s record.
Requests for Copies of PHI/Medical Record
[Processing requests for copies of PHI for treatment purposes are discussed below in Section B.]
· The client or his/her personal representative must complete and sign the Authorization to Use and Disclose Protected Health Information form and submit the form to the Custodian of Records.
· Designated program staff, working with Custodian of Records, will review the request and determine if access will be granted based on 45 CFR §164.524.
· When request for copies is granted, program staff makes copies of the requested items and forwards them along with a signed and completed Record Release Approval Form to the Custodian of Records.
· The Custodian of Records prepares an invoice for the cost of the copies provided plus postage (based on the HCA Fee Schedule) and submits the invoice to the requesting party for payment prior to release of the PHI copies.
· Upon receipt of payment the Custodian of Records forwards the requested copies of PHI to the authorized party(s).
· The Custodian of Records and program shall maintain copies of the Authorization to Use and Disclose Protected Health Information and the Records Release Approval. Program shall file its copies in the client’s record.
Denial of Requests for Access
HIPAA regulations allow that access to PHI may be denied without a Right to Review in specific circumstances. HIPAA regulations also allow that access to PHI may be denied with a Right to Review. When access is denied, in whole or in part, program staff shall send a written explanation to the Custodian of Records.
· Denial Process
o Program staff completes and signs the Record Release Approval Form noting the reasons for denial. Health and Safety Code §123115(b) requires that program document in the individual’s chart:
- the date of the request,
- an explanation of denial, and
- a description of the specific adverse or detrimental consequences anticipated should access be permitted.
o Program staff forwards the signed and completed Records Release Approval and Authorization to Use and Disclose Protected Health Information forms to the Custodian of Records and files a copy of each form in the client’s chart.
o Program staff may determine that the client’s clinician should notify the client of the denial of access. Otherwise the Custodian of Records will provide notification. Notification of denial of access must be in writing and must include the basis for the denial. If a Right of Review exists, the notification must include the process by which the individual may exercise their Right of Review. If access to PHI is denied in part, the individual must be given access to the other PHI requested in accordance with the above outlined procedure.
Denial – Without a Right of Review
· Under HIPAA regulations, individuals have no right to access and no Right of Review for the following:
o Psychotherapy notes as defined under HIPAA;
o information compiled in reasonable anticipation of or for use in civil, criminal or administrative action or proceedings;
o PHI maintained by entity covered under the Clinical Laboratory Improvements Amendments (CLIA), which allows laboratories to release lab test results only to the ordering provider.
· In correctional facilities, when an inmate/ward requests access to his/her PHI, denial without the Right of Review may be implemented when access to the PHI might:
o Jeopardize the health, safety, security, custody or rehabilitation of the individual or other inmates/wards or
o Jeopardize the safety of an officer, employee, or other person at the correctional institution, or responsible for transporting the inmate/ward.
· In the course of research that includes treatment of the individual, access to PHI may be temporarily suspended for as long as the research is in progress. The individual must agree to a suspension of the right of access during the research period and the health care provider must inform the individual that the right to access will be reinstated upon completion of the research.
· When denial of access is for PHI contained in records subject to the Privacy Act and meets the requirements of the Privacy Act.
· When denial of access is for PHI that was obtained from someone, other than a health care provider, under a promise of confidentiality and access to the PHI would be likely to reveal the source of the information.
Denial – Subject to Right of Review
· When a licensed health care professional determines, in the exercise of professional judgment, that access to PHI is reasonably likely to endanger the life or physical safety of the individual or another person.
· When the PHI makes reference to another person (someone other than the individual who is the subject of the PHI or the health care provider), and a licensed health care professional determines, in the exercise of professional judgment, that access is reasonably likely to cause harm to that other person.
· When a Personal Representative requests access to PHI and a licensed health care professional determines, in the exercise of professional judgment, that such access is reasonably likely to cause substantial harm to the individual or another person.
· Access may be denied to a Personal Representative of a minor when:
o The minor has consented to the treatment as mandated by State law, and therefore, has the right of access to the PHI.
o The representative’s access to the PHI is thought to have a detrimental affect on the provider’s professional relationship with the minor or the minor’s physical safety or psychological well-being.
Review of the Denial Process
If the basis for denial grants the individual a Right of Review, the individual can request to have the denial reviewed by a licensed health care professional. HCA designates a health care professional, who did not participate in the original decision, to act as the Reviewing Official.
· The client or his/her personal representative must submit a written request through the Custodian of Records office for a Review of Denial to Access to PHI.
· Upon receipt of such written request, the Custodian of Records informs program and arranges for review of denial by the Reviewing Official.
· The Reviewing Official must make a determination whether or not to uphold the denial of access (in whole or in part) in a reasonable period of time.
· The Reviewing Official’s written determination is provided to the Custodian of Records, who will work with the Reviewing Official to notify the individual of the determination. The Custodian of Records shall take immediate action, as required, to carry out the determination. Copies of documentation shall be maintained by Custodian of Records and by program in the client’s record.
B. PROCESSING REQUESTS FOR COPIES OF PHI FOR TREATMENT PURPOSES
When an individual is presenting at clinic with a request for treatment records such as physical examinations, x-rays, lab test results and/or Immunization records
· An Authorization to Use and Disclose Protected Health Information form shall be completed and signed by individual or personal representative.
· Verification of identity and/or authority as personal representative shall be reviewed and documented (i.e. driver’s license, photo ID).
· Copy of the requested PHI is provided and noted on Authorization to Use and Disclose PHI form as released.
· Copy of Authorization to Use and Disclose PHI form is forwarded to Custodian of Records.
· Copy of Authorization to Use and Disclose PHI form is filed in the client’s record.
IV. AMENDING PHI
A. PROCESSING REQUESTS TO AMEND PHI
Federal Regulations, 45 CFR §164.526, provide individuals the right to request an amendment of the protected health information (PHI) in the individual’s designated record set. Amendments will be reviewed for acceptance or denial per the following.
Requests to Amendment PHI/Medical Record
· The client or his/her personal representative must complete and sign the Request to Amend Protected Health Information form requesting an amendment be made and a reason to support the requested amendment.