HIPAAs Allowable Public Interest Disclosures 164512Authorization or O - PDF document

1 HIPAA’s Allowable “Public Interest Discl
HIPAA’s Allowable “Public Interest Disclosures” 164.512Authorization or Opportunity to CE may use or disclose PHI without written auagree or object - for this section When CE is required to inform individual, or when individual may agree to use or disclosure in this section, CE’s information and individual’s agreement may be given CE may use or disclose - if required by law and use/disclosure complies with and is limited to relevant requirements of the law Must meet requirement for disclosures about victims of abuse, neglect or domestic violence (c), disclosures for judicial and administrative proceedings (e), or disclosures for law enforcement purposes law to collect/receive information government agency that is acting in collaboration with public health authority. nment authority authorized by law to Person who may have been exposed to communicable disease if CE or Employer if: th care to the individual at evaluation relating to medical surveillance of workplace or evalrelated illness/injury PHI consists of findings concerning work-related illness or injury Employer needs findings to comply with federal or state law medical surveillance of workplace and work-related illnesses and requirements apply) ospective student if PHI is limited to proof of documents agreement to disclosure from parent, guardian or inemancipated minor) If CE also public health authority – CE i

2 s permitted to use PHI in all cases in w
s permitted to use PHI in all cases in which it is permitted to disclose it for public health activities Public health authority- an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate. CE may disclose PHI to government authority about individual whom they reasonably believe to be a victim of abuse, neglect or domestic violence (includes social service or protective services agency) ry to prevent serious harm to information is not intended to be used against them and there is an immediate enforcement activity Informing individual: CE must promptly inform individual if such a disclosure (above) is made except if: CE believes informing individual wCE would be informing personal therefore informing PR would not be Permitted disclosures: to health oversight agency for oversight activities Audits Civil, administrative or criminal investigations Licensure or disciplinary actions Civil, administrative or crimhealth care system government benefit programs (for which health information is entitie

3 s subject to government regulatory progr
s subject to government regulatory programs -- for which health information is necessary to determine compliance with program standards, or entities subject to civil rights laws for which health information is necessary for determining compliance investigation/other activity in which individual is health care, claim for public benefits related to health public benefits when patient’s health is integral to claim for public benefits or services Joint activities or investigations: if health oversight activity/investigation ation relating to claim joint activity considered health oversight Permitted Uses: If CE is also health oversight agency, CE may use PHI for health oversight activities of this section Health oversight agency- an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is Standard: Disclosures for jud

4 icial and administrative proceedings Pe
icial and administrative proceedings Permitted disclosures – CE may disclose PHI in course of a judicial or administrative proceeding in response to: 1) order of court or administrative court/tribunal) if: om party seeking information that reasonable efforts have been made to ensure individual who is subject of om party seeking information that reasonable efforts have been made to sfrom party seeking PHI that party requesting info if CE receives written statement and documentation that: Party requesting information has made good faith attempt to Notice included sufficient information about litigation to permit e court or administrative tribunal, Time for individual to raise objections to court or administrative CE considered to have received satisfactory assurance if receives written statement and accompanying documentation that parties have agreed to qualified protective order from such court or administrative tribunal Qualified protective order - an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that: (A) Prohibits parties from using or disclosing the PHI for any purpose other than the litigation or proceeding for which the information was requested; and (B) Requires the return to the CE or destruction of the PHI (including all copies made) at the end of litigation or proceeding CE may

5 disclose PHI in response to lawful proce
disclose PHI in response to lawful process satisfactory assurance if CE makes rindividual or seek qualified protective order otherwise permit or restrict Standard: Disclosures for law enforcement purposes -for a law enforcement purpose to a law enforcement official if following conditions are met: 1. Permitted disclosures: Pursuant to process and as otherwise required by law a. CE may disclose PHI as required by law including laws that require reporting 1. (b)(1)(ii)[public health authority authorized by law to receive reports of child abuse or neglect] and (c)(1)(i) [required by law for victims of abuse, neglect and domestic violence] b. In compliance with and as limited by: 1. Court order or court-ordered warrant, or subpoena or summons issued by 3. Administrative request including administrative subpoena or summons, civil or authorized investigative demand or similar process authorized - Information sought is relevant and material to legitimate law enforcement inquiry - Request is specific and limited in scope to extent reasonably practicable - De-identified information cPermitted disclosures: Limited Information for identification and location purposes CE may disclose PHI in response to law enforcement official’s request for information for purposes of identifying or locating a suspect, fugitive, material witness or missing person CE may only disclose: Name

6 and address ABO blood type and rh factor
and address ABO blood type and rh factor Date and time of treatment Date and time of death (if applicable) e color, facial hair, scars, May NOT disclose DNA, dental records or typing, samples or Permitted disclosure: Victims of a crime CE may disclose in response to law enforcement official’s request for information about individual suspected to be victim of crime if: CE can’t obtain agreement due emergency circumstance if: Law enforcement official represents that he/she needs information to determine whether violation of law by a person other than the victim has occurred and this information won’t be used against victim; AND Law enforcement official represents that the activity that disclosure; AND Disclosure is in best interests of individual as determined by Permitted disclosure: Decedents – CE may disclose PHI about an individual who has died to a law enforcement official for purpose of alerting law enforcemendeath may have resulted from criminal conduct Permitted disclosure: Crime on premises CE may disclose to a law enforcement oconstitutes evidence of criminal conduct that occurred on premises of CE Permitted disclosure: Reporting crime in emergencies Note: not for crime on premises; instead deals with the provision of emergency health care in response to a medical emergency CE may disclose during provision of emeralert law enforcement to: Commission

7 and nature of a crime Location of crime
and nature of a crime Location of crime and/or victims If medical emergency is believe to be a result of abuse, neglect, or domestic violence of individual in need of emergency care – CE may disclose as per Uses and disclosures about Decedents Coroners and medical examiners CE may disclose to coroner or medical examiner for purpose of identifying deceased person, determining cause of death, or other duties authorized by law CE that is a coroner or medical examiner may use PHI for these purposes CE may disclose to funeral directors if consistent with law as necessary to carry out their duties with decedent CE may disclose prior to and in reasonUses and disclosures for CadaveriTo organ procurement organizations or others involved in procurement, of facilitating organ, eye or tissue donation or transplantation Uses and disclosures for Research Purposes Permitted uses and disclosures CE may use or disclose PHI for research, regardless of source of funding, if: Has members with varying backgrounds and appropriate professional competency as necessary to review the effect of the research protocol on and related interests; Includes at least one member who is embership criteria key to establishing this Reviews preparatory to research es of preparing for research no PHI is removed from CE premises and PHI used is Research on decedent’s information documentation of death of in

8 dividuals if CE requests this PHI sought
dividuals if CE requests this PHI sought is necessary for research purposes Documentation of waiver approval Criteria Use or disclosure involves no more than minimal risk to Plan to protect identifPlan to destroy identifiers at earliest possible date (unless necessary for research) Written assurance that PHI will not be further used/disclosed unless required by law, for authorized oversight of research program or for other permitted research Research could not be practically undertaken without the Research could not be practically undertaken without the Statement that waiver has been reviewed and approved under either normal or expedited process IRB must follow requirem Privacy board must review waiver at meeting where majority of members are present, majority of members Signature by chair of IRB or Permitted disclosures CE may use or disclose fodisclosure is: is necessary to prevent or lessen serious and imminent threat to health or safety of person or public Is necessary for law enforcement authorities to identify or apprehend Based on statement by individual admitting participation in violent crime that CE believe may have cause serious physical harm to victim, OR Appears that individual has escaped from correctional institution or from lawful custody Uses or disclosures not permitted In course of treatment to affect propensity to commit criminal Through request by ind

9 ividual to initiate or be referred for t
ividual to initiate or be referred for treatment, counseling or therapy Limit on information that may be disclosed Disclosure based on statement by individual must be limited to statement Presumption of good faith belief on behalf of CE r specialized government functions Armed forces personnel Separation or discharge from military service Foreign military personnel National security and intelligence activities Protective services for the President and others Medical suitability determinations If component of Department of State for medical suitability to component of Department of State To determine worldwide availability or availability for mandatory For family to accompany Foreign Service member abroad consistent with Foreign Service Act w enforcement custodial situations May disclose to correctional institution or law enforcement official having lawful custody of inmate or other individual IF correctiolaw enforcement official represents that PHI is necessary for: Provision of health care to individual Health and safety of individual or other inmates Health and safety of officers or employees or others at correctional institution Health and safety of individuals and officers or other persons responsible for transporting of inmates from one institution, Law enforcement on premises of correctional institution Administration and maintenance of safety, security and good or

10 der of the correctional institution Perm
der of the correctional institution Permitted uses A CE that is a correctional institution may use PHI of inmates for same purposes as they can disclose it No application after release This section does NOT apply once individual is no longer inmate – ie when released on parole, probation, supervised release or CEs that are government programs providing public benefits Health plan that is government program providing public benefits may disclose PHI relating to eligibility for or enrollment in health plan to another agency administering government program providing public benefits if sharing of information amongst agencies or maintenance of information in single or combined data system accessible to all agencies is CE that is government agency administering government program providing public benefits may disclose PHI relating to program to another CE that is government agency administering government program providing public benefits of programs serve same or similar populations and disclosure is necessary to coordinate CE functions of the programs or to improve administration and management relating to covered functions of the programs Standard: Disclosures for workers’ compensation CE may disclose PHI as authorized by and to extent necessary to comply with laws relating to workers’ compensation or similar programs established by law ries or illness without regard to