This policy describes the general principles of Perham Health's protections for privacy of health care information, and it implements the privacy provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). It is Perham Health's policy to protect privacy of medical records and other personal health information of its patients without jeopardizing patients' access to health care or the quality of their health care.
This policy applies to Perham Health and Perham Living. It applies to all individually identifiable health care information, whether oral, written or electronic. It applies to all activities involving the use or disclosure of protected health information (PHI), even if Perham Health has contracted with other businesses or individuals to perform some of those functions.
In order to protect patient privacy, Perham Living will use and disclose PHI in accordance with the requirements of this policy.
PERMITTED USE AND DISCLOSURE OF INFORMATION
Perham Health is permitted to use PHI for its own treatment, payment, and health care operations. It is also permitted to use and disclose PHI for treatment and payment activities of other non-Perham Health providers, and for certain health care operations of other non-Perham Living and Perham Health providers, as described below. These uses do not require authorization from the patient.
For uses or disclosures of protected health information other than for treatment, payment and health care operations, or as otherwise permitted by this policy, Perham Health will obtain patient authorization. Authorization is explained further in this policy.
Perham Health may use PHI for its own treatment of patients. Treatment means providing, coordinating, or managing health care and related services by health care providers. Treatment includes services by those with direct and indirect relationships to the patient. Indirect treatment includes those who deliver health care based on the orders of another treatment provider, or those who deliver services, products, or reports on diagnosis or results of studies to another health care provider who is directly treating the patient. Treatment includes coordination and management of health care among providers or with a third party, consultations between health care providers, and referrals from one health care provider to another.
Perham Health may also disclose PHI to non-Perham Health providers for the treatment activities of those providers. For example, a Perham Health primary care physician may send PHI of an individual to a non-Perham Health specialist who needs the information to treat that individual.
Perham Health may use and disclose PHI for payment for its own services, and for payment of other non-Perham Health health care providers. Payment includes such things as billing, claims management, collection, determining eligibility for coverage, risk adjustment and utilization review.
Health care operations
Perham Health may use and disclose PHI as necessary for its own health care operations. Health care operations include but are not limited to quality assessment, development of clinical guidelines or protocols, population-based activities to improve health or reduce costs, contacting patients with information about treatment alternatives, evaluating and reviewing practitioner qualifications and performance, conducting training, performing certification and accreditation activities, underwriting and premium rating, medical review, legal services, auditing, fraud and abuse detection and compliance, business planning and development, administrative activities, and due diligence for sale or transfer of assets.
To a limited extent, Perham Health may disclose PHI to other non-Perham health care providers for the health care operations of those providers.
Amount of information used or disclosed
Perham Health will take reasonable safeguards to prevent the improper use or disclosure, whether intentional or inadvertent, of PHI of its patients. For routine or recurring uses and disclosures of PHI, employees will follow Perham Health's standard policies and procedures for disclosure. A case-by-case review of the information to be used or disclosed is not required. Non-routine disclosures of information will limit the PHI used or disclosed to the amount reasonably necessary to accomplish the purpose of the disclosure, and these non-routine disclosures will be reviewed on an individual basis by Perham Health's, Health Information System Release of Information staff.
Perham Health will identify which uses and disclosures are routine or recurring and covered by standard policies and procedures. Examples of routine uses and disclosures include access by Perham Health physicians and nurses for treatment purposes, exchange of information between health care providers for treatment purposes, and access to treatment information for reimbursement and payment.
Physicians, nurses, and others involved in treatment may have access to a patient's entire record, as needed. Others who are involved indirectly in treatment or involved in payment or health care operations will have access to and use of PHI based upon their role(s) in the organization.
Employees who are not involved in treatment of patients but who require PHI for other activities will make reasonable efforts to limit use, disclosure, or requests of PHI to the minimum necessary for the intended purpose.
Oral communications must occur freely and quickly for effective and high quality care. Perham Health's providers will communicate orally whenever necessary for appropriate treatment, but will take reasonable steps to minimize disclosure of information to others who may be nearby who are not involved in treatment. These steps include not using patient's names in public hallways and elevators, speaking quietly when discussing a patient's condition with family members in a waiting room or public area, asking patients to stand back at registration desks or pharmacy counters until their turn, and using available curtains or cubicles in areas where multiple patients are seen.
Psychotherapy notes are treated differently for privacy purposes than other parts of a medical record. Psychotherapy notes are notes of conversation during private counseling or group, joint or family counseling and which are kept separate from the rest of the patient's medical record. They do not include medication prescription and monitoring, start and stop times of counseling sessions, type and frequency of treatment, results of clinical tests, or summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date.
Psychotherapy notes by a mental health professional may be used as part of treatment or health care operations only for three purposes: 1) by the creator of the notes for treatment purposes, 2) in training programs for mental health trainees under supervision, or 3) to defend a legal proceeding brought by the patient. For purposes other than treatment or health care operations, psychotherapy notes may be disclosed in certain limited circumstances required or allowed by law, as listed below. Otherwise, psychotherapy notes may not be used or disclosed to anyone else, even within Perham Health, without a patient authorization.
Perham Health may use or disclose psychotherapy notes without authorization:
When required by the Secretary of DHHS (Dept. of Health and Human Services) to investigate compliance with privacy regulations
When required by law
When requested by a health oversight agency in order to oversee the author of the notes
To coroners regarding a deceased individual
To prevent a serious and imminent threat
Perham Health psychotherapy providers will keep psychotherapy notes in a separate section of patients' medical records.
Access to PHI and disclosure of PHI for minors (patients under age 18) will be handled according to state law (Minnesota law at Minnesota sites; North Dakota law at North Dakota sites). Refer to Perham Health's Informed Consent policy for guidance. When the patient is a minor, the patient's parent, guardian or authorized representative is the person authorized to give consent and authorization for use of the minor's PHI. However, the minor patient himself or herself is the person authorized to give authorization if:
The minor is emancipated (married, has borne a child, or is living away from home and managing own financial affairs)
The minor lawfully may obtain the healthcare services without consent of a parent or guardian, and the minor, a court, or other authorized person has consented to the services (for example, in North Dakota a minor age 14 or older and in Minnesota a minor of any age may obtain treatment for chemical dependency or sexually transmitted diseases without parental consent)
The minor's parent, guardian or authorized representative has assented to an agreement of confidentiality between the minor and the healthcare provider
Perham Health reasonably believes that the parent, guardian or authorized representative has abused or neglected the minor, or that dealing with the adult as legal representative could endanger the minor or would not be in the minor's best interests.
If a person has the legal authority to act on behalf of a patient (such as a guardian, substituted decision maker or a person with durable power of attorney for health care), that person is the representative permitted to authorize use and disclosure of the patient's PHI. Perham Health will seek authorization from that representative, unless Perham Health reasonably believes that the representative has abused or neglected the patient, or that dealing with the representative could endanger the patient or would not be in the patient's best interests.
A person who is legally authorized to act on behalf of a deceased patient or the patient's estate is the person authorized to give consent and authorization for use of the patient's PHI.
NOTICE OF PRIVACY
Perham Health will provide individuals with notice of the uses and disclosures that may be made of the individual's PHI, of the individual's rights, and of Perham Health's responsibilities regarding privacy of PHI.
This notice will be provided in writing in a Notice of Privacy Practices. The notice of privacy practices will be in plain language, and will be posted in a clear and prominent location at Perham Health sites. A copy of the Notice of Privacy Practices is attached to this policy.
Perham Health will obtain a written acknowledgment that the individual has received this notice. Direct treatment providers at Perham Health will make good faith efforts to obtain this acknowledgment at the time of first delivery of health care services to an individual. If the first delivery of service is not in person, but provided electronically, Perham Health will obtain electronic acknowledgment of receipt of the notice. Perham Health need not provide notice and obtain acknowledgment in emergency treatment situations. If an emergency exists, Perham Health will provide notice when reasonably practical after the emergency.
If an individual refuses to sign or provide an acknowledgment of receipt of the privacy notice, Perham Health may still proceed with treatment and permitted uses and disclosures of information. In such cases, Perham Health will document the good faith efforts to obtain an acknowledgment and the reason it could not be obtained (such as "patient refused to sign after being requested to do so.")
In general, authorizations are required for any use and disclosure of health care information for purposes other than treatment, payment, or health care operations. Perham Health will not use or disclose PHI without a valid authorization from the patient, except as provided in this policy. An authorization specifies the uses and disclosures permitted by the patient and the PHI that may be used or disclosed.
Authorization is required for use or disclosure of psychotherapy notes, with some exceptions. See Psychotherapy Notes section in this policy.
A valid authorization will be in plain language and will include these basic requirements:
A specific description of the information to be used or disclosed
Name or other specific identification of the entity authorized to use or disclose PHI
Name or other specific identification of the entity to whom Perham Health may disclose or make use of PHI
Description of each purpose of the requested use or disclosure. (If authorization is at patient's request, patient need not state a purpose; authorization may simply state "at the request of the individual.")
Expiration date or event
Statement of the patient's right to revoke the authorization in writing
Description of how to revoke and exceptions to the right to revoke, or reference to that information in the notice of privacy
Statement that treatment, payment, enrollment or eligibility may not be conditioned on signing the authorization in most circumstances or a description of consequences of refusal to sign, when conditioning of treatment, enrollment or eligibility is permitted
Signature of the patient or patient's authorized representative. If a representative, it will include a description of that person's authority
Date of signature
Patient's refusal to give authorization
Perham Health may not refuse treatment, payment, enrollment, or eligibility of a patient if a patient refuses to give an authorization, except that:
Research related treatment may be conditioned on an authorization
Health plan enrollment or eligibility may be conditioned on authorization, if authorization is requested before enrollment, and is sought for eligibility, enrollment, underwriting, or risk rating, and is not for psychotherapy notes
Payment may be conditioned on authorization if disclosure is necessary to determine payment and authorization is not for psychotherapy notes
Healthcare solely for the purpose of creating PHI for disclosure to a third party may be conditioned on authorization
Revocation of authorization
A patient may revoke an authorization at any time, except to the extent Perham Health has already acted in reliance on it. The revocation must be in writing.
Amount of information used or disclosed
When a patient authorizes disclosure of PHI, Perham Health will disclose the information requested, and will not make an independent determination of how much information is needed for that purpose.
Authorization requested by Perham Health
If Perham Health requests an authorization from an individual for PHI, it will provide a copy of the signed authorization to the individual.
USE AND DISCLOSURE WITHOUT AUTHORIZATION
Perham Health is permitted by law to use and disclose PHI for certain public health and public protection purposes. Perham may disclose PHI without patient authorization, and without opportunity for the patient to agree or object, in the following circumstances:
When required by law, as long as the use and disclosure is limited to the requirements of the law
To public health authorities who are authorized to receive such information
To the FDA or those subject to FDA jurisdiction to report adverse events, track products, allow product recalls, repairs or replacements, or conduct surveillance
To a person exposed to a communicable disease if permitted by law
To an employer for medical surveillance under limited conditions
To an authorized government authority concerning victims of abuse, neglect or domestic violence if permitted by law
For health oversight activities authorized by law
In judicial and administrative proceedings in response to a court order or order of an administrative court, as long as the information produced is limited to the scope of the order
In judicial and administrative proceedings in response to a subpoena or discovery request if certain conditions are met
For law enforcement purposes:
if required by law
in compliance with certain warrants, subpoenas, or administrative requests
to help locate a fugitive, missing person or material witness as long as only limited information is provided
regarding suspected crime victims
to notify of a death suspected to be due to criminal conduct
to report crime in an emergency
To coroners, medical examiners, and funeral directors
For organ donation or procurement
For research under limited conditions
To avoid a serious threat to health or safety
Perham Health may disclose PHI without patient consent or authorization in the following circumstances, but must allow the patient an opportunity to agree or object, or restrict the disclosure:
In Perham Health's directory, limited to the patient's name, location (except for exclusively psychiatric, chemical dependency, or communicable disease treatment areas), condition in general terms only, and religious affiliation. This information, except for religious affiliation, may be given to those who ask for the patient by name. Religious affiliation may be given to members of the clergy
To family members, friends, or others identified by the patient if the information is directly related to that person's involvement in care or payment, or to notify that person of the patient's location, general condition, or death
For disaster relief purposes
Perham Health must disclose PHI to a patient who requests his/her own information (except for psychotherapy notes, information compiled in anticipation of legal proceedings, and when otherwise prohibited by law) and to DHHS for enforcement of federal privacy standards. A patient may request a copy of his/her PHI, or to inspect the PHI, or an accounting of disclosures made of the PHI.
Authorizations for psychotherapy notes may be combined only with other authorizations regarding other psychotherapy notes.
PATIENT RESTRICTIONS ON USE OF PROTECTED HEALTH INFORMATION
A patient may request Perham Health to restrict use or disclosure of protected health information for treatment, payment and operations, or disclosures to relatives or close friends involved with care or payment. Perham Health is not required to accept those restrictions. If it does accept restrictions, however, it must follow them except in certain emergencies. A restriction, once agreed to by Perham Health, may be terminated only with the patient's agreement (in writing, or orally, and documented in writing) or by informing the patient that Perham Health will no longer agree to the restriction. Perham Health may only terminate a patient's restriction as to PHI created or received after it notifies the patient the restriction is terminated.
A patient may not restrict, even by special request, these uses of PHI:
Disclosures required by law (such as abuse or neglect reporting, judicial and administrative proceedings, and law enforcement purposes)
Disclosures to authorized public health authorities
Disclosures to an authorized health oversight agency
Disclosures about deceased individuals to authorized persons such as coroners and funeral directors
Disclosures related to organ or tissue donation
Disclosures for research purposes when permitted by law
Disclosures to avert serious threats to health or safety