Free preview: HIPAA Privacy Rule Compliance Policy

Policy Statement

[Practice Name] must use and disclose PHI only as permitted or required by the HIPAA Privacy Rule. The two required disclosures are: to the patient (or personal representative) who requests access to their own PHI, and to the Secretary of the U.S. Department of Health and Human Services for compliance investigations. All other disclosures are either permitted under specific Privacy Rule provisions or require the patient's written authorization.

The [Role, e.g. Privacy Official] is accountable for this policy, serves as the contact for privacy complaints, and must resolve workforce questions about permissibility before an uncertain disclosure is made. When a workforce member is unsure whether a disclosure is permitted, the member must withhold the disclosure and escalate to the [Role, e.g. Privacy Official] the same business day. Violations of this policy are subject to the Sanction Policy.

Permitted Uses and Disclosures: Treatment, Payment, and Health Care Operations

Workforce members may use and disclose PHI without patient authorization for the practice's own treatment, payment, and health care operations (TPO), and in the specific cross-entity situations listed below.

• Treatment: providers, nurses, and medical assistants may share PHI as needed to treat the patient, including sending referrals to specialists, transmitting orders and receiving results from [Lab vendor] and imaging centers, conducting telehealth visits, coordinating with a covering physician after hours, and sending prescriptions to pharmacies. Treatment disclosures to another treating provider are not subject to the minimum necessary standard.
• Payment: billing staff may disclose PHI to submit claims, verify eligibility, obtain prior authorizations, respond to payer documentation requests, and pursue collections, limited to the minimum necessary for each task.
• Health care operations: PHI may be used for the practice's own quality review, peer review, training, audits, compliance activities, and business planning. Disclosures for another covered entity's operations are permitted only when both entities have or had a relationship with the patient and the disclosure relates to that relationship or to fraud and abuse detection.
• Other permitted disclosures (each must be routed through the [Role, e.g. Privacy Official] before release unless emergent): disclosures required by law, public health reporting such as immunization registries and communicable disease reports to [State health department], reports of abuse or neglect, health oversight audits, responses to valid court orders or compliant subpoenas, certain law enforcement requests, workers' compensation, and disclosures to avert a serious and imminent threat.
• Disclosures to family and friends involved in the patient's care are permitted when the patient agrees, is given the opportunity to object and does not, or, when the patient is not present or is incapacitated, when the provider judges disclosure of directly relevant information to be in the patient's best interest.

Uses and Disclosures Requiring Written Authorization

Any use or disclosure not described in this policy as permitted or required must be made only with a valid, signed authorization on the practice's authorization form. Treatment may never be conditioned on signing an authorization, except for research-related treatment as permitted by the Privacy Rule.

• Authorization is always required for: marketing communications involving payment from a third party, any sale of PHI, disclosure of psychotherapy notes (with narrow exceptions), and disclosures to employers, attorneys, life insurers, or other third parties outside TPO.
• A valid authorization must identify the information to be disclosed, the recipient, the purpose, an expiration date or event, and the patient's signature and date, and must state the right to revoke and the potential for redisclosure.
• Patients may revoke an authorization in writing at any time; the [Role, e.g. Privacy Official] must log the revocation and stop further disclosures the same business day, except to the extent the practice has already acted in reliance on it.
• Signed authorizations and revocations must be retained for at least 6 years from the later of creation or last effective date.

Minimum Necessary Standard

For all uses, disclosures, and requests other than treatment disclosures, disclosures to the patient, disclosures under an authorization, and disclosures required by law, workforce members must limit PHI to the minimum necessary to accomplish the purpose. Role-based access in the [EHR system] implements this standard and is governed in detail by the ePHI Access Control Policy and the Workforce Security and Access Authorization Policy.