Tweet
Disagree with me all you want to, Wufan and Kung, but here's some background:
Cited:
Authorization. A covered entity must obtain the individual’s written authorization
for any use or disclosure of protected health information that is not for treatment,
payment or health care operations or otherwise permitted or required by the Privacy
Rule.44 A covered entity may not condition treatment, payment, enrollment, or
benefits eligibility on an individual granting an authorization, except in limited
circumstances.45
An authorization must be written in specific terms. It may allow use and disclosure
of protected health information by the covered entity seeking the authorization, or by
a third party. Examples of disclosures that would require an individual’s
authorization include disclosures to a life insurer for coverage purposes, disclosures
to an employer of the results of a pre-employment physical or lab test, or disclosures
to a pharmaceutical firm for their own marketing purposes.
All authorizations must be in plain language, and contain specific information
regarding the information to be disclosed or used, the person(s) disclosing and
receiving the information, expiration, right to revoke in writing, and other data. The
Privacy Rule contains transition provisions applicable to authorizations and other
express legal permissions obtained prior to April 14, 2003. 46
Here's more regarding minimum necessary disclosure of unformation:
"Minimum Necessary. A central aspect of the Privacy Rule is the principle of
“minimum necessary” use and disclosure. A covered entity must make reasonable
efforts to use, disclose, and request only the minimum amount of protected health
information needed to accomplish the intended purpose of the use, disclosure, or
request.50 A covered entity must develop and implement policies and procedures to
reasonably limit uses and disclosures to the minimum necessary. When the minimum
necessary standard applies to a use or disclosure, a covered entity may not use,
disclose, or request the entire medical record for a particular purpose, unless it can
specifically justify the whole record as the amount reasonably needed for the purpose.
See OCR “Minimum Necessary” Guidance.
The minimum necessary requirement is not imposed in any of the following
circumstances: (a) disclosure to or a request by a health care provider for treatment;
(b) disclosure to an individual who is the subject of the information, or the
individual’s personal representative; (c) use or disclosure made pursuant to an
authorization; (d) disclosure to HHS for complaint investigation, compliance review
or enforcement; (e) use or disclosure that is required by law; or (f) use or disclosure
required for compliance with the HIPAA Transactions Rule or other HIPAA
Administrative Simplification Rules.
Access and Uses. For internal uses, a covered entity must develop and implement
policies and procedures that restrict access and uses of protected health information
based on the specific roles of the members of their workforce. These policies and
procedures must identify the persons, or classes of persons, in the workforce who
need access to protected health information to carry out their duties, the categories of
OCR Privacy Rule Summary 11 Last Revised 05/03
protected health information to which access is needed, and any conditions under
which they need the information to do their jobs.
Disclosures and Requests for Disclosures. Covered entities must establish and
implement policies and procedures (which may be standard protocols) for routine,
recurring disclosures, or requests for disclosures, that limits the protected health
information disclosed to that which is the minimum amount reasonably necessary to
achieve the purpose of the disclosure. Individual review of each disclosure is not
required. For non-routine, non-recurring disclosures, or requests for disclosures that
it makes, covered entities must develop criteria designed to limit disclosures to the
information reasonably necessary to accomplish the purpose of the disclosure and
review each of these requests individually in accordance with the established criteria.
Reasonable Reliance. If another covered entity makes a request for protected health
information, a covered entity may rely, if reasonable under the circumstances, on the
request as complying with this minimum necessary standard. Similarly, a covered
entity may rely upon requests as being the minimum necessary protected health
information from: (a) a public official, (b) a professional (such as an attorney or
accountant) who is the covered entity’s business associate, seeking the information to
provide services to or for the covered entity; or (c) a researcher who provides the
documentation or representation required by the Privacy Rule for research."
Again, if this isn't a violation of HIPPA, it should run afoul of hospital policy.
No matter how you try to spin it, the purpose of legal and compliance functions is to prevent occurrence of situations where the perception exists that a violation might have occurred.
Of course Kung probably hates compliance people, he probably thinks they're bureaucrats.
Cited:
Authorization. A covered entity must obtain the individual’s written authorization
for any use or disclosure of protected health information that is not for treatment,
payment or health care operations or otherwise permitted or required by the Privacy
Rule.44 A covered entity may not condition treatment, payment, enrollment, or
benefits eligibility on an individual granting an authorization, except in limited
circumstances.45
An authorization must be written in specific terms. It may allow use and disclosure
of protected health information by the covered entity seeking the authorization, or by
a third party. Examples of disclosures that would require an individual’s
authorization include disclosures to a life insurer for coverage purposes, disclosures
to an employer of the results of a pre-employment physical or lab test, or disclosures
to a pharmaceutical firm for their own marketing purposes.
All authorizations must be in plain language, and contain specific information
regarding the information to be disclosed or used, the person(s) disclosing and
receiving the information, expiration, right to revoke in writing, and other data. The
Privacy Rule contains transition provisions applicable to authorizations and other
express legal permissions obtained prior to April 14, 2003. 46
Here's more regarding minimum necessary disclosure of unformation:
"Minimum Necessary. A central aspect of the Privacy Rule is the principle of
“minimum necessary” use and disclosure. A covered entity must make reasonable
efforts to use, disclose, and request only the minimum amount of protected health
information needed to accomplish the intended purpose of the use, disclosure, or
request.50 A covered entity must develop and implement policies and procedures to
reasonably limit uses and disclosures to the minimum necessary. When the minimum
necessary standard applies to a use or disclosure, a covered entity may not use,
disclose, or request the entire medical record for a particular purpose, unless it can
specifically justify the whole record as the amount reasonably needed for the purpose.
See OCR “Minimum Necessary” Guidance.
The minimum necessary requirement is not imposed in any of the following
circumstances: (a) disclosure to or a request by a health care provider for treatment;
(b) disclosure to an individual who is the subject of the information, or the
individual’s personal representative; (c) use or disclosure made pursuant to an
authorization; (d) disclosure to HHS for complaint investigation, compliance review
or enforcement; (e) use or disclosure that is required by law; or (f) use or disclosure
required for compliance with the HIPAA Transactions Rule or other HIPAA
Administrative Simplification Rules.
Access and Uses. For internal uses, a covered entity must develop and implement
policies and procedures that restrict access and uses of protected health information
based on the specific roles of the members of their workforce. These policies and
procedures must identify the persons, or classes of persons, in the workforce who
need access to protected health information to carry out their duties, the categories of
OCR Privacy Rule Summary 11 Last Revised 05/03
protected health information to which access is needed, and any conditions under
which they need the information to do their jobs.
Disclosures and Requests for Disclosures. Covered entities must establish and
implement policies and procedures (which may be standard protocols) for routine,
recurring disclosures, or requests for disclosures, that limits the protected health
information disclosed to that which is the minimum amount reasonably necessary to
achieve the purpose of the disclosure. Individual review of each disclosure is not
required. For non-routine, non-recurring disclosures, or requests for disclosures that
it makes, covered entities must develop criteria designed to limit disclosures to the
information reasonably necessary to accomplish the purpose of the disclosure and
review each of these requests individually in accordance with the established criteria.
Reasonable Reliance. If another covered entity makes a request for protected health
information, a covered entity may rely, if reasonable under the circumstances, on the
request as complying with this minimum necessary standard. Similarly, a covered
entity may rely upon requests as being the minimum necessary protected health
information from: (a) a public official, (b) a professional (such as an attorney or
accountant) who is the covered entity’s business associate, seeking the information to
provide services to or for the covered entity; or (c) a researcher who provides the
documentation or representation required by the Privacy Rule for research."
Again, if this isn't a violation of HIPPA, it should run afoul of hospital policy.
No matter how you try to spin it, the purpose of legal and compliance functions is to prevent occurrence of situations where the perception exists that a violation might have occurred.
Of course Kung probably hates compliance people, he probably thinks they're bureaucrats.
Comment