1.050 Obtaining Authorization for Disclosure

Op10.04-7 Obtaining Disclosure

Purpose

It is the policy of Missouri State University (University) and the University’s Health Care Components (HCC) to protect the privacy of individually identifiable health information in compliance with federal and state laws governing the use and disclosure of Protected Health Information (PHI) and confidentiality. It is also the policy of the HCC to provide for the patient’s voluntary authorization for use or disclosure of his or her protected health information (PHI) as set out in 45 CFR Sections 164.508; 164.510; and 164.512. Whether PHI may be used or disclosed is subject to the review of the Director, Supervisor, Unit Privacy Officer, or designee.

Application

The University’s HCC

  1. Definitions
    1. Patient: any individual who has received or is receiving services from an HCC.
    2. Disclosure: the release, transfer, provision of access to, or divulging in any other manner of information outside the HCC holding the information.
    3. Psychotherapy notes: Notes recorded in any medium by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the patient’s medical record. Such notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress notes to date.
    4. PHI: As defined in HIPAA Procedure 1.005, 1.b. and c.
  2. Procedure
    1. The HCCs may not use or disclose PHI without a valid authorization completed by the patient, or applicable personal representative, with limited exceptions. The standard authorization form is attached. The Unit Privacy Officer should obtain written information regarding the identity of the requestor, the date of the request, the nature and purpose of the request and any authority that the requestor has to request such information, consistent with Verification Procedures. If other staff receives a completed authorization form for the release of PHI, they shall direct it to the HCC Director, Unit Privacy Officer, or representative for review.
    2. Any disclosures that occur shall be limited to the minimum amount of information necessary to meet the purpose of the use or disclosure.
      1. Exceptions to the minimum necessary requirement are as follows:
      2. When the patient authorizes the disclosure;
      3. Disclosures required by law.
    3. The HCC must obtain an authorization for any use or disclosure or psychotherapy notes except:
      1. To carry out treatment, payment or health care operations;
      2. For the HCC to use in defending itself in litigation or other proceedings brought by the patient.
    4. PHI may only be disclosed without authorization in the following situations unless authorized by the NPP and HIPAA Procedure 1.005:
      1. To a public health authority (e.g., required reporting to the Missouri Department of Health and Senior Services, FDA, communicable diseases), per § 164.512(b);
      2. To report child abuse/neglect situations, and other situations involving abuse, neglect or domestic violence (if disclosure is allowed by law), per § 164.512(c);
      3. To a health oversight agency, per § 164.512(d);
      4. In response to order of judicial or administrative tribunal (or a subpoena or discovery request if satisfactory assurances of notice to the individual pursuant to § 164.512(e));
      5. To law enforcement (but only in certain circumstances; including when they present a grand jury subpoena; information concerning forensic clients; to locate a missing person, suspect, or fugitive; or at the discretion of the Director of the HCC when the information is requested to assist law enforcement in their investigation, per § 164.512(f));
      6. To medical examiners, coroners and funeral directors, per § 164.512(g);
      7. For organ donation, per § 164.512(h);
      8. For research purposes, per § 164.512(i) and policy 8.055;
      9. To avert a serious threat to health or safety, per § 164.512(j);
      10. Governmental functions (such as national security; veterans information, eligibility for public assistance programs), per § 164.512(k);
      11. To comply with worker’s compensation laws, per § 164.512(l);
      12. As required by law, per § 164.512(a).
  3. Any questions as to whether a use or disclosure is permitted or required by law should be directed to the University Privacy Officer and/or University legal counsel.
  4. If it is the HCC that requests that the patient complete the authorization, the facility must provide the patient with a copy of the signed authorization.
  5. Review Process. The University Privacy Officer will collect information from the Unit Privacy Officers during the month of April each year beginning in 2004 for the purpose of providing feedback to the HIPAA Management Team as to compliance with the procedure and any proposed modification or recommendation that additional training be implemented.
  6. Sanctions. Any person found to have violated the requirements of this policy shall be subject to disciplinary action up to and including dismissal.

HISTORY: Effective March 21, 2003