UTMB HANDBOOK OF OPERATING PROCEDURE

Section 6 Compliance Policies Subject 6.2 Privacy Related Policy 6.2.2 Use and Disclosure of PHI to Family and Friends for Individual Care and Notification Purposes

04/11/03 - Originated 08/31/07 - Reviewed w/changes - Reviewed w/o changes Compliance Office - Author

Use and Disclosure of PHI– to Family and Friends for Individual Care and Notification Purposes

Definition

Personal Representative: Any adult who has decision-making capacity and who is willing to act on behalf of a patient. A personal representative would include an individual who has authority, by law or by agreement from the individual receiving treatment, to act in the place of the individual. This includes parents, legal guardians or properly appointed agents, such as those identified in Medical Power of Attorney documents, or individuals designated by state law. Protected Health Information (PHI): Individually identifiable health information transmitted or maintained in any form or medium, including oral, written, and electronic. Individually identifiable health information relates to an individual’s health status or condition, furnishing health services to an individual or paying or administering health care benefits to an individual. Information is considered PHI where there is a reasonable basis to believe the information can be used to identify an individual. Demographic information on patients is also considered PHI.

Policy

In limited instances, UTMB may disclose certain Protected Health Information (PHI) without the patient’s written authorization to individuals who are not affiliated with UTMB. However, UTMB must obtain the oral agreement of the patient or the patient’s personal representative prior to using or disclosing the PHI. The instances when UTMB is permitted to disclose PHI under this policy are for the following purposes: 1. Disclosures by UTMB of PHI directly relevant to the person’s involvement with the patient’s care or payment related to the patient’s health care, and 2. Disclosures of PHI to notify or to assist in the notification of a family member, a personal representative of the patient, or another person responsible for the care of the patient of the patient’s location, general condition or death of the patient. The following sections of this policy outline the requirements for disclosing PHI for the purposes listed above. Violation of this policy may result in disciplinary action up to and including termination for employees; a termination of employment relationship in the

Policy, continued	case of contractors or consultants; or suspension or expulsion in the case of a student. Additionally, individuals may be subject to loss of access privileges and civil and/or criminal prosecution.
Disclosures When the Patient is Present (e.g. actually present or has capacity)	For the disclosures to be permitted under the HIPAA Privacy Regulations, UTMB may disclose PHI to family and friends who are involved in the patient’s care or for notification purposes if: 1. Opportunity to Agree or Object: a. UTMB provides the patient or the personal representative the opportunity to agree or reject the disclosure of PHI BEFORE the disclosure is made, b. A UTMB healthcare provider provides the patient with the opportunity to object to the disclosure, and the patient does not express an objection BEFORE the disclosure is made, or c. UTMB obtained the patient’s oral agreement to the disclosure prior to the patient becoming incapacitated to make healthcare decisions BEFORE the disclosure is made. 2. Exercise of Professional Judgment. A UTMB healthcare provider can disclose PHI to family and friends who are involved in the patients’ care or for notification purposes if the healthcare provider reasonably infers from the circumstances that the patient does not object to the disclosure based on the exercise of professional judgment.
Disclosures when the Patient or Personal Representative is not Present (e.g. not actually present or is incapacitated)	If the patient is not present or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the patient’s incapacity or an emergency circumstance, UTMB may exercise professional judgment, determine whether the disclosure is in the best interest of the patient. If a UTMB healthcare provider determines the use or disclosure is in the best interest of the patient, the UTMB healthcare provider may disclose only the PHI that is directly relevant to the person’s involvement with the patient’s health care or may disclose only the PHI that is directly relevant for notification of the patient’s location, general condition or death of the patient. UTMB may use professional judgment and its experience with common practice to make reasonable inferences of the patient’s best interest in allowing a person to act on behalf of the patient; (e.g. picking up prescriptions, obtaining medical supplies, x-rays, or other similar forms of PHI).
Reference	45 C.F.R. §164.510 IHOP Policy 6.2.4, Use and Disclosure of PHI for Patient Directories