UTMB HANDBOOK OF OPERATING PROCEDURES

Section 6 Compliance Policies Subject 6.2 Privacy Related Policy 6.2.14 Minimum Necessary Use & Disclosure of PHI

05/12/03 - Originated 08/31/07 - Reviewed w/ changes - Reviewed w/o changes Compliance Office - Author

Minimum Necessary Use & Disclosure of PHI

Definitions

Protected Health Information (PHI): Individually identifiable health information transmitted or maintained in any form or medium, including oral, written, and electronic. Individually identifiable health information relates to an individual’s health status or condition, furnishing health services to an individual or paying or administering health care benefits to an individual. Information is considered PHI where there is a reasonable basis to believe the information can be used to identify an individual. Demographic information on patients is also considered PHI.

Policy

When using or disclosing PHI or when requesting PHI from another entity UTMB and its employees must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. UTMB will determine what access levels to PHI are needed by its employees to carry out work duties. Access to the PHI will be granted based on the individual’s role and determined by the department head. Violation of this policy may result in disciplinary action up to and including termination for employees; a termination of employment relationship in the case of contractors or consultants; or suspension or expulsion in the case of a student. Additionally, individuals may be subject to loss of access privileges and civil and/or criminal prosecution.

When Minimum Necessary Applies

The minimum necessary rule applies to all aspects of PHI including: Requests for Uses or Disclosures of PHI: All requests for the use and disclosure of PHI must follow UTMB policy outlined in IHOP Policy, 6.2.0, General Policy on the Use and Disclosure of PHI. UTMB personnel must only use and disclosure the minimum amount of PHI necessary to complete the request. For requests requiring patient authorization. UTMB must limit the use and disclosure of PHI as described in the patient authorization. a) Requests for Uses or Disclosures of Entire Medical Records – Medical record custodians must not release the entire medical record to internal departments or business associates unless such release is necessary. For example, a health care

When Minimum Necessary applies, continued

provider should request the specific volume containing the time period of the particular patient visit at issue, instead of the entire set of volumes. Good Faith Reliance – The medical record custodian may rely on the belief that the PHI requested is the minimum amount necessary to accomplish the purpose of the request when: a) The information is requested by another person previously approved for access; b) The information is requested by a professional (such as an attorney or accountant) providing professional services either as an employee or as a business associate; c) Making disclosure to entities or agencies health related purposes that do not require authorization, or opportunity to agree or object and the entity or agency that the information is the minimum necessary or is required by law; d) IRB or privacy board documentation represents that proposed research meets the minimum necessary standard; e) A requester asserts that the information is necessary to prepare a research protocol; or f) A requester asserts the information is for research on decedents. Disclosures for Payment: Only the minimum necessary PHI shall be disclosed for payment functions, as provided through contractual agreement. Persons handling PHI in a payment context shall refrain from publicizing patient diagnosis information. This policy shall apply to checks collected, credit card paper receipts, and envelopes and invoices sent to consumers. Disclosures Required by Law: Disclosures Ordered by a Court or Administrative Tribunal - The minimum necessary standard does not apply to disclosures ordered from an administrative tribunal or by order of court. Only the information directly requested by such an order is to be provided. PHI About a Victim of a Crime or Abuse - The minimum necessary standard shall apply to information released to law enforcement regarding victims of crime or abuse. However, if the law requires information to be released, then the disclosure will be in compliance with the subpoena, statute, or law. Disclosures for Worker’s Compensation: PHI may be disclosed to comply with Worker’s Compensation laws and regulations without consent, authorization, or opportunity to

When Minimum Necessary Applies, continued

object by the patient, but such disclosure shall only be the minimum necessary. Requests for entire records should be scrutinized and approved by the medical record custodian. Disclosures to Family and Friends Persons with access to PHI and authority to disclose PHI may only make disclosures in accordance with IHOP Policy 6.2.2, Use and Disclosures of PHI to Family and Friends for Individual Care and Notification Purposes. Minimum Necessary Use and Disclosure for Students: Students and trainees are to adhere to the minimum necessary standard. Students and trainees are not exempt from following the rules outlined in this policy. Students are considered to be part of the treatment process if they are actively involved in the patient’s care, and therefore are not limited in their access or use of the patient’s medical information. Minimum Necessary Use and Disclosure for Educational Purposes Faculty, staff, students, and trainees are to use de-identified information when in a classroom setting, and the patient’s identifying information (i.e. name, DOB, address, etc.) is not needed for the educational purpose. Reference IHOP Policy 6.2.29, De-identification of PHI.

When Minimum Necessary does not apply

The minimum necessary provision shall not apply to the uses and disclosures of PHI for: 1. Treatment purposes; 2. Information requested by the individual to whom it belongs; 3. Information described with details and requested pursuant to a valid patient authorization; 4. Compliance with standardized HIPAA Transactions; 5. Required disclosures to the Department of Health and Human Services (DHHS) for enforcement purposes; or 6. Instances required by law.

References

45 C.F.R. §164.514(b) 45 C.F.R. §164.514(d) 45 C.F.R. §164.506 45 C.F.R. §164.512(b) 45 C.F.R. §164.512(f)(3) 45 C.F.R. §164.512(l)