UTMB HANDBOOK OF OPERATING PROCEDURES

Section 6 Compliance Subject 6.2 Privacy Related Policy 6.2.16 Permitted Uses and Disclosures in Special Situations

05/12/03-Originated 10/08/07 -Reviewed w/ changes -Reviewed w/o changes Compliance -Author

Permitted Uses and Disclosures in Special Situations

Policy

In general, under the HIPAA Privacy Regulations, Protected Health Information (PHI) can be used and disclosed in the following ways: • By UTMB, if the use and disclosure is for Treatment, Payment or healthcare Operations (TPO), • By UTMB, if the covered entity (UTMB) obtained the patient’s authorization; however, different requirements and limitations exist for oral or written authorization, and • By UTMB, if the use or disclosure meets “the permitted uses and disclosures” as enumerated by the HIPAA Regulations. There are several policies that address the specific requirements of uses and disclosures of PHI referenced above; however, this policy addresses when UTMB and its workforce are permitted to use and disclose PHI without the patient’s authorization in limited and special situations. The HIPAA regulations require an accounting of all disclosures based on the provisions listed below. UTMB has a procedure for documenting and accounting for such disclosures, please see IHOP Policy, Accounting of Disclosures of PHI, #6.2.28 for more information. If the requested information contains PHI, is not routinely disclosed in a department or service area and falls within a category listed below, do not disclose the PHI without notifying your supervisor and obtaining permission to disclose the PHI. If there is ever a question as to whether the information requested should be disclosed, contact the Office of Institutional Compliance. Violation of this policy may further result in disciplinary action up to and including termination for employees; a termination of employment relationship in the case of contractors or consultants; or suspension or expulsion in the case of a student. Additionally, individuals may be subject to loss of access privileges and civil and/or criminal prosecution.

As Required By Law

UTMB will use or disclose PHI when required to do so by federal, state, or local law.

Coroners, Medical Examiners and Funeral Directors.	UTMB may release PHI to a coroner or medical examiner to identify a deceased person or to determine the cause of death. UTMB may also release PHI about patients of UTMB to funeral directors as necessary to help them carry out their duties. If a coroner or medical examiner is undertaking an investigation and requires medical records, the coroner or medical examiner must request medical records pursuant to a valid subpoena or request medical records from Health Information Management (HIM) through a written request citing the statutory provision that grants them power to request and obtain information.
Correctional Institutions and Inmate PHI.	UTMB may disclose PHI to a correctional institution or a law enforcement official having lawful custody of an inmate or other individual’s PHI about such prisoner or individual, if the institution or law enforcement official represents that such PHI is necessary for: • The provision of health care to such individuals; • The health and safety of such individual or other inmates; • The health and safety of the officers or employees of or others at the correctional institution; • The health and safety of such individuals and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another; • Law enforcement on the premises of the correctional institution; and • The administration and maintenance of the safety, security, and good order of the correctional institution. Under the HIPAA privacy rules, an inmate’s PHI must be protected like any other patient’s PHI. For the purposes of this provision, an individual is no longer an inmate when released on parole, probation, supervised release, or otherwise is no longer in lawful custody.
Health Oversight Activities.	UTMB may disclose PHI to a health oversight agency for activities authorized by law such as audits, investigations, inspections and licensure related inquiries of UTMB or its employees. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws. In some instances, if a health oversight activity or investigation is related to a claim for public benefits not related to healthcare, a joint activity or investigation shall be considered a health oversight activity for purposes of this policy.

Lawsuits and Disputes.

If a patient is involved in a lawsuit or a dispute, UTMB may disclose PHI in response to a court or administrative order. UTMB may also disclose PHI in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell the patient about the request or to obtain an order protecting the information requested. The Department of Health Information Management (HIM) is responsible for the use or disclosure of all PHI related to subpoenas or other judicial activities. For more information regarding the use of disclosure of PHI related to judicial processes, see IHOP Policy 6.2.20.

Law Enforcement

UTMB may release PHI if asked to do so by a law enforcement official. If a law enforcement official requests a UTMB employee to use or disclose PHI, the UTMB employee must contact UTMB’s Office of Institutional Compliance or the Department of Legal Affairs before disclosing the PHI. Examples of when a law enforcement official may request PHI is: • in response to a court order, subpoena, warrant, summons or similar process; • as required by law to report certain types of wounds or other physical injuries; • to identify or locate a suspect, fugitive, material witness or missing person, but only if limited information (e.g., name and address, date and place of birth, Social Security number, blood type and RH factor, type of injury, date and time of treatment, description of distinguishing characteristics (height, weight, gender, race, hair and eye color, presence of absence of facial hair, scars and tattoos) and date and time of death, if applicable) is disclosed [the same characteristics may be disclosed by UTMB if a member of its workforce becomes a crime victim]; • about the victim of a crime if the individual agrees or if the individual is unable to agree because of incapacity or other emergency circumstance provided the law enforcement official represents that : • such information is needed to determine whether a violation of law by a person other than the victim has occurred and such information is not intended to be used against the victim

Law Enforcement, continued	• immediate law enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree, and • the disclosure is in the best interest of the individual as determined by the exercise of professional judgment by UTMB or its employees. • about a death we believe may be the result of criminal conduct; • about criminal conduct we believed occurred on UTMB’s premises; and • in emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.
Organ and Tissue Donation.	UTMB may release PHI to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank to facilitate organ or tissue donation and transplantation. See IHOP Policy 9.15.3, Authorization for Organ/Tissue Donations.
Public Health Activities	UTMB may disclose PHI for public health activities. For example, public health activities generally include: • preventing or controlling disease, injury or disability; • reporting births and deaths; • reporting child abuse or neglect; • reporting reactions to medications or problems with products; • notifying patients of recalls of products they may be using; • notifying governmental agencies, like the FDA, about product related adverse events or injuries; • notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; or • notifying the appropriate government authority if it is believed a patient has been the victim of abuse, neglect or domestic violence. If UTMB makes a disclosure based on these reasons, UTMB or its employees must notify the individual or the individual’s personal representative
Public Health Activities, continued	promptly, unless notice would place the individual at risk of serious harm based the exercise of professional judgment or UTMB reasonably believes the personal representative is responsible for the patient abuse, neglect or other injury and informing the personal representative would not be in the individual’s best interest.
Research	Under certain circumstances, UTMB may use and disclose PHI for research purposes. For more information on research disclosures, please see IHOP policy 6.2.30.

Specialized Governmental Functions.

• To Avert a Serious Threat to Health or Safety. UTMB may use and disclose PHI when necessary to prevent a serious threat to the individual, the health and safety of the public or another person. Any disclosure would only be permitted to law enforcement in order to help prevent the threat. • Armed Forces and Foreign Military Personnel. If an individual is a member of the armed forces, UTMB may disclose the individual’s PHI as required by military command authorities. UTMB may also disclose PHI about foreign military personnel to the appropriate foreign military authority. • National Security and Intelligence Activities. UTMB may disclose PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law. • Protective Services for the President and Others. UTMB may disclose PHI to authorized federal officials so they may provide protection to the President of the United States, other authorized persons or foreign heads of state, or to conduct special investigations.

Whistleblowers.

A member of UTMB’s workforce or a UTMB business associate may disclose PHI of UTMB patients if the individual believes in good faith that UTMB has engaged in conduct that is unlawful, violates professional or clinical standards, or the care it provides endangers its patients, its workers, or the public. The disclosure must be made to a health oversight agency or a public health authority authorized by law to investigate the relevant conduct, an appropriate health care accreditation organization to report the failure to meet professional standards or misconduct, or an attorney retained by the workforce member or the business associate for the purpose of determining the legal options regarding the reporting of the improper conduct.

Workers' Compensation.	UTMB may disclose PHI for workers' compensation or similar programs. These programs provide benefits for work-related injuries or illness.
References	45 CFR 164.512; the HIPAA Privacy Standards.