UTMB HANDBOOK OF OPERATING PROCEDURES

Section 6 Compliance Policies Subject 6.2 Privacy Related Policy 6.2.18 Use & Disclosure of PHI for Fundraising

04/11/03 - Originated 10/08/07 - Reviewed w/changes - Reviewed w/o changes Compliance Office - Author

Use and Disclosure of PHI for Fundraising

Policy

In general, UTMB may not use or disclose a patient’s Protected Healthcare Information (PHI) for fundraising purposes without specific authorization from the patient or legally authorized representative. In some cases, UTMB fundraising personnel may use and disclose limited PHI including dates of treatment and demographic information in connection with fundraising activities. Demographic information generally includes name, address, other contact information, age, gender, and insurance status. Information about the department in which an individual received services also cannot be used for fundraising purposes without the patient’s prior authorization, if that information would reveal or could reveal the nature of the diagnosis, services or treatment that the individual received. Violation of this policy may result in disciplinary action up to and including termination for employees; a termination of employment relationship in the case of contractors or consultants; or suspension or expulsion in the case of a student. Additionally, individuals may be subject to loss of access privileges and civil and/or criminal prosecution.

Use & Disclosure Requirements

UTMB personnel and affiliated fundraising associates may: 1. Use a patient’s basic demographic information to solicit gifts. 2. Access patients’ dates of care. 3. Use public information outside its internal database to send fundraising requests without fear of violating this policy. UTMB personnel and affiliated fundraising associates must: 1. Include an opt-out provision along with the initial fundraising letter describing how individuals may opt out of receiving further fundraising materials. 2. Exclude information about diagnosis, nature of services, or treatment in any solicitation. 3. Remove patient’s information immediately from the mailing list upon receipt of an “opt out” clause; and 4. Sign an appropriate business associate contract before disclosing patient information to consultants or outside entities for

Use & Disclosure Requirements (cont’d)

fundraising activities (See Policy 6.1.4, Business Associates With Access to PHI). This contract is not necessary should UTMB employees or an institutionally related foundation perform the fundraising, which includes nonprofit foundations that raise only a portion of funds for UTMB. Information that CAN be used for fundraising without authorization or consent includes: • Name • Address • Other contact information (such as email, phone etc.) • Age • Gender • Insurance status • Date of service Information that CANNOT be used without authorization: • Diagnosis • Nature of services • Treatment • Place within hospital where patient receives treatment that specifically identifies that treatment, such as - Department of Psychiatry - Department of Obstetrics - Department of Radiation Oncology Information about a part of the hospital/area where treatment occurred may be used to filter names for fundraising as long as the department does not identify the type or nature of treatment. Caution should be used when divulging the matter of hospital area treatment. When a prospective contributor voluntarily discloses information about diagnosis and treatment to a member of UTMB’s fundraising staff, that information can then be used for other fundraising purposes.