|
|
 |
|
UTMB HANDBOOK OF OPERATING PROCEDURES
|
Section 6 Compliance Policies
Subject 6.2 Privacy Related
Policy 6.2.26 Patient Rights Related to Protected Health Information
|
04/11/03 - Originated
07/06/07 - Reviewed w/changes
Compliance Office - Author
|
Patient Rights Related to Protected Health Information
Definitions
|
Designated Record Set: A group of records maintained by or for UTMB that are:
A. The medical records and billing records about patients maintained by or for UTMB;
B. The enrollment, payments, claims adjudication, and case or medical management record systems maintained by or for a health plan; or
C. Used, in whole or in part, by or for UTMB to make decisions about patients.
Protected Health Information (PHI): Individually identifiable health information transmitted or maintained in any form or medium, including oral, written, and electronic.
Restriction: Agreed upon limitation of UTMB’s ability to use and disclose PHI. For instance, UTMB and the patient may agree that the patient’s information is not to be used for certain Treatment, Payment or health care Operation (TOP) functions, (e.g., The patient may request UTMB not include their information in the Patient Directory.)
Treatment, Payment, and health care Operations (TPO): Three core functions of providing health care to patients. Treatment involves the administering, coordinating and management of health care services by UTMB for its patients. Payment includes any activities undertaken either by UTMB or a third party to obtain premiums, determine or fulfill its responsibility for coverage and the provision of benefits or to obtain or provide reimbursement for the provision of health care. Health care Operations are activities related to UTMB’s functions as a health care provider, including general administrative and business functions necessary for UTMB to remain a viable health care provider. For a more detailed definitions of TPO, see IHOP Policy 6.2.0, General Uses and Disclosures.
|
Policy
|
Patients are granted numerous rights as regards their protected health information (PHI) by HIPAA:
1. The right to inspect their PHI and to obtain a copy of it;
2. The right to request an amendment to their PHI;
3. The right to an Accounting of Disclosures made by UTMB;
4. The right to request restrictions on the uses and disclosures of their PHI made by UTMB;
5. The right to request that UTMB communicate with them about their PHI at an alternative location (i.e., at work instead of at home) or via alternative means (i.e., mail only); and
6. The right to receive a paper copy of UTMB's Notice of Privacy Practices even if the patient has requested the Notice electronically.
|
Patient Right to Access PHI
|
UTMB ensures that patients’ rights are protected by providing a process for patients (or legally-authorized representative on behalf of the patient) to inspect and receive a copy, at their expense, of the PHI in the patient’s designated record set. All personnel must strictly observe the following standards:
1. A patient has the right to inspect, or receive copies of PHI about the patient in a designated record set for as long as the PHI is maintained in the designated record set.
2. If UTMB does not maintain the PHI that is the subject of the patient’s request for access, and UTMB knows where the requested information is maintained, UTMB must inform the patient where to direct the request for access.
3. The patient must make the request in writing using the UTMB Authorization Form.
4. UTMB will process requests in accordance with Texas law, which is more stringent than HIPAA, including UTMB must act on the patient's request no later than the 15th business day after receipt and payment of the request.
5. If the patient agrees in advance, UTMB may provide the patient with a summary of the PHI requested, or may provide an explanation of the PHI to which access has been provided.
6. If the patient requests a copy of the PHI or agrees to a summary or explanation of such information, UTMB may impose a reasonable, cost-based fee, provided that the fee includes only the cost of:
|
Patient Right to Access PHI (continued)
|
a. Copying, including the cost of supplies for and labor of copying, the PHI requested. The fee schedule for these services is set by the State of Texas. To obtain the fee schedule contact Health Information Management (HIM);
b. Postage, if the patient has requested the copy, summary, or the explanation is mailed. The fee schedule for postage can be obtained from HIM; and
c. Preparing an explanation or summary of the PHI, if agreed to in advance by the patient
7. UTMB may deny a request to inspect or receive a copy in certain very limited circumstances. If denied access to PHI, UTMB will notify the patient in writing. If the patient requests that the denial be reviewed, UTMB may chose another licensed health care professional to review the request and the denial. The person conducting the review will not be the person who denied the original request.
8. UTMB may deny a patient’s request without providing the patient with an opportunity for review when:
a. The information is not part of the designated record set;
b. UTMB is acting under the direction of a correctional institution and the prisoner’s request to obtain a copy of PHI would jeopardize the patient, other prisoners, or the safety of any officer, employee, or other person at the correctional institution, or a person responsible for transporting the prisoner;
c. The patient agreed to a temporary denial of access when consenting to participate in research that includes treatment, and the research is not yet complete;
d. The records are subject to the Privacy Act of 1974 and the denial of access meets the requirements of that law;
e. The PHI was obtained from someone other than UTMB under a promise of confidentiality and access would likely reveal the source of the information.
|
Patient Right to Amend PHI
|
Patients have a right to amend information collected and maintained about them in their designated record set for as long as the PHI is maintained in the designated record set. All personnel must strictly observe the following standards:
1. UTMB must accept all requests to amend PHI in the designated record set but is not required to act on the individual’s request if it is determined that the PHI or record that is the subject of the request:
|
Patient Right to Amend PHI (continued)
|
a. Was not created by UTMB, unless the individual provides a reasonable basis to believe originator of the PHI is no longer available to act on the requested amendment;
b. Is accurate and complete.
2. Requests to amend PHI must be in writing with a reason to support a requested amendment. The request should be on the Request for Correction/Amendment of Protected Health Information (PHI) form and routed to HIM for processing; HIM will maintain original amendment requests forms.
3. UTMB must act on the request no later than 60 days after receipt of such a request. If UTMB is unable to act within the required time limit, UTMB may extend the time by no more than 30 days, provided that UTMB:
a. Provides the individual with a written statement of the reasons for the delay and the date by which action on the request will be completed; and
b. May have only one such extension of time for action on a request for an amendment.
4. If the amendment is granted, in whole or in part, UTMB must make the correction and inform the patient of the agreement in a timely manner. UTMB will distribute the correction to:
a. Persons identified by the individual as having received the PHI needing the amendment; and
b. Persons, including business associates, that UTMB knows have the PHI that is the subject of the amendment and that may have relied, or could foreseeably rely, on such information to the detriment of the individual.
5. If the requested amendment is denied, in whole or in part, UTMB must provide the individual with a timely written denial. The denial must use plain language and contain all elements required by HIPAA.
6. If UTMB is informed of an amendment granted by another Covered Entity, UTMB must document the amendment in the UTMB designated record set if UTMB has incorporated the outside Covered Entity’s PHI in the UTMB designated record set. If UTMB has not relied on another Covered Entity’s records, UTMB does not have to incorporate the amendment into the UTMB designated record set.
|
Accounting of Disclosures
|
1. Upon request, UTMB shall provide individuals with an accounting of PHI disclosures made by UTMB in the six years prior to the date of the request. UTMB must provide the first accounting to an individual in any 12-month period without charge. UTMB may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same individual within the 12-month period, provided that UTMB informs the individual in advance of the fee and provides the individual with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee. The fee schedule for these services is set by the State of Texas. To obtain the fee schedule contact Health Information Management (HIM).
2. UTMB must account for all disclosures of PHI, except for disclosures:
a. To carry out TPO, including referring physicians;
b. To individuals requesting their own PHI;
c. Incident to a use or disclosure otherwise permitted or required;
d. Pursuant to an authorization;
e. For a UTMB patient directory or to persons involved in the individual’s care or other notification purposes;
f. For national security or intelligence purposes in accordance with IHOP Policy 6.2.22, Use and Disclosure for Specialized Government Functions;
g. To correctional institutions or law enforcement officials in accordance with IHOP Policy 6.2.23, Use and Disclosure of PHI for Public Health & Safety;
h. As part of a limited data set in accordance with IHOP Policy 6.2.13, Use and Disclosure of Limited Data Set; or
i. That occurred prior to the compliance date of April 14, 2003.
3. UTMB personnel will document disclosures in accordance with #2 above in the Accounting of Disclosure module in MyUTMB. This module includes all fields that must be provided in the accounting of disclosure.
4. HIM will be responsible for receiving and processing request for accounting of disclosures.
5. UTMB must act on the individual’s request for an accounting, no later than 60 days after receipt of such a request, as follows.
|
Accounting of Disclosures (continued)
|
i. Provide the individual with the accounting requested; or
ii. If UTMB is unable to provide the accounting within the time required above, UTMB may extend the time to provide the accounting by no more than 30 days, provided that:
A. UTMB, within the time limit of 60 days, provides the individual with a written statement of the reasons for the delay and the date by which UTMB will provide the accounting; and
B. UTMB may have only one such extension of time for action on a request for an accounting.
6. UTMB must temporarily suspend an individual’s right to receive an accounting of disclosures made to a health oversight agency or law enforcement official if such agency or official provides UTMB with a written statement that such an accounting to the individual would be reasonably likely to impede the agency's activities. The written statement must specify the time for which such a suspension is required.
7. If the agency or official suspends an individual’s right to receive an accounting of disclosures and the statement is made orally, UTMB must:
A. Document the statement, including the identity of the agency or official making the statement;
B. Temporarily suspend the individual’s right to an accounting of disclosures subject to the statement; and
C. Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement from the suspending agency or official is submitted during the time period.
|
Right to Request a Restriction
|
1. UTMB must permit an individual to request that UTMB restrict:
A. Uses and disclosures of PHI about the individual to carry out TPO; and
B. Permitted uses and disclosures as outlined in IHOP Policy 6.2.4, Uses and Disclosures of PHI for Patient Directories, and IHOP policy 6.2.2, Use and
|
Right to Request a Restriction (continued)
|
2. UTMB is not required to agree to a restriction. If UTMB does agree to a restriction, UTMB must abide by such restriction except if the individual who requested the restriction is in need of emergency treatment and the restricted PHI is needed to provide emergency treatment. UTMB may use the restricted PHI itself or UTMB may disclose such restricted PHI to a health care provider to provide emergency treatment to the individual. If the restricted PHI is disclosed to another health care provider as outlined above, UTMB must request that the healthcare provided not further use or disclose the PHI.
3. The restriction request must include:
A. What information the patient wants to limit;
B. Whether the limitation is for UTMB’s use and/or disclosure of the information;
C. To whom the limits apply (for example, disclosures to your spouse); and
D. Patient contact address. A restriction request form is available electronically.
4. UTMB may terminate its agreement to a restriction if:
A. The patient agrees to or requests termination in writing;
B. The patient orally agrees to the termination and the oral agreement is documented; or
C. UTMB informs the patient that it is terminating the restriction. Any PHI created and received after the termination will not be restricted. However, any PHI created or received before the termination will remain restricted.
|
Request for Alternate Communication Location or Methods
|
1. A request for communications to an alternate location or by alternate means can occur anytime and requires a change in the patient’s designated address. UTMB must permit individuals to request and must accommodate reasonable requests.
2. The individual receiving a request from the patient for communications at an alternative location or by alternative means should ask the patient to complete the Request for Communications at an Alternative Location or by an Alternative Means form before processing the request.
|
Right to UTMB’s Notice of Privacy Practices of PHI
|
1. Patients have the right to a paper copy of UTMB’s Notice of Privacy Practices of PHI and may ask UTMB to provide a copy of this notice at any time even if already provided a copy of this notice.
2. Additional information regarding UTMB’s notice is contained in IHOP Policy 6.2.15, Use of Notice of Privacy Practices of PHI.
|
|
|
