MARSHALLTOWN MEDICAL & SURGICAL CENTER Marshalltown Iowa ADMINISTRATIVE POLICY AND PROCEDURE

MARSHALLTOWN MEDICAL & SURGICAL CENTER Marshalltown Iowa ADMINISTRATIVE POLICY AND PROCEDURE Policy Number: 330 SUBJECT: TRACKING AND ACCOUNTING FOR DISCLOSURES OF PROTECTED HEALTH INFORMATION POLICY HIPAA grants individuals the right to request an accounting of certain disclosures that Marshalltown Medical & Surgical Center makes of their protected health information. MMSC shall establish procedures to document that such disclosures have been made, and will account and arrange for business associates to account pursuant to the following procedures. DEFINITIONS Protected health information means individually identifiable health information about an individual, regardless of whether it is gathered, stored or transmitted in written, electronic, or even oral form. Health Information Management (HIM) refers to the function of record maintenance, whether it is a department of MMSC or a function within Home Care Plus or the clinics. Treatment means: Furnishing preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, and furnishing counseling, assessment or other procedures with respect to the physical or mental condition or functional status of an individual or that affects the structure or function of the body; and Sale or dispensing of a drug, device, equipment or other item in accordance with a prescription. Payment means activities undertaken by a provider to obtain payment for health care. Examples include: Preparing and submitting claims and attachments to support payment. Obtaining certification of enrollment or coverage and obtaining pre-certification for treatment. Inquiring about an individual s coverage or benefits. Pursuing collection through an attorney or collection agency. Reporting limited information to a collection bureau. Participating in utilization management, claims adjudication, risk sharing and coordination of benefits activities. Health care operations means the following activities when related to MMSC s covered functions: Quality assessment activities, utilization management activities and activities designed to monitor or improve quality or reduce costs. Peer review activities and activities to evaluate the competence or qualifications of health care professionals. Conducting or arranging for audit functions, compliance functions, legal functions and medical reviews. Business planning, management and general administrative activities of MMSC. Fundraising for MMSC. Note This is a partial listing of health care operations activities. See the Privacy Officer for help applying the definition to actual uses and disclosures. 1

EXCEPTIONS TO THE ACCOUNTING OF DISCLOSURE Not all disclosures are subject to an accounting. Typical disclosures like those for our treatment, payment and health care operations, or even for the treatment, payment or health care operations of others are not subject to an accounting. Disclosures made pursuant to a valid authorization signed by the patient are not subject to an accounting. These are the exceptions as stated in 164.528(a) To carry out treatment, payment and health care operations as provided in 164.506; To individuals of protected health information about them as provided in 164.502; Pursuant to an authorization as provided in 164.508; For the facility s directory or to persons involved in the individual s care or other notification purposes as provided in 164.510; For national security or intelligence purposes as provided in 164.512(k)(2); To correctional institutions or law enforcement officials as provided in 164.512(k)(5); That occurred prior to the compliance date for the covered entity; Incidental Disclosures 164.502; As part of a Limited Data Set (LDS) 164.514(e). DISCLOSURES SUBJECT TO AN ACCOUNTING 1. The following disclosures, whether made by MMSC or a business associate of MMSC, are subject to the patient s right to request an accounting: Uses and disclosures required by law, including reporting to mandatory registries Uses and disclosures for public health activities including surveillance, investigations, interventions, recording births, communicable disease reporting, FDA reporting of adverse events, registries Disclosures about victims of abuse, neglect or domestic violence Disclosures for health care oversight activities Disclosures for judicial and administrative proceedings; court orders, subpoenas Disclosures for law enforcement purposes; crime on premises, treatment for gun shot wounds Disclosures about decedents, including funeral home directors, medical examiner Disclosures for organ donation purposes Disclosures for research purposes Disclosures to avert a serious threat to health or safety Disclosures for certain specialized governmental functions Disclosures for workers compensation Improper disclosures of which MMSC is aware 2. The right to an accounting applies to disclosures made on or after April 14, 2003. 3. Disclosures in the form of limited data sets are not subject to the patient s right to an accounting, even if the disclosure is for one of the purposes listed above. PROCEDURES A. TRACKING DISCLOSURES 1. Each person who makes a disclosure of protected health information of a patient for one of the following purposes shall follow the procedures set forth in this policy to document the disclosure. (See other policies that establish procedures for making the following disclosures.) 2

2. Use the Disclosure Record to document disclosures that are subject to the patient s right to an accounting. Complete the Disclosure Record at the same time the disclosure is made and route the Disclosure Record to Health Information Management. The separate record must be created to ensure that an accounting of disclosures will be able to be determined accurately when requested by the patient. Logistically, documentation only within the record would be too difficult to decipher accurately and efficiently, as some records may run to thousands of pages encompassing several years of tests and treatment, and may be in various data bases and forms, such as paper, microfilm, or digital. The patient has the right to an accounting of all disclosures outside of treatment, payment or healthcare operations (as it is limitedly defined in the Privacy Rules) from April 14, 2003 forward, for a period of six years. 3. Content of Disclosure Tracking. The patient has the right to the following information for each disclosure subject to an accounting, so the Disclosure record will include the following information for all covered disclosures: Date of disclosure Name and address of person or entity to whom disclosure was made Brief description of the information disclosed Brief statement of the purpose of the disclosure This information must be clearly documented on the Disclosure form. 4. Everyone subject to HIPAA Privacy Policies who makes a disclosure is responsible to complete and file the Disclosure Record. 5. Each business associate of MMSC shall be required to maintain such Disclosure Records for each disclosure subject to the patient s right to an accounting at the time of the disclosure. They must be able to respond to our requests for individual disclosures when so asked, within a reasonable time period that will allow us to respond to the individual within 60 days. 6. Some registry disclosures are so large that it would be onerous for an individual Disclosure record to be completed for each patient s information at the time. Other departments might have a thorough system for tracking disclosures in place. For Rehab, Birth Certificate filing, and the EMS Registry, these databases will be kept for no less than six years, and will respond to HIM s request for an accounting if and when an individual requests one. If large databases are unable to respond to these just in time requests for an accounting, individual Disclosure Records will need to be created and routed to HIM. Any questions about Disclosure Records being completed concurrently or kept in a manner that an accurate and timely response is possible should be addressed to the Privacy Officer. No areas should undertake this without discussion with the Privacy Officer. HIM will can request an accounting from the relevant areas if and when a patient requests it. 7. If there is a question regarding whether a disclosure is subject to the accounting right, the Privacy Officer should be consulted. B. REQUESTS FOR AN ACCOUNTING OF DISCLOSURES 1. Initiating the Request. To initiate a request for an accounting, MMSC will direct individuals to submit a written request to Health Information Management using the Request for Accounting form. HIM will be responsible for processing all requests for access to protected health information in accordance with this policy. 3

2. Review for Completeness. When a Request for Accounting form is received, HIM will review the form for completeness. If any information is incomplete, HIM will notify the individual that we cannot process the incomplete request.. Attempts to contact the individual will be documented on the Request for Accounting form. 3. Identifying Accountable Disclosures. HIM will be responsible to identify disclosures which must be accounted for. Upon receipt of a Request HIM will check the patient s record to identify accountable disclosures. Some will be listed within the correspondence section of the patient s chart. Requests for disclosure tracking should be sent to Ambulance, Rehab, Nursery if the visit history indicates that the patient any of those services after April 14, 2003. Also, check with business associates, particularly the Iowa Hospital Association, to see if accountable disclosures have been made in the time period requested by the patient. All questions regarding the content of an accounting or whether a disclosure is subject to the patient s right to an accounting will be reviewed with the Privacy Officer. 4. Timeframe for Response. a. MMSC will respond to the request within sixty (60) days of the date the request was received. b. If HIM determines that MMSC is unable to respond to the request within sixty (60) days, the individual must be notified in writing that one 30-day extension is necessary to respond to the request and provided the reasons the extension is necessary. The extension notice shall state the date by which action on the request will be taken. 5. Responding to the Accounting Request. a. Content of Accounting. The accounting will include the following information for all covered disclosures: Date of disclosure Name and address of person or entity to whom disclosure was made Brief description of the information disclosed Brief statement of the purpose of the disclosure b. Multiple Disclosures to Same Entity. If MMSC has made multiple disclosures to the same entity during the requested accounting period, MMSC must provide the following information in response to a request for an accounting: For the first disclosure to the entity, the information in paragraph 4(a) above of this policy The frequency (or total number) of disclosures to the same entity The date of the last disclosure to the entity during the accounting period 6. Suspension of Accounting Rights. a. When a health oversight agency or a law enforcement official has provided MMSC with a written statement that an accounting of disclosures to such agency or official would be reasonably likely to impede their activities, MMSC will temporarily suspend the inclusion of such disclosures in a response to a request for an accounting. b. The agency or official must designate the length of time that such suspension is needed. If no length of time is designated, the suspension may last for no more than 30 days. The Privacy Officer shall follow up with the agency or official if no period of time has been designated. c. When the period of suspension has ended, MMSC should notify the individual of such disclosure(s) to the agency or official. 4

7. Fees for Providing Accounting. a. MMSC may not charge for the first accounting in a 12 month period. b. For the second or subsequent accountings in a twelve month period, MMSC may charge a reasonable, cost-based fee for the accounting. The basis for calculating such fee shall be documented on the Cost Worksheet attached to this policy. DOCUMENTATION 1. Forms. An individual s request for an accounting and MMSC s response shall be retained as HIPAA records in the patient s record for as long as the record is maintained, but no less than six years from the date MMSC responded to the request. 2. Tracking. MMSC shall document disclosures subject to the patient s right to an accounting on an ongoing basis. Originated by: Administration Effective date: February, 2003 Authorized by: Revision date: 6/07 Review date: T:\DATA\POLICIES\ADMINNEW_2\ADM330R1.DOC 5

DISCLOSURE RECORD SAMPLE (OBTAIN SUPPLY IN STOREROOM MR-120) PATIENT NAME: ACCT. #: DISCLOSURE TO: PERSON/ENTITY ADDRESS (IF KNOWN) DESCRIPTION OF INFORMATION DISCLOSED: DATE OF DISCLOSURE: CHECK PURPOSE OF DISCLOSURE Disclosure required by law: - what law Disclosure for public health activities: why? Disclosure about victims of abuse, neglect or domestic violence: Disclosure for health care oversight activities: what? Disclosure for judicial and administrative proceedings: Disclosure for law enforcement purposes: what? Disclosure about decedents: Disclosure for organ donation purposes: Disclosure for research purposes: Disclosure to avert a serious threat to health or safety: Disclosure for certain specialized governing functions: Disclosure for workers compensation: Disclosure for OTHER: please state: GIVE BRIEF EXPLANATION AS TO WHY DISCLOSURE MADE: SIGNATURE OF PERSON COMPLETING FORM: DEPARTMENT: DATE COMPLETED: PLEASE ROUTE TO HIM WHEN COMPLETED 6

INSTRUCTIONS REQUEST FOR ACCOUNTING Please complete this entire form to request an accounting of certain disclosures that MMSC or its business associates have made of your health information. We will provide you with the accounting report within sixty (60) days of receipt of your request, or notify you that an extension is necessary. MMSC cannot process your request if this form is not complete. IDENTIFYING INFORMATION Patient Name: D.O.B. Current Address: Phone #: TIME PERIOD OF ACCOUNTING Beginning Date: End Date: (On or after April 14, 2003) (Not to exceed six-year period) ACCOUNTING FROM: Marshalltown Medical & Surgical Center Home Care Plus Conrad Family Clinic State Center Family Medical Clinic Tama Medical Center All of MMSC and affiliated clinics FEES FOR ACCOUNTING You may receive one accounting every twelve months at no charge. If you have requested an accounting within the last twelve months, you may be charged $ to receive this accounting. By signing this form, you agree to pay such amount. You may contact to determine the date you last requested an accounting. DISCLOSURES NOT SUBJECT TO ACCOUNTING Please be aware that we are not required by law to provide an accounting of the following types of disclosures: Disclosures made for the purpose of treatment, payment or health care operations Disclosures to you or your personal representative Disclosures that you or your personal representative have authorized in writing Disclosures to persons involved in your care or for notification of next of kin or family Disclosures for national security or intelligence purposes Disclosures to correctional institutions or law enforcement officials about inmates or others in custody Disclosures in limited data sets Signature of patient or patient s personal representative Date Authority of personal representative WE WILL NOT PROCESS THIS REQUEST UNLESS IT IS SIGNED BY YOU OR YOUR REPRESENTATIVE 7

SAMPLE EXTENSION NOTICE (ACCOUNTING OF DISCLOSURES) [Date] [Requestor s Name] [Requestor s Address Line 1] [Requestor s Address Line 2] Re: Request to Amend Records of [patient name] MMSC received a copy of your request for an accounting of disclosures of your protected health information on [date of receipt]. We are unable to take action on your request within sixty (60) days of receiving your request and will require an additional thirty (30) days to respond to your request. This 30-day extension is necessary because: This is the only extension we will use. We will notify you if your request has been approved or denied no later than ninety (90) days from the date we received your original request. Should you have any questions regarding this notice or your request, you may contact [Title/Address/Phone Number]. Sincerely, [Signature] [Title/Department] 8