HUNTINGTON MEMORIAL HOSPITAL ADMINISTRATIVE POLICY & PROCEDURE SUBJECT: AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (PHI) AUTHORIZED APPROVAL: POLICY NO: 155 PAGE 1 of 5 EFFECTIVE DATE: REPLACES: 11/9/2015 11/9/2012 PURPOSE The purpose of this policy is to establish the manner in which Protected Health Information (PHI) will be used and disclosed for purposes other than allowable or permissible reasons under the Health Insurance Portability and Accountability Act (HIPAA) through the use of an authorization. POLICY Huntington Hospital respects its patients rights to have their Protected Health Information (PHI) used or disclosed only for allowable or permissible purposes under the HIPAA regulations and provides them the opportunity to approve all other uses or disclosures through the use of a written authorization. APPLICABLE TO All departments which use or disclose patient information DEFINITIONS Disclosure: The release, transfer, provision of access to, or divulging in any other manner of Protected Health Information outside the hospital. Protected Health Information (PHI): Any health information, whether oral or recorded, transmitted or maintained in any form or medium that is created or received by Huntington Hospital. Use: The sharing, employment, application, utilization, examination, or analysis of Protected Health Information within the hospital. PROCEDURE General Requirements
SUBJECT: AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (PHI) POLICY NO: 155 PAGE 2 of 5 1. Except as required by law or otherwise allowable under the HIPAA regulations, Huntington Hospital will not use or disclose PHI that was received or created outside the process of providing treatment, payment or health care operations, or other legally permissible uses and disclosures without a valid authorization from the patient. 2. When Huntington Hospital obtains or receives a valid authorization for its use or disclosure of PHI, such use or disclosure will be consistent with the authorization. Authorization forms for the disclosure of PHI approved by Huntington Hospital should be used. 3. In general, Huntington Hospital will obtain a patient authorization for any use or disclosure of psychotherapy notes. However, Huntington Hospital may use and disclose psychotherapy notes in accordance with its Notice of Privacy Practices and other policies and procedures related to mental health and developmental disability information for the following purposes: a. For the provider, individual originator of the psychotherapy notes, to provide treatment; b. For use in supervised training programs; or c. For defending a legal action or other proceeding brought by the individual. 4. Huntington Hospital may also disclose psychotherapy notes without patient authorization when it is requested by federal Department of Health and Human Services as part of health oversight activities under HIPAA, when required by law or necessary to avert a serious threat to health and safety or to a coroner/medical examiner for the purpose of identifying a deceased person. Defective Authorizations 1. An authorization is not valid for the disclosure of PHI to a third party if the authorization document submitted has any of the following defects: a. The expiration date has passed or the expiration event is known by the covered entity to have occurred; b. The authorization has not been filled out completely; c. The authorization has been revoked; d. The authorization does not contain all the required elements as defined in this policy; or, e. Any material information in the authorization is known to be false. Conditioning of Authorizations 1. Huntington Hospital will not condition treatment on the provision of an authorization, except that the organization may condition the provision of research-related treatment on provision of consent and authorization. 2. Huntington Hospital may also condition the provision of health care that is solely for the purpose of creating PHI for disclosure to a third party. For example, the organization may have a contract with an employer to provide fitness-for-duty exams, or a contract with a life insurer to provide pre-enrollment physicals for applicants. In each of these cases, Huntington Hospital would condition the health care services on provision of an authorization. Revocation of Authorizations
SUBJECT: AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (PHI) POLICY NO: 155 PAGE 3 of 5 1. Huntington Hospital will allow a patient to revoke an authorization at any time, provided the revocation is in writing. Such revocation shall be effective upon receipt except to the extent that Huntington Hospital has taken action in reliance of the authorization. Documentation Requirements 1. Huntington Hospital will retain any signed authorization and related documentation for six (6) years from the signed date of the authorization. 2. The organization will provide the patient with a copy of the authorization. 3. The authorization must be written in plain language. Core Elements and Requirements 1. Huntington Hospital has created a valid authorization form ( Authorization For Use or Disclosure of Protected Health Information attached) which has been written in plain language and should be used in most situations. Huntington Hospital will provide the patient or personal representative with a copy of the authorization form they submit. A properly executed authorization for release of medical record information and PHI contains the following elements: a. Be addressed to Huntington Hospital b. Name the patient whose record is to be released c. A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion; d. The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure; e. The name or other specific identification of the person(s), or class of persons, to whom the organization may make the requested use or disclosure; f. An expiration date or an expiration event that relates to the patient or the purpose of the use or disclosure; g. A statement of the patient s right to revoke the authorization in writing and the exceptions to the right to revoke, together with a description of how the patient may revoke the authorization; h. A statement that information used or disclosed pursuant to the authorization may be subject to re-disclosure by the recipient and no longer be protected by this rule; i. Signature of the patient and date; and j. If the authorization is signed by a personal representative of the patient, a description of such representative s authority to act for the patient. Required Elements for an Authorization for the Use or Disclosure Submitted by Others a. A statement that the organization will not make as a condition for treatment of the patient providing authorization for the requested use or disclosure; b. A description of each purpose of the requested use or disclosure; c. A statement that the patient may inspect or copy the protected health information to be used or disclosed, and refuse to sign the authorization; d. If use or disclosure of the requested information will result in direct or indirect remuneration to the organization from a third party, a statement that such remuneration will result; and e. A statement that the patient may refuse to sign the authorization.
SUBJECT: AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (PHI) POLICY NO: 155 PAGE 4 of 5 Authorization for Research 1. If Huntington Hospital creates or permits the collection of PHI for the purpose, in whole or in part, of research that includes treatment of patients, it will provide for the appropriate authorization for the use or disclosure of such information in accordance with the criteria and procedures set forth in the Clinical Research Department Standard of Procedure 1004 (8010.210). Compound Authorizations 1. Except as provided in (2) below, Huntington Hospital will not combine any authorizations for use or disclosure with a consent for treatment or payment, or with an informed consent to participate in research. 2. Huntington Hospital may combine an authorization for use or disclosure of PHI with another document to create a compound authorization as follows: a. An authorization created for a research study may be combined with any other written permission for the same research study including another authorization for use or disclosure of PHI for such research or a consent to participate in such research; b. An authorization, other than an authorization for disclosure of psychotherapy notes, may be combined with any other authorization, except when treatment is conditioned on the provision of one of the authorizations. 3. If authorizations are combined as described in this policy, each authorization must be visually and organizationally separate from other content within the document; and it must be separately signed and dated. Procedure for Obtaining Authorization 1. Any requests for authorization of use and disclosure of PHI made by patients or representatives will be directed to Medical Records. 2. Staff will contact the Medical Records Department requesting an authorization form for use and disclosure of PHI. Medical Records staff will tube the form back to the requesting department. Patient will complete and sign the authorization form. 3. Staff will provide the patient with a copy of the authorization, place the original in the chart, and send a copy to the Medical Records Department. Medical Records staff will then log in the system, and document the details related to the authorization. REFERENCES 45 Code of Federal Regulations 164.508 California Hospital Association, Patient Privacy Manual SOURCE
SUBJECT: AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (PHI) POLICY NO: 155 PAGE 5 of 5 Compliance & Internal Audit Services Medical Records Department Patient Access/Admitting Department Professional Nurse Practice Committee
MR #: (if available) Patient Name: Home Address: AUTHORIZATION TO USE AND DISCLOSE PROTECTED HEALTH INFORMATION Last First Middle Street City State Zip Home Telephone: DOB: RECIPIENT: Name of person, entity, or class of persons or entities to whom Huntington Memorial Hospital (HMH) may disclose my protected health information (PHI): Name: In addition, PLEASE CIRCLE ONE, if applicable: Attorney Doctor DPA Insurance Self Other: I would prefer to: Pick up a copy of or view the requested PHI at HMH; OR Have the requested Pin mailed to the Recipient at the following address: Street City State Zip Phone Number Fax Number Page 1 of 5 V2.0 Revision 11.9.15 Confidential
TERM: This Authorization will expire on (required): The day of, 20. (If no date specified, it will expire twelve (12) months from the date signed.) TIME PERIOD OF MEDICAL RECORDS REQUESTED: Specify time period of medical records requested: From (month/day/year) to (month/day/year) (If no date specified, information created within 12 months before and after this authorization is signed will be included in this time period). Please check appropriate box(es) to indicate the specific PHI that may be disclosed: Pertinent Records Package A Face Sheet Consultation Reports Laboratory Tests Discharge Summary Operatory Reports Radiology Reports ER Report Pathology Reports Cardiology Reports History and Physical Pertinent Records Package B Progress Notes Medications Rhythm Strips Physician Orders Special Test/Therapy Labor/Delivery Summary Graphics Nurses Notes All Records (Package A and Package B) Highly Confidential PHI (will not be released without specific consent) By checking the box next to a category of highly confidential PHI listed below and signing on the appropriate line after the checked box, I specifically authorize the use and/or disclosure of the type of highly confidential PHI indicated next to my signature, if any such information will be used or disclosed pursuant to this authorization: Mental Health Treatment: Developmental Disability: Communicable Disease: Page 2 of 5 V2.0 Revision 11.9.15 Confidential
Sexual Assault: Child Abuse or Neglect: Genetic Testing: Domestic Abuse: Adult Abuse: Substance Abuse: (Prevention or Treatment for Alcohol or Drug Abuse) HIV/AIDS: (Testing, Diagnosis, or Treatment (regardless of result)) Psychotherapy notes: PURPOSE: I authorize HMH to use or disclose my PHI (including the highly confidential PHI I selected above, if any) during the term of this Authorization for the following specific purpose(s) (Note: "at the request of the Patient" is a sufficient purpose if the Patient is initiating this Authorization): I understand that once HMH discloses my PHI to the recipient, HMH cannot guarantee that the recipient will not re-disclose my PHI to a third party. The third party may not be required to abide by this Authorization or applicable law governing the use and disclosure of my PHI. I understand that I may at any time make a written request to HMH to inspect and/or obtain a copy of my PHI, and that HMH will either, within five (5) working days for a request to inspect and fifteen (15) days for a request to copy, grant the request and contact me to arrange for a convenient time to inspect and/or copy my PHI or provide me with a written denial of the request that states the basis for the denial, my review rights (if any), and instructions as to how and to whom I may register a complaint regarding the denial. I understand that I may refuse to sign or may revoke (at any time) this Authorization for any reason and that such refusal or revocation will not affect the commencement, continuation or quality of my treatment at HMH; except, however, if my treatment at HMH is for the sole purpose of creating PHI for disclosure to the recipient identified in this Authorization, in which case HMH may refuse to treat me if I do not sign. I understand that, at any time during which this Authorization is in effect, I may make a written request to receive a copy of this Authorization. Such written request shall be made to HMH at the address listed below. I understand that this Authorization will remain in effect until the term of this Authorization expires or I provide a written notice of revocation to HMH at the address listed below. The revocation will be effective immediately upon HMH s receipt of my written notice, except that the revocation will not have any effect on any action taken by HMH in reliance on this Authorization before it received my written notice of revocation. Page 3 of 5 V2.0 Revision 11.9.15 Confidential
I have read and understand the terms of this Authorization and I have had an opportunity to ask questions about the use and disclosure of my PHI. By my signature below, I hereby, knowingly and voluntarily, authorize HMH to use or disclose the indicated PHI in the manner described above. I understand that failure to provide all requested information may invalidate this Authorization. Signature of Patient Date If Patient is a minor and unable to sign this Authorization, obtain the following signatures below. If Patient is NOT a minor and unable to sign this Authorization, attach any additional necessary authorization forms (e.g., Power of Attorney forms, etc.) and obtain the following signature below. NOTE: I understand that this authorization will be valid until or unless otherwise canceled or revoked. I understand that this authorization may be canceled or revoked at any time, but that such cancelation or revocation must be submitted to HMH in writing and be acknowledged by HMH in order to be valid. Signature of Personal Representative: Description of Authority: Date: Please return this form to: By mail or in person to: Huntington Hospital Medical Records 100 W. California Blvd. Pasadena, CA 91105 By Fax: (626) 397-2928 Please contact Medical Records with any questions at (626) 397-5054, Monday through Friday, 8:00am to 4:30pm (closed weekends and holidays). For Internal Use Only (REQUIRED): The identity of the requestor has been validated either with a government issued picture ID, such as a driver's license or passport, or comparison of signatures documented in the PHI records. Signature of employee validating identity Date Page 4 of 5 V2.0 Revision 11.9.15 Confidential
Medical Record Payment Form CA CIVIL CODE 123110: California Patient Access to Health Records. Inspection and copying; Paragraph (b) Additionally any patient or patient s representative shall be entitled to copies of all or any portion of the patients records that he or she has a right to inspect, upon presenting a written request to the health care provider specifying the records to be copied, together with a fee to defray the cost of copying, that shall not exceed ($.25) per page plus any additional reasonable clerical costs incurred in making the records available. Date: Medical Record #: Patient Name: Daytime contact #: Payment Method (To Be Completed by Patient) NO CASH ACCEPTED Check (payable to: BACTES) Money Order Credit Card (MC, Visa) Check / Money Order #: Credit Card Number: Expiration Date: 3 Digit Security Code: Name on Credit Card: Signature of credit card holder: Patient Billing Address: Charges for the cost of reproduction of medical records for STANDARD (up to 15 business days) processing: $15 Flat fee $0.25 per page for pages 61 and up. For Office Use Only: Total Page Count (From Page 61 - up) @ $0.25 per page = Total amount due: $ Date patient notified of charges: Total pages copied: Date pickedup: Page 5 of 5 V2.0 Revision 11.9.15 Confidential