SPECIAL CONSIDERATIONS FOR PATIENT PRIVACY

In addition to HIPAA, the strict confidentiality of records of persons receiving alcohol and drug prevention and treatment services is protected by Federal law, implemented through Federal regulations 42 C.F.R. (Code of Federal Regulations), Part 2. Noteworthy provisions:

-          Prohibits disclosures except with client consent (or 9 other specific conditions).

-          Prohibits re-disclosure except with explicit signed consent/authorization. This differs from HIPAA.

-          Allows limited disclosure for payment, evaluation, and other purposes with Business Associate Agreements.

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

No directory is maintained for general/public use.

FACILITY DIRECTORY

·         Where is patient's information status documented?

Originals are found in the client clinical record. Generally, unless a signed consent/authorization to release information is found, we are not permitted to contact family. Treatment Associates office maintains a directory of clients and copies of signed consent/authorization for release of information to specific persons making inquiry. Reception desk, the usual first receiver of visitors and telephone inquiries, is also provided with a copy of consent forms as applicable.

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

In the client clinical record. Generally, unless a signed consent/authorization to release information is found, we are not permitted to contact family. Also, Reception Desk and Treatment Associate staff, who are first receivers of visitors and telephone inquiries, are notified of client’s objection through a memo from counselor or through daily census meetings.

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

In the client clinical record. Generally, unless a signed consent/authorization to release information is found, we are not permitted to contact family. Also, Treatment Associate staff are notified through a memo from counselor or through daily census meetings.

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

This information is not currently available. Information will be available to students prior to their placement at Hina Mauka.

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Psychiatry residents may contact Medical Director, program director or designee. R.N. or any counselor may assist in locating PHI in the client record for any client currently being seen by a psychiatry resident. For non-active cases, contact custodian of records.

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

Signed consent/authorization by the client is required. Consent must meet standards for 42 CFR, pt. 2. as well as HIPAA.

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

Contact Hina Mauka’s Privacy Officer and IRB chair.

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

For disclosures from active clinical records, the clinician making the disclosure records the fact in the client record. For non-active clients, the custodian of records documents disclosures. Disclosures of financial information are documented in a running record/log by staff making the disclosures.

PRIVACY TRAINING REQUIREMENTS

All staff are provided with Confidentiality and Privacy Training, covering both 42 CFR, Part 2; and HIPAA; upon hire or (for volunteers and students) job assignment.

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

N/a

FACILITY DIRECTORY

·         Where is patient's information status documented?

N/a

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

N/a

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

Billing Department

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Privacy Officer

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

Submit written request stating purpose is treatment

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

Privacy Officer

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

Privacy Officer

PRIVACY TRAINING REQUIREMENTS

Will accept HRC training for residents

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

N/A

N/A

FACILITY DIRECTORY

·         Where is patient's information status documented?

N/A

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

N/A

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

“Restriction Request Forms” and their disposition maintained by the DLS Privacy Officer.

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes, check with DLS Privacy Officer.

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

DLS Privacy Officer.

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

DLS will release PHI to other providers for treatment purposes after verifying the identity of the requestor and the authority to receive PHI.

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

DLS Privacy Officer.

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

Automated computerized accounting for most disclosures (DOH). Manual (Ad Hoc) accounting for others (subpoenas etc.)

Computerized tracking and documentation accessible by Privacy Officer.

PRIVACY TRAINING REQUIREMENTS

DLS accepts HRC’s standardized community Training Program.

SPECIAL CONSIDERATIONS FOR PATIENT PRIVACY

HSH IS A PSYCHIATRIC FACILITY AND IS REQUIRED TO COMPLY WITH SPECIFIC JCAHO, DOJ, AND DOH REQUIREMENTS.

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

IN PATIENT CHART

TELECOMMUNICATIONS

FACILITY DIRECTORY

·         Where is patient's information status documented?

IN PATIENT CHART

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

IN PATIENT CHART

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

IN PATIENT CHART

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

YES

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

CAROLYN TAKAHASHI, ACTING CHIEF OF MEDICAL RECORDS

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

MEDICAL RECORDS

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

RYAN MCMULLIN, PH.D.

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

ALL PATIENT CARE STAFF

IN PATIENT CHART

PRIVACY TRAINING REQUIREMENTS

FILM IN STAFF DEVELOPMENT

OTHER

PRIVACY OFFICER IS RUTH STEWAT, RN, MS, CPHQ, CHIEF OF STANDARDS AND COMPLIANCE

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

1.     Regular information—location only.

2.     No information.

Condition is given by nursing staff only.

FACILITY DIRECTORY

·         Where is patient's information status documented?

Hospital Information System (McKesson) and on the Consent to Release to the Public form in the patient’s record.

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

Release is permitted unless the patient has completed a Request for Restriction form.

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

On the Request for Restriction form in the patient’s medical record.

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Medical Records Department

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

Medical Records Department

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

Privacy Officer

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

Medical Records Department

PRIVACY TRAINING REQUIREMENTS

Record of completion of HIPAA training.

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

STATUS:

1.     Regular info

2.     No info

FACILITY DIRECTORY

·         Where is patient's information status documented?

Hospital Information systems: SMS

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

Restriction Request form in the medical record

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes – refer to Policy regarding Educational Uses of PHI

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Medical Records for medical information;

Business Services for billing records;

Medical Records, ORSOS system administrators for data reports

Note: Data Access Request form Required

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

PHI may be released for treatment purposes in response to any of the following

1. Patient authorization

2. Letter from physician practice,

3. Provider Request for Information form or similar document

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

IRB or Privacy Officer

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures?

·         Where and how are disclosures documented?

·         Each individual is responsible for documenting disclosures. All documentation is kept in the chart.

·         Documentation forms are available on each unit. Check with Supervisor of area to see what their procedure is.

Centralized Collection points:

1. Medical Records for Medical records;

2. Business services for billing records

PRIVACY TRAINING REQUIREMENTS

Completion of HPH HIPAA training requirements for direct access or HRC’s standardized community Training Program

OTHER

Contact Privacy Officer

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

STATUS:

1.     Regular info

2.     No info

FACILITY DIRECTORY

·         Where is patient's information status documented?

Hospital Information systems: SMS and Karelink

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

Restriction Request form in the medical record

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes – refer to Policy regarding Educational Uses of PHI

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Medical Records for medical information;

Business Services for billing records;

Medical Records, Karelink or ORSOS system administrators for data reports

Note: Data Access Request form Required

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

PHI may be released for treatment purposes in response to any of the following

1.     Patient authorization

2.     Letter from physician practice,

3.     Provider Request for Information form or similar document

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

IRB or Privacy Officer

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures?

·         Where and how are disclosures documented?

·         Each individual is responsible for documenting disclosures. All documentation is kept in the chart.

·         Documentation forms are available on each unit. Check with Supervisor of area to see what their procedure is.

Centralized Collection points:

1.     Medical Records for Medical records;

2.     Business services for billing records

PRIVACY TRAINING REQUIREMENTS

Completion of HPH HIPAA training requirements for direct access or HRC’s standardized community Training Program

OTHER

Contact Privacy Officer

SPECIAL CONSIDERATIONS FOR PATIENT PRIVACY

This response applies to acute care and long term care inpatients. Patient privacy issues are discussed at registration and special requests are flagged in the computer system.

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

This response applies to acute care and long term care inpatients. Patient privacy issues are discussed at registration and special requests are flagged in the computer system. If the patient request that they not be included in the facility directory, their request is flagged in the computer and forwarded to the receiving floor. The hospital operator will not have that patient’s name on the directory at all.

FACILITY DIRECTORY

·         Where is patient's information status documented?

This response applies to acute care and long term care inpatients. Patient privacy issues are discussed at registration and special requests are flagged in the computer system. If the patient request that they not be included in the facility directory, their request is flagged in the computer and forwarded to the receiving floor. The hospital operator will not have that patient’s name on the directory at all.

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

This response applies to acute care and long term care inpatients. Patient privacy issues, including the identification of a PRIMARY individual to disclose protected health information are discussion during registration. The information gleaned is flagged in the computer system.

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

This response applies to acute care and long term care inpatients. Patient privacy issues are discussed at registration and special requests are flagged in the computer system.

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes for both acute care and long term care inpatient within specified guidelines.

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Medical Records

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

Medical Records

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

Robin Miyamoto, Research Coordinator

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

Medical Records

Tracked by the computer system.

PRIVACY TRAINING REQUIREMENTS

Record of education on HIPAA. Signature on the Confidentiality form.

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

Front Desk

Each Nurses Station

FACILITY DIRECTORY

·         Where is patient's information status documented?

Front Desk

Medical Record

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

Medical Record

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

Front Desk

Medical Records

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Medical Records

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

Medical Records

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

Medical Records

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

Medical Records

PRIVACY TRAINING REQUIREMENTS

HRC Privacy Training & Signed Confidentiality Agreement

SPECIAL CONSIDERATIONS FOR PATIENT PRIVACY

Long term care and acute TB unit

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

Regular

No Information

Noted in chart, computer system, internal directory

FACILITY DIRECTORY

·         Where is patient's information status documented?

Noted in chart, computer system, internal directory

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

Noted in chart, computer system, internal directory

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

Noted in chart, computer system, internal directory

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Medical Records

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

Medical Records

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

HIPAA Officer- Administration

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

Medical Records

PRIVACY TRAINING REQUIREMENTS

HRC Privacy Training & Signed Confidentiality Agreement

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

1.     Regular info- location and condition

2.     Limited info – acknowledge patient is at QMC only

3.     No info

4.     Pending- Trauma/VIP pt. No info to public while trying to notify family and determine status

FACILITY DIRECTORY

·         Where is patient's information status documented?

Hospital Information System (SMS)

Patient Care Summary

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

Release okay unless patient has made specific objections. Would be documented in the medical record

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

Refer patient to the Privacy Officer

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

-          Medical Records for charts and copies

-          IS help desk for access to computer systems

-          Data Coordinator of system for data queries and reports

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

-          Okay to release if treatment relationship documented

-          If not documented, Licensed health care provider (MD or RN) will accept patient authorization, letter from physician practice, Provider Request Form

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

QMC Research Regulatory Office at 808-547-4512

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

Through computerized computer entry system – CLiQ

PRIVACY TRAINING REQUIREMENTS

Satisfactory completion of Collaborative’s Privacy Training Session

OTHER

Students may not remove documents containing PHI from facility. See Privacy Officer for approval and de-identification.

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

Regular information

No information (NOI)

FACILITY DIRECTORY

·         Where is patient's information status documented?

Hospital information system (Affinity)

Medical record chart cover : NOI sticker

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

Family contacts listed on Face Sheet

Objections are recorded in chart: Discharge Plan Screening form in Case Management section

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

Medical record

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

For medical record: Clinical Information Dept (CID)

For electronic access: Information Systems Dept (IS)

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

May release for treatment after verification of requesting provider’s involvement in patient’s care (verification form)

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

Research, Education, and Training Dept (RET)

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

Clinical Information Dept (CID)

Disclosures are documented in the medical record by person making the disclosure

PRIVACY TRAINING REQUIREMENTS

Either REHAB privacy orientation or HRC Privacy Training

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

1.     Regular Information

2.     No Information

FACILITY DIRECTORY

·         Where is patient's information status documented?

Hospital information system (SMS).

Confidential" header on patient's Face Sheet.

Direct visitors to Information Desk or Operator who will check the Secure Census.

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

Permissible unless patient has requested to restrict family involvement. Patient's request and facility decision are documented on the Restriction Request form in the medical record.

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

Restriction Request form in the medical record

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Health Information Management department for medical records

Business Office for billing records

Information Services Help Desk for data queries or reports

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

Permissible if treatment relationship is documented within hospital information system, or with patient authorization, Provider Request form, or fax / letter from other healthcare provider.

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

Privacy Officer

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

Each program, service, department or facility is responsible for documenting disclosures, and making such documentation available to the Privacy Officer upon request.

PRIVACY TRAINING REQUIREMENTS

Satisfactory completion of HRC or SFHS privacy training program

OTHER

Procedures are similar for St. Francis Hospice and St. Francis Home Care Services

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

STATUS:

1. Regular info
2. No info
3. VIP (CE executives, CE BOD, celebrities, etc.)

FACILITY DIRECTORY

·         Where is patient's information status documented?

Hospital Information system - IDX

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

Restriction Request form in the medical record

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Medical Records for medical information;

Business Services for billing records

IT for reports

Note: Data Access Request form Required if not for TPO

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

1. Patient authorization
2. Letter from physician practice,
3. Provider Request for Information form or similar document

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

IRB or Privacy Officer

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

Centralized Collection points:

1. Medical Records for Medical records;
2. Business services for billing records

Each individual is responsible for documenting disclosures. All documentation is kept in the chart. Each area has different approach. Check with Supervisor of area to see what their procedure is.

PRIVACY TRAINING REQUIREMENTS

Completion of HPH HIPAA training requirements for direct access or HRC’s standardized community Training Program

OTHER

Plastic Surgery Records kept separate from Medical Records; See Privacy Officer

FACILITY DIRECTORY

·         Patient Info Status

·         Callers or Visitors

1.     Regular info

2.     No info

FACILITY DIRECTORY

·         Where is patient's information status documented?

No info patients have a plus sign (+) noted to the right of their names on the CPSI information system.

FAMILY INVOLVEMENT

·         Where is patient's objection to family involvement documented?

Persons whom staff may contact and/or speak with are listed on the Face Sheet.

OTHER RESTRICTION REQUESTS

·         Where is patient's restriction request (and facility's decision) documented?

Request for Restriction form

FACIALLY DE-IDENTIFIED INFORMATION

·         Does facility permit use of facially de-identified PHI for educational purposes?

Yes

ACCESS TO PHI

·         Whom should I contact if I need to request access to PHI?

Medical Records Department

REQUEST FOR PHI BY OTHER HEALTH CARE PROVIDERS FOR TREATMENT PURPOSES

Patient authorization is required.

RESEARCH

·         Whom should I contact if I need more information about requirements for research?

Privacy Officer

ACCOUNTING OF DISCLOSURES

·         Who is responsible for accounting of disclosures? Where and how are disclosures documented?

PRIVACY TRAINING REQUIREMENTS