ROI Tracking
RMC Release of Information Policies
Rasmussen Medical Center
Health Information Department
Release of Information Policies
Release of Information Overview
This should serve as a resource for those individuals responsible for manageing or performing the process of release of information. Health care providers have a duty to maintain patient privacy and to release information when appropriate. Patient health information should be considered confidential, and should be released only in accordance with a health care information disclosure policy. The policy must define when a patient’s authorization is required and should comply with state and federal statutes, the Health Insurance Portability and Accountability Act (HIPAA), Patient Bill of Rights, court rulings, administrative rules, and accrediting and regulatory agency requirements.
The HIM professional is considered the key individual in developing, implementing and maintaining privacy policies and procedures due to their specific training in handling these particular situations. An HIM professional’s education and experience includes confidentiality, legal issues, and critical thinking in a variety of situations.
Patient information must be protected from unauthorized, inappropriate, or unnecessary access. Federal regulations under HIPAA established national requirements for confidentiality.
Considerations for Disclosure
The principal considerations for determining when information may be disclosed are:
Whether a patient authorization is required
The nature of the information requested
Whether it is confidential or non-confidential
The purpose of the request
The authority of the person or agency requesting the information
Whether any revocations or notices to withhold information are on file
State Law
This state has a statute that identifies provisions for access to health care records. The basic provisions of the law are:
The patient has a right to access health care information that pertains to the patient’s examination or treatment of a medical, psychiatric or mental condition.
Upon written request from the patient, a health care provider has an obligation to supply the patient with health care information.
A signed and dated patient authorization is required for release of health care information except under the following circumstances:
Disclosure is authorized by law
Disclosure of immunization date
Medical emergency
Health care information may be release without patient authorization for medical or scientific research unless the patient has specifically objected to disclosure for research purposes. The health care provider must make a “reasonable effort to determine” that the researcher or organization will protect the rocor from unauthorized disclosure or misuse.
Health care information may not be re-released without a signed and dated authorization from the patient or patient’s legally authorized representative, unless the release is specifically authorized by law.
An authorization is valid for one year or for a lesser period if specified in the authorization. The authorization does not expire after one year for:
Other health care providers
Health insurance plans
Life insurance
With patient’s authorization, the provider may furnish a summary of the record, or copies of pertinent portions of the record, in lieu of the entire record.
The provider may charge a reasonable fee for the copies.
Information may be withheld if a provider determines that information in the record is detrimental to the physical or mental health of the patient, or is likely to cause the patient to inflict self-harm or to harm another.
In a licensed health care facility, this determination to withhold information must be made by the health care provider before a request is received, otherwise the request must be honored.
If the patient is a subject of a competency hearing, full access must be allowed.
A person who released health records in violation of this statute, or who alters the authorization from of another person without the person’t consent, is liable to the patient for damages.
A provider who inappropriately charges ofr health care information may be subject to disciplinary action by the Board of Medical Practice for Physicians, or the State Health Department for other providers.
A health care provider should develop procedures for documenting access restrictions. The restrictions should be visibly documented in the patient health record. When information is withheld from the patient, the provider may release the information to an appropriate third party or to another health care provider, who may then release the information to the patient.
Authorization Requirements
Written patient authorization is required to release health care information. The authorization may be an original, a facsimile/scanned image or a photocopy. Some facilities will not accept a photocopy or fax or scanned image as the original unless a statement is present on the authorization states a photocopy or image is treated ion the same manner as the original.
The authorization should include the following components or elements:
Plain language
Name of institution or provider that is to release the information
Name of individual or institution that is to receive the information
Patient’s full name, address, and date of birth
A description of the information to be disclosed with sufficient specificity to allow the facilty or provider to know which information the authorization references
The name or other specific identification of the person that is authorized to make the disclosure
A specific expiration date, a specific expiration time period, or an event at which the authorization will expire that is directly relevant to the individual or the purpose of the disclosure
A statement of the individual’s right may revoke the authorization in writing
Instructions on how the individual may revoke the authorization in writing
A statement informing the individual may be subject to re-disclosure by the recipient and may no longer be protected by the HIPAA rule
A statement that the record may include provider records from other facilities or providers of care
The individual’s signature and date of signature
If the authorization is signed by a personal representative of the individual, the representative must indicate his or her authority to act for the individual.
Specific Types of Releases
Deceased Patients
The surviving spouse or parents of a deceased patient, or a person the patient designates in writing as a representative, may authorize release of the patient’s records. If there is no surviving spouse or parents, the law does not specify who may authorize release. The provider may require legal representation be established for a party to authorize disclosure of the record. The legal representative of the patient (i.e. executor of the estate) may authorize disclosure of the records. Legal documentation from the court should be requested to provide proof of appointment.
The state’s ombudsman for mental health and mental retardation is not required to obtain consent for access to private data on decedents who were receiving services for mental illness, mental retardation or a related condition, or emotional disturbance.
Requirements:
A patient’s authorization or consent does not survive his or her death. A deceased person cannot authorize in advance release of his or her own patient information.
Powers of attorney are revoked by the death of the principal (patient).
The executor of the patient’s estate should sign the authorization for release of information.
Prison Inmates
Federal Prison: health care records of an inmate of a federal prison do not belong to the patient (inmate), therefore may not be release with an authorization signed by the patient (inmate).
Permission from the Federal Government is required for release of any health care records of an inmate of a federal prison.
Mentally or Physically Incompetent Patient
If a patient is not competent to sign an authorization to release health care information, but has not been legally adjudicated to be incompetent, discretion must be used in obtaining an authorization. It is recommended that the next of kin authorize to release of information. If a person has been adjudicated to be incompetent, refer to Guardians and Conservators.
Guardian/Conservator
A court may fin d that a person is incompetent to manage personal affairs. In this case a guardian or conservator will be appointed. Guardians have the authority to release health care information. Conservators may or may not have authority over an individual’s health care needs. With either a guardian or conservator, proof of appointment and authority to release health care information should be presented.
Custodial / Divorced Parents
When the parents of a child are divorced, either parent may authorize release or have access to the health care information of the minor child, regardless of which parent has been awarded legal custody. Only when the parental rights have been terminated or a cours has set specific limitations with respect to the child’s health care and access to records can the parent be denied access to their minor child’s health care information. The health information professional may contact the custodial parent to inform them that a request has been received from the other parent for health record information, but this is not required.
If one parent requests that access be denied to the other parent, legal documentation from the court must be provided to prove termination of parental rights or other restrictions.
HIV/AIDS Records
Specific patient access or release statutes do not regulate health care records pertaining to HIM and AIDS testing and results. Health care providers should take extra precaution to ensure patient confidentiality of these records due to the sensitivity of information, public attitudes, and the potential consequences from an unnecessary HIV test or inappropriate release of HIV/AIDS information. Even though law does not specifically protect this information, the sensitivity issues may merit the development of special procedures. Unless specifically asked for and authorized by the patient, HIV and AIDS records should not be released.
County Attorney Requests
A county attorney is allowed access to health care records of incarcerated individuals in the state prison if the Department of Corrections refers the case for commitment as a sexual psychopath or sexually dangerous person. This would apply to prison inmates who are nearing the completion of their sentence for sex crimes and whom the Corrections Department feels would be a public risk if they are released.
Independent Medical Examination
In an independent medical examination (IME), there is no physican-patient relationship. The results of the examination do not become part of the health care record. The original report goes directly to the third party who requested or paid for the examination. The examinee’s consent is not required for the provider who performed the examination to release the report to the third party who requested and or paid for the examination.
Medical Examiner / Coroner
Release of health care records is allowed to the medical examiner / coroner. Health care records on the decedent whose death is being investigated shall be made promptly available to the medical examiner/coroner upon the written request of the medical examiner/coroner. The medical examiner/coroner shall pay the reasonable costs for copies of records or data provided.
Worker’s Compensation Requests
Statutes provide for release of medical data related to a current worker’s compensation claim to the employee, employer, or insurer who are parties to the claim or to the Department of Labor and Industry. A patient authorization is not required as consent is implied when a claim is filed. A request for copies of health care records must be in writing. Health care information not directly related to the specific injury or disability should not be released without authorization of the patient. In addition, only written data, which exists at the time the request is made, shall be released. Future information may be released only with another written request.
Board of Medical Practice Requests
Physicans have the obligation to comply fully with the Board of Medical Practice investigations. This includes providing copies of records, for which the Board of Medical Practice will pay usual and customary charges. The Board of Medical Practice generally obtains patient authorization for release of records for all patient initiated complaints. The Board of Medical Practice is not required to obtain patient authorization in investigation of Board initiated complaints. In this case, the releasing facility or provider should delete all patient identification information from the copies being released.
8
