ROI Tracking

Unless otherwise permitted, PHI may not be used or disclosed without a valid authorization.

Special rules apply to:

• • disclosure of psychotherapy notes

  • Marketing

Seven Core Elements of a Valid Authorization

1. A description of information to be used or disclosed

2. The identification of the person or class of persons authorized to make the use or disclosure of the PHI

3. The identification of the persons or class of persons to whom the covered entity is authorized to make the use or disclosure

4. A description of each purpose of the use or disclosure

5. An expiration date or event

6. The individual’s signature and date

7. If signed by a person representative, a description of his/her authority to act for the individual

Three Required Statements of a Valid Authorization

1. An individual may revoke an authorization in writing. Plus:

   1. An additional statement regarding the exceptions to an individual’s right to revoke and specific instructions on how to revoke or

   2. A reference to the covered entity’s Notice of Privacy Practices, if this information is included

2. Treatment, payment, enrollment, or eligibility of benefits may not be conditioned on obtaining the individual’s authorization. (In other words, one cannot say “sign this or we won’t treat you” or “sign this or we won’t cover your care.”

OR:

Where the Privacy Rule allows for such conditioning, delineation of the specific consequences to an individual if he/she refuses to sign the authorization form

1. The potential for the PHI to be redisclosed by the recipient and thus, no longer protected under the Privacy Rule

An example of a redisclosure:

Other Considerations for a Valid Authorization

• • All authorizations “must be in plain language”

  • Other elements or information may be included as long as they are not in conflict with requirements

Combined Authorizations

In general, an authorization for use and disclosure of PHI may not be combined with any other document to create a compound authorization except for:

• • Research

  • Psychotherapy notes

  • Another authorization under Section 164.508

Documentation Requirements

• • A copy of the signed authorization form can be given to the patient or individual

  • Covered entities must document and retain all signed authorizations for a period of six years from date of creation or when last in effect, whichever is later.

Revoking an Authorization

Revocation of an authorization is allowed at any time as long as:

• • It is requested by the individual in writing

  • Unless:

  • The covered entity has already taken action based on the originally-signed authorization or

  • When the authorization was obtained as a condition of obtaining insurance coverage

When is Use/Disclosure of PHI Allowed Without an Authorization

• • For treatment, payment or health care operations (TPO)

  • For public health or health oversight activities

  • When use is for victims of abuse, neglect or domestic violence or other persons at risk

  • For judicial and administrative proceedings

  • To employers (under certain conditions)

  • For use by coroners, medical examiners, and funeral directors in the case of deceased persons

  • For cadaveric organ, eye, or tissue donation

  • To avert a serious threat to public health or safety

When is Use/Disclosure of PHI Allowed Without an Authorization

• For law enforcement purposes

• For Workers’ Compensation and specialized government functions

• As otherwise required by law

• For research (waiver approval required)

• A covered entity must make reasonable efforts to limit access of PHI to that which is minimally necessary to meet the purpose of the use or disclosure

• “Minimum” determination need not be made for reasonable requests made by public officials, other CE’s, members of workforce, business associates, or researchers

• A covered entity may not use, disclose, or request an entire medical record unless need for such is specifically justified

Must be able to provide individuals with a record of disclosures for a period of six (or fewer) years prior to the date of their request.

What must be included in a disclosure accounting?

• • Date of each disclosure

  • Name of the organization or person who received the PHI

  • Address of the organization or person who received the PHI

  • A brief description of the information disclosed

  • A brief statement of the purpose of the disclosure

Charges for an Accounting of Disclosure

• • Individuals have a right to receive one free accounting per 12 month period

  • For each additional request within a 12 month period the covered entity may charge a reasonable, cost-based fee.

  • If a fee is charged, the covered entity must inform the individual of the fee in advance

Retrieval and Copying of PHI

• • A “reasonable, cost-based fee” for requested copies may be charged

  • For a summary or explanation of PHI, a preparation fee may be charged

  • Costs associated with searching for and retrieving the requested information may not be charge to patients

Charges for ROI

• • You may charge for search and retrieval and preparation time

  • You may charge per page for the copies

  • Check with your state statues to find out what are considered to be reasonable charges

  • Many states have set guidelines on what you may charge per page