Patient Information
Policy
Use and Disclosure of an Individual’s
Protected Health Information for Fundraising
SCOPE:
All Louisiana State University (LSU) System
health care facilities and providers including,
but not limited to hospitals, physician
practices, clinics, schools, etc. on the LSU
Health Sciences Center New Orleans Academic
Campus.
Note Bene: All LSU System health care facilities
and providers including, but not limited to
hospitals, physician clinics, schools, etc. on
the LSU Health Sciences Center New Orleans
Academic Campus, are referred to in this policy
as LSUHSC-NO.
PURPOSE:
To provide guidance to the health care
facilities and providers affiliated with LSUHSC-NO
on the use or disclosure of an individual’s
Protected Health Information for fundraising
purposes.
POLICY:
All LSUHSC-NO health care facilities and
providers may use or disclose an individual’s
Protected Health Information for fundraising
purposes as described in this policy.
DEFINITIONS:
Protected Health
Information (sometimes referred to as “PHI”)
– for purposes of this policy means individually
identifiable health information, that relates to
the past, present or future health care services
provided to an individual. Examples of Protected
Health Information include medical and billing
records of the patient.
Authorization – A
written document completed and signed by the
individual that allows use and disclosure of PHI
for purposes other than treatment, payment or
health care operations.
For the purposes of the definition of
"Designated Record Set":
- The term "record" means any item, collection, or grouping of information that includes PHI and is maintained, collected, used or disseminated by or for LSUHSC-NO.
- The term "record" also includes patient information originated by another health care provider and used by LSUHSC-NO to make decisions about a patient.
- The term "record" includes tracings, photographs, and videotapes, digital and other images that may be recorded to document care of the patient.
Designated Record
Set – is a group of records maintained by or for
LSUHSC-NO that is:
-
The medical records and billing records
about individuals maintained by or for LSUHSC-NO; or
-
Any records used, in whole or part, by
or for LSUHSC-NO to make decisions about individuals.
-
Any record that meets this definition
of Designated Record Set and which are held by a HIPAA
Business Associate of LSUHSC-NO are part of LSUHSC-NO’s
Designated Record Set.
Director of Information Services – Person designated by the facilities and clinics with the responsibility for disseminating information to the general public regarding the activities of LSUHSC-NO and for determining, with input from the Privacy Officer, HIPAA-appropriate fundraising activities. The Director of Information Services or his/her designee is responsible for obtaining patient authorizations when required by HIPAA.
PROCEDURE:
|
1.0 |
LSUHSC-NO may use,
or disclose to a business associate or to an
institutionally related foundation, without a signed
authorization from an individual the following Protected
Health Information for the purpose of raising funds for
its own benefit: (1) Demographic information relating to
an individual; and (2) Dates of health care provided to
an individual. |
|
1.1 |
The facility must
have a business associate contract in place before
disclosing patient information to a consultant or
outside entity for fundraising purposes. |
|
1.2 |
To use or disclose
other Protected Health Information related to an
individual besides the categories included in “1.”
above, LSUHSC-NO must obtain the patient or personal
representative’s authorization to use such information
for fundraising purposes. Examples of such information
include but are not limited to:
-
a patient’s
illness, diagnosis, or treatment;
-
the services received, or place within the hospital where the patient receives
treatment, such as Department of Psychiatry, Department of Obstetrics, or
Department of Radiation Oncology; or
-
other
non-demographic information for fundraising purposes.
(See HIPAA Policy on Authorization)
|
| 1.3 |
The facility may filter patient names for targeted
or other fundraising purposes based upon the demographic
information. |
| 1.4 |
The Notice of Privacy Practices of LSUHSC-NO must
include a statement that LSUHSC-NO may contact the
individual to raise funds for LSUHSC-NO. |
| 2.0 |
Request to Opt Out of Receiving Further
Communications |
| 2.1 |
The facility fundraising communications must include
a statement describing how the patient can opt out of
receiving future fundraising communications and stating
that the facility will take reasonable efforts to ensure
the patient does not receive future fundraising
communications. |
| 2.2 |
Use the following statement as opt out language for
fundraising:
“Please write us at our address if you wish to have
your name removed from the list of persons who will
receive requests for fundraising to support LSUHSC-NO in
the future. In the event you contact us with a request
not to be sent fundraising communications, all
reasonable efforts will be taken to ensure you will not
receive any such communications from us in the future.” |
| 2.3 |
The facility may continue to send information about
educational and other events to a patient who has opted
out from receiving fundraising communications. |
| 3.0 |
Newsletters Newsletters and other types of communications concerning
facility events may include active or passive
fundraising. These types of communications sent out to
broad sections of patients or general audiences do not
require an ‘opt out’ clause.
|
| 4.0 |
Responsibilities |
| 4.1 |
The facility must designate appropriate personnel
who are responsible for reviewing and approving all
fundraising communications using PHI. |
| 4.2 |
The facility must designate appropriate personnel
who are responsible for receiving and processing patient
requests to opt out of receiving further fundraising
communications. |
| 4.3 |
The facility must designate appropriate personnel
who are responsible for obtaining business associate
contracts with any business associates involved in the
production, distribution, or processing of fundraising
communications. |
REFERENCE:
45 C.F.R. § 164.514(f)
|
