Patient Information Policy
Use or Disclosure of Protected Health Information
that Requires an Individual’s Written Authorization
SCOPE:All Louisiana State University (LSU) System health care
facilities and providers including, but not limited to,
hospitals, physician practices, clinics, schools, etc. All
LSU System health care facilities and providers including,
but not limited to hospitals, clinics, and schools are
referred to in this policy as LSUHSC-NO.
PURPOSE:To provide guidance to the health care facilities and
providers affiliated with the LSU System on the requirement
to obtain a patient’s written authorization to use or
disclose the patient’s Protected Health Information under
the Health Insurance Portability and Accountability Act,
Standards for Privacy of Individually Identifiable Health
Information (HIPAA Privacy Regulations), and any other
applicable state or federal laws or regulations.
POLICY:
All LSU System health care facilities and providers must
obtain a patient’s written authorization.
DEFINITIONS:
Protected Health Information (sometimes referred to as
“PHI”) – for purposes of this policy means individually
identifiable health information, that relates to the past,
present or future health care services provided to an
individual. Examples of Protected Health Information include
medical and billing records of a patient. Disclosure - For purposes of this policy, means the release,
transfer, provision of access to PHI outside of LSUHSC-NO. Use – For purposes of this policy, means with respect to
Protected Health Information, the sharing, utilization, or
examination of Protected Health Information within and by
employees or agents of LSUHSC-NO.
PROCEDURE:
| 1.0 |
An individual’s written authorization must be
obtained prior to using or disclosing the
individual’s Protected Health Information, unless
the particular Use or Disclosure is listed in
Attachment A to as a “Permitted” or a “Required”
Use or Disclosure, such as treatment, payment or healthcare operations. |
| 2.0 |
If a signed authorization is required for a
particular Use or Disclosure, then either the
attached “Authorization” form (as Attachment B) or
an authorization form that contains all of the
“Authorization Form Content Requirements” listed
in 3.0 below must be used when obtaining an
individual’s authorization. Examples of
disclosures that require an Authorization include: |
| 2.1 |
Release of psychotherapy notes (except to the
originator of the notes); |
| 2.2 |
For marketing purposes; |
| 2.3 |
To release health information to an employer
as part of a background check; |
| 2.4 |
To release information to an insurance company
at the patient’s request for underwriting or eligibility for benefits (e.g.
life or disability insurance); or |
| 2.5 |
To release the results of a fitness test to a
prospective employer. |
| 3.0 |
Authorization Form Content Requirements:
A valid authorization must contain at least the
following information and statements: |
| 3.1 |
A description of the information to be used or
disclosed that identifies the information in a
specific and meaningful fashion; |
| 3.2 |
The name or other specific identification of
the person(s), or class of persons, authorized to
make the requested use or disclosure; |
| 3.3 |
The name or other specific identification of
the person(s), or class of persons, to whom
LSUHSC-NO may make the requested disclosure; |
| 3.4 |
A description of each purpose of the requested
use or disclosure. The statement “at the request
of the individual” is a sufficient description of
the purpose when an individual initiates the
authorization and does not, or elects not to,
provide a statement of the purpose; |
| 3.5 |
An expiration date or an expiration event that
relates to the individual or the purpose of the
use or disclosure. The statement “end of the
research study,” “none” or similar language is
sufficient if the authorization is for a use or
disclosure of PHI for research, including for the
creation and maintenance of a research database or
research repository; and |
| 3.6 |
In addition to the above information, the
authorization form must contain statements with
the following information:
| 3.6.1 |
The individual’s right to revoke the
authorization in writing, and either: (a) the
exceptions to the right to revoke and a
description of how the individual may revoke
the authorization; or (b) a reference to
LSUHSC-NO’S notice of privacy practices; |
| 3.6.2 |
The ability or inability to condition
treatment, payment, enrollment or eligibility
for benefits on the patient signing the
authorization, by stating either:
| 3.6.2.1 |
LSUHSC-NO may not condition treatment,
payment, enrollment or eligibility for
benefits on whether the individual signs
the authorization when the prohibition on
conditioning of authorizations contained
in the HIPAA Privacy Regulations is
applicable; or |
| 3.6.2.2 |
The consequences to the individual of
a refusal to sign the authorization when
LSUHSC-NO can condition treatment,
enrollment in the health plan, or
eligibility for benefits on obtaining such
an authorization; and |
|
| 3.6.3 |
The potential for information disclosed
pursuant to the authorization to be subject to
re-disclosure by the recipient and no longer
be protected by the HIPAA Privacy Regulations.
|
|
| 3.7 |
A valid authorization may contain other
information in addition to the required elements,
provided that such additional information does not
conflict with the required information and
statement. |
| 3.8 |
A copy of the signed authorization must be given to the patient. |
| 3.9 |
3.9 The authorization must be written in plain language |
| 4.0 |
Psychotherapy Notes Authorization Exceptions - A signed
authorization form must be obtained for any use or
disclosure of psychotherapy notes, except in the following
situations: |
| 4.1 |
To carry out the following treatment, payment, or health
care operations:
| 4.1.1 |
Use by the originator of the psychotherapy notes for
treatment; |
| 4.1.2 |
Use or disclosure by LSUHSC-NO for its own training
programs in which students, trainees, or practitioners
in mental health learn under supervision to practice or
improve their skills in group, joint, family, or
individual counseling; or |
| 4.1.3 |
Use or disclosure by LSUHSC-NO to defend itself in a
legal action or other proceeding brought by the
individual; and |
| 4.1.4 |
Use or disclosure that is required or permitted with
respect to the oversight of the originator of the
psychotherapy notes. |
|
| 5.0 |
Marketing Authorization Exceptions - A signed
authorization must be obtained for any use or disclosure of
Protected Health Information for marketing purposes, except
if the communication is in the form of: |
| 5.1 |
A face-to-face communication made by LSUHSC-NO to an
individual; or |
| 5.2 |
A promotional gift of nominal value provided by
LSUHSC-NO. |
| 5.3 |
If the marketing involves direct or indirect
remuneration to LSUHSC-NO from a third party, the
authorization must state that. |
| 6.0 |
Invalid Authorizations: LSUHSC-NO cannot accept an
authorization that contains any of the following defects: |
| 6.1 |
The expiration date has passed or the expiration event
is known LSUHSC-NO to have occurred; |
| 6.2 |
The authorization has not been filled out completely,
with respect to information that is required for a valid
authorization form; |
| 6.3 |
The authorization is known by LSUHSC-NO to have been
revoked; |
| 6.4 |
The authorization violates any requirements of this
policy; or |
| 6.5 |
Any material information in the authorization is known
by our LSUHSC-NO to be false. |
| 7.0 |
Compound Authorizations: An authorization for
use or disclosure of PHI may not be combined with
any other document to create a compound
authorization, except as follows: |
| 7.1 |
An authorization for the use or disclosure of
PHI for a research study may be combined with any
other type of written permission for the same
research study, including another authorization
for the use or disclosure of PHI for such research
or a consent to participate in such research; |
| 7.2 |
An authorization for a use or disclosure of
psychotherapy notes may only be combined with
another authorization that also regards
psychotherapy notes; |
| 7.3 |
An authorization under this section, other
than an authorization for a use or disclosure of
psychotherapy notes, may be combined with any
other such authorization under this section,
except when LSUHSC-NO has conditioned the
provision of treatment, payment, enrollment in the
health plan, or eligibility for benefits under
this section on the provision of one of the
authorizations. |
| 8.0 |
Prohibition on Conditioning of Authorizations:
LSUHSC-NO may not condition treatment, payment,
enrollment in our health plan, or eligibility for
benefits to an individual on the signing of an
authorization, except in the following
circumstances: |
| 8.1 |
LSUHSC-NO may condition the provision of
research-related treatment on the signing of an
authorization for the use or disclosure of PHI for
research; or |
| 8.2 |
LSUHSC-NO may condition the provision of
health care that is solely for the purpose of
creating PHI for disclosure to a third party on
the signing of an authorization for the disclosure
of the PHI to such third party. |
| 9.0 |
Revocation of an Authorization: An individual
may revoke his or her authorization at any time,
provided that the revocation is in writing, except
to the extent that: |
| 9.1 |
LSUHSC-NO has taken action in reliance on the
signed authorization; or |
| 9.2 |
If the authorization was obtained as a
condition of obtaining insurance coverage, other
law provides the insurer with the right to contest
a claim under the policy or the policy itself.
|
| 10.0 |
Documentation Requirements: LSUHSC-NO must
retain copies of all signed authorization forms
for six (6) years from the date the authorization
was last in effect. The authorization forms may be
retained in a paper or electronic format. |
REFERENCES: 45 C.F.R. § 164.508
|
