PRIVACY POLICY AND PROCEDURES	Policy #: 2100.4
LSU Health Sciences Center New Orleans Date Effective: April 14, 2003	Table of Contents

Minimum Necessary Policy

Uses and Disclosures of Protected Health Information with Minimum Necessary Standard

SCOPE:

All Louisiana State University (LSU) System health care facilities and providers including, but not limited to hospitals, physician practices, clinics, schools, etc. on the LSU Health Sciences Center New Orleans Academic Campus.

Nota Bene: All LSU System health care facilities and providers including, but not limited to hospitals, physician clinics, schools, etc. on the LSU Health Sciences Center New Orleans Academic Campus, are referred to in this policy as LSUHSC-NO.

PURPOSE:

LSUHSC-NO is committed to ensuring the privacy and confidentiality of protected health information that is used or disclosed by the LSUHSC-NO workforce during the course of their work while ensuring that LSUHSC-NO has access to the information that is required to accomplish its mission, goals, and objectives. LSUHSC-NO will make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request as required under the HIPAA Privacy regulation [45 CFR 164.514 (d)] and other applicable federal, state, and local laws and regulations.

POLICY:

LSUHSC-NO will make reasonable efforts to limit the use, disclosure, and requests for protected health information to the minimum necessary to accomplish the intended purpose either for use or disclosure of protected health information or when requesting protected health information from another covered entity.

This policy does not apply to the following uses or disclosures:

Disclosures to or requests by a provider for treatment purposes;
Disclosures made to the individual who is the subject of the information;
Uses or disclosures pursuant to an authorization;
Disclosures made to the Department of Health and Human Services;
Uses or disclosures required by law; and
Uses or disclosures required for compliance with HIPAA and other applicable laws and regulations.

DEFINITIONS:

Protected Health Information (sometimes referred to as “PHI”) – for purposes of this policy means individually identifiable health information, that relates to the past, present or future health care services provided to an individual. Examples of Protected Health Information include medical and billing records of the patient.

PROCEDURE:

1.0	LSUHSC-NO will develop protocols appropriate to its business practices or operations that identify: Those workforce members or classes of workforce members who need access to protected health information to carry out their duties; The category or categories of protected health information to which such workforce member or class needs access; and Any conditions appropriate to such access.
2.0	For disclosures on a routine or recurring basis, LSUHSC-NO has established protocols that will be used to delineate those uses and disclosures which: Encompass treatment, payment, and operations; Are permitted by law; or Are permitted or required by the HIPAA regulations if the disclosure is one that must be included in an accounting of disclosures, the required information will be documented.
3.0	All disclosures of protected health information which are non-standard or non-recurring will be forwarded to the Privacy Officer who will determine, using established criteria, what information will be disclosed (if any): The specificity of the request; The purpose or importance of the request; The impact (both positive and negative) to the member; The impact (both positive and negative) to LSUHSC-NO; The extent to which the disclosure would extend the number of individuals or entities with access to protected health information; The likelihood of redisclosure; The ability to achieve the same purpose with de-identified information; Technology and cost available to limit the disclosure; and Any other factors believed to be relevant to the determination.
4.0	LSUHSC-NO workforce members may reasonably rely on requests from the following in determining the minimum necessary information for disclosures: Public health and law enforcement agencies; Other covered entities; or A professional who is a member of its workforce or is a business associate of LSUHSC-NO for the purpose of providing professional services to LSUHSC-NO, if the professional represents that the information requested is the minimum necessary for the stated purpose.

5.0	In the event of disclosures for research purposes, LSUHSC-NO will review the documentation of required Institutional Review Board or other entity in determining the minimum amount of protected health information necessary.
5.1	LSUHSC-NO may use de-identified data or a Limited Data Set when disclosing this information.
5.2	If a Limited Data Set is used, LSUHSC-NO will acquire a Data Use Agreement before disclosing the information.
6.0	The disclosure of an entire medical record will not be made except as provided in the POLICY section above or pursuant to policies which specifically justify why the entire medical record is needed.

REFERENCE:

45 CFR 164.502 (b)