Releasing PHI in Maine

1. Releasing PHI in Maine Frequently Asked Questions in the OP setting Susan Levenseler, RN, BSN, Clinical Quality Improvement Manager, Maine Medical Partners Chris Simons, RHIA, Director, HIM and Privacy Officer, Spring Harbor Hospital

2. Release of Information Basics • Privacy is a cornerstone of Medical Ethics • Privacy and Security protections mandated by State (1711C and HIV) and Federal (HIPAA and Substance Abuse) law • Simple concept, difficult to achieve • Many gray areas- technology helps and hinders! • Every covered entity MUST have an identified Privacy & Security Officer, and NOP

3. Anyone hear about this Guy? • Now that we have your attention…..

4. Office Practice Basics • HIPAA requires “reasonable” safeguards • Examples: • Don’t call full names in waiting room or use sign in sheets with names • Avoid conversations others may overhear • Avoid leaving answering machine messages • Watch out for portable devices • Telephone- a dangerous instrument! • Remember the “Need to Know” Principle

5. More “Reasonable” Safeguards • Fax only when absolutely necessary • Avoid Emailing patient names (discovery issues) • Be sure work station is confidential (privacy screens) • Keep papers turned over, avoid names on the outside of folders or as papers are transported • Don’t let faxes/printers build up • Role Based Access • Audit Trails • Passwords • Interesting Stories • Cell phones • Record security/destruction

6. ROI Basics • OK to release non sensitive info based on phone consent, though many practices do not. • Specific WRITTEN Consent required for SA, MH and HIV • Must be signed by patient/LAR (get proof!) • Must include right to revoke, expiration date, purpose of release • Risk Management • Blanket release not ok • “When in doubt, don’t give it out” unless emergency

7. Common Concerns- Pt access to own records • Rare to deny- no need for physician review in most cases • Use copy charge as a way of limiting amount released, if you want • Never leave patient alone with record • If on your staff, use proper procedures for all • Use good documentation practices- assume patient will read anything written (along with many others!)

8. Minors • Mom calls your office. She wants a copy of her 16 year old’s last physical exam. The documentation notes that the teen is sexually active.

9. Minors • Legal interpretations differ • Generally, if minors may consent for treatment, they may also consent to release info for that treatment • Don’t promise privacy– any record can be obtained with a court order • Don’t forget the bill • Teach documentation practices that lead to redaction (and devise templates that way)

10. Divorce • A 7 year old’s father calls your office, irate. It seems his ex wife has brought the child to you for an examination for possible sexual abuse.

11. Divorce • ME law- both bio parents have equal rights in absence of order • Document your advice to include the other partner in decision making, if appropriate. • Remind parents that you are health care organization, not a court room!

12. Interested Parties • A 12 year old’s grandmother has brought her in for a tetanus shot. • One of your patients has recently died. Her son now comes to you, asking for a copy of his mother’s record.

13. Interested Parties • Step parents have no legal rights but can get a release • Babysitters, foster parents, grandparents, all can get a letter authorizing treatment • Consider witnessing phone consent if necessary • Deceased patients- ask for proof that requestor is the Personal Representative unless absolutely clear who that is

14. Schools • Your 15 year old patient has issues with substance abuse. His mom has requested that you send a copy of his latest physical exam, which documents this issue, to his high school.

15. Schools • Remember “Need to know” and “minimum necessary”. • Don’t hesitate to redact sensitive information– what is the purpose of this release? • Fax machines often NOT in secure areas. Follow careful faxing procedures if you must fax • Suggest family take documents to school so the consent to release is truly informed (if appropriate)

16. Law Enforcement • You get a call from your patient’s probation officer. He would like the results of the patient’s most recent UA sent to him. • You get an investigative subpoena for the records of one of your adult patients.

17. Law Enforcement/Child Protective/DHHS • Must follow the ROI rules just like everyone else, or get a court order • You must respond to a subpoena, but not necessarily with the record (Investigative subpoenas you must respond to unless Substance Abuse) • Be very careful here– releasing info can have a serious impact on a person’s life. Get legal advice if not sure

18. Reporting • Your practice is concerned about Mr. Smith, a 85 year old in failing health, who is continuing to drive.

19. Mandatory Reporting • Document following mandatory reporting rules • Whenever possible include patient in discussion- rarely should you report anonymously • Release not required by law, but document • Distinguish between MAY report and MUST report

20. More scenarios • You receive a call from a local ED. Your patient is in the ED and is too ill to sign a release. • Mary in your office wants to throw a birthday party for one of your co workers, but doesn’t know the exact day. She looks it up in the electronic patient data base. • A patient’s employer calls for information about his worker’s comp injury.

21. And a few more • An adult patient you have been treating tells you he is thinking of hurting his friend. You believe him. • Mr. Jones calls to see if his wife is in the waiting room- she was supposed to bring the kids in today. • You have been trying hard to reach a patient with abnormal test results. All you get is her answering machine.

22. Confused yet?