OF PROTECTED HEALTH INFORMATION

PURPOSE

The purpose of this Policy is to set forth the Office's process for the use and disclosure of Protected Health Information ("PHI") pursuant to a written authorization.

POLICY

In accordance with the HIPAA Privacy Rule, when PHI is to be used or disclosed for purposes other than treatment, payment, or health care operations, the Office will use and disclose it only pursuant to a valid, written authorization, unless such use or disclosure is otherwise permitted or required by law. Use or disclosure pursuant to an authorization will be consistent with the terms of such authorization.

PROCEDURE

Exceptions to Authorization Requirements

PHI may be disclosed without an authorization if the disclosure is:

1. Requested by the Patient or his personal representative (authorization is never required);

2. For the purpose of treatment;

3. For the purpose of the Office's payment activities, or the payment activities of the entity receiving the PHI;

4. For the purpose of the Office's health care operations;

5. In limited circumstances, for the health care operations of another Covered Entity, if the other Covered Entity has or had a relationship with the Patient;

6. To the Secretary of the U.S. Department of Health and Human Services for the purpose of determining compliance with the HIPAA Privacy Rule; or

7. Required by other state or federal law. (See "Request and Disclosure Table" in the "Uses and Disclosures of Protected Health Information" Policy for other exceptions.)

Use or Disclosure Pursuant to an Authorization

1. When the Office receives a request for disclosure of PHI, the Office Privacy Official shall determine whether an authorization is required prior to disclosing the PHI.

2. PHI may never be used or disclosed in the absence of a valid written authorization if the use or disclosure is:

a. Of psychotherapy notes as defined by the HIPAA Privacy Rule;

b. For the purpose of marketing; or

c. For the purpose of fundraising.

3. If the use or disclosure requires a written authorization, the Office shall not use or disclose the PHI unless the request for disclosure is accompanied by a valid authorization.

4. If the request for disclosure is not accompanied by a written authorization, the Office Privacy Official shall notify the requestor that it is unable to provide the PHI requested. The Privacy Official will supply the requestor with an Authorization to Use or Disclose PHI ("Authorization") form. (See sample Authorization Form following this Policy.)

5. If the request for disclosure is accompanied by a written authorization, the Privacy Official will review the authorization to assure that it is valid (see the "Checklist for Valid Authorization" following this Policy).

6. If the authorization is lacking a required element or does not otherwise satisfy the HIPAA requirements, the Privacy Official will notify the requestor, in writing, of the deficiencies in the authorization. No PHI will be disclosed unless and until a valid authorization is received.

7. If the authorization is valid, the Privacy Official will disclose the requested PHI to the requester. Only the PHI specified in the authorization will be disclosed.

8. Each authorization shall be filed in the Patient's Medical Record.

Preparing an Authorization for Use or Disclosure

1. When the Office is using or disclosing PHI and an authorization is required for the use or disclosure, the Office will not use or disclose the PHI without a valid written authorization from the Patient or the Patient's personal representative.

2. The Authorization form must be fully completed, signed and dated by the Patient or the Patient's personal representative before the PHI is used or disclosed.

3. The Office may not condition the provision of treatment on the receipt of an authorization except in the following limited circumstances:

a. The provision of research‑related treatment; or

b. The provision of health care that is solely for the purpose of creating PHI for disclosure to a third party (i.e., performing an independent medical examination at the request of an insurer or other third party).