Expert answer:Release of Information
Expert answer:In this assignment, you will be working with the Release of Information (ROI) Department. With this in mind, you should familiarize yourself with the HIPPA Guidelines and ROI documents below before you begin.HIPAA’s Privacy Rule and Release of Information GuidelinesRasmussen Medical Center – Release of Information PoliciesPeggy Smith, the Assistant Director of the HIM department, has taken over the ROI department after being notified that the ROI Supervisor will be out indefinitely. Peggy has learned that she has two tasks to handle immediately. The first task is responding to a variety of ROI requests. The second task is developing an accounting of disclosures for ROI tracking.Part 1 – Release of Information RequestsDownload the Release of Information Requests Worksheet.Read the case provided and review the ROI scenarios described. After analyzing the situations, comment whether you agree or disagree with how Peggy handled each situation. Give your reasons for agreeing or disagreeing with her actions. Save your answers in the worksheet.Part 2 – Accounting of Disclosures FormA patient has requested an Accounting of Disclosures. Peggy quickly realizes the department does not have a formal document to present to the patient. She must now create an Accounting of Disclosures form and has asked you for assistance.Review the documents provided above for the HIPAA Guidelines and RMC Release of Information Policies. It is a HIPAA rule that all health information releases must be tracked. The HIPAA and ROI materials suggest what type of information must be tracked. Some HIM department have an HIM software application that can be used to do this, while others simply use Excel or Word to set up a tracking system.For this assignment, design an Accounting of Disclosures Form using an Excel spreadsheet or a Word table or form document. Be sure it includes each of the areas that are required on an Accounting of Disclosures form. It may be helpful to research Accounting of Disclosures forms using your preferred Internet search engine.Once you have your form designed, fill in the information for one patient simply using made-up information.2 Documents needs submitted separately (Worksheet and Excel Table)
rmc_roi_policies.pdf
roi_part_1a__worksheet.docx
roi_hipaa_guidelines.pdf
Unformatted Attachment Preview
RMC Release of Information Policies
Rasmussen Medical Center
Health Information Department
Release of Information Policies
1
RMC Release of Information Policies
Release of Information Overview
This should serve as a resource for those individuals responsible for managing or
performing the process of release of information. Health care providers have a duty to
maintain patient privacy and to release information when appropriate. Patient health
information should be considered confidential and should be released only in
accordance with a health care information disclosure policy. The policy must define
when a patient’s authorization is required and should comply with state and federal
statutes, the Health Insurance Portability and Accountability Act (HIPAA), Patient Bill of
Rights, court rulings, administrative rules, and accrediting and regulatory agency
requirements.
The HIM professional is considered the key individual in developing, implementing and
maintaining privacy policies and procedures due to their specific training in handling
these particular situations. An HIM professional’s education and experience includes
confidentiality, legal issues, and critical thinking in a variety of situations.
Patient information must be protected from unauthorized, inappropriate, or unnecessary
access. Federal regulations under HIPAA established national requirements for
confidentiality.
Considerations for Disclosure
The principal considerations for determining when information may be disclosed are:
Whether a patient authorization is required
The nature of the information requested
Whether it is confidential or non-confidential
The purpose of the request
The authority of the person or agency requesting the information
Whether any revocations or notices to withhold information are on file
State Law
This state has a statute that identifies provisions for access to health care records. The
basic provisions of the law are:
A. The patient has a right to access health care information that pertains to the
patient’s examination or treatment of a medical, psychiatric or mental condition.
B. Upon written request from the patient, a health care provider has an obligation to
supply the patient with health care information.
C. A signed and dated patient authorization is required for release of health care
information except under the following circumstances:
2
RMC Release of Information Policies
D.
E.
F.
G.
H.
I.
J.
K.
L.
a. Disclosure is authorized by law
b. Disclosure of immunization date
c. Medical emergency
Health care information may be released without patient authorization for medical
or scientific research unless the patient has specifically objected to disclosure for
research purposes. The health care provider must make a “reasonable effort to
determine” that the researcher or organization will protect the record from
unauthorized disclosure or misuse.
Health care information may not be re-released without a signed and dated
authorization from the patient or patient’s legally authorized representative,
unless the release is specifically authorized by law.
An authorization is valid for one year or for a lesser period if specified in the
authorization. The authorization does not expire after one year for:
a. Other health care providers
b. Health insurance plans
c. Life insurance
With patient’s authorization, the provider may furnish a summary of the record, or
copies of pertinent portions of the record, in lieu of the entire record.
The provider may charge a reasonable fee for the copies.
Information may be withheld if a provider determines that information in the
record is detrimental to the physical or mental health of the patient, or is likely to
cause the patient to inflict self-harm or to harm another.
a. In a licensed health care facility, this determination to withhold information
must be made by the health care provider before a request is received,
otherwise the request must be honored.
b. If the patient is a subject of a competency hearing, full access must be
allowed.
A person who released health records in violation of this statute, or who alters
the authorization from of another person without the person’s consent, is liable to
the patient for damages.
A provider who inappropriately charges for health care information may be
subject to disciplinary action by the Board of Medical Practice for Physicians, or
the State Health Department for other providers.
A health care provider should develop procedures for documenting access
restrictions. The restrictions should be visibly documented in the patient health
record. When information is withheld from the patient, the provider may release
the information to an appropriate third party or to another health care provider,
who may then release the information to the patient.
3
RMC Release of Information Policies
Authorization Requirements
Written patient authorization is required to release health care information. The
authorization may be an original, a facsimile/scanned image or a photocopy. Some
facilities will not accept a photocopy or fax or scanned image as the original unless a
statement is present on the authorization states a photocopy or image is treated ion the
same manner as the original.
The authorization should include the following components or elements:
Plain language
Name of institution or provider that is to release the information
Name of individual or institution that is to receive the information
Patient’s full name, address, and date of birth
A description of the information to be disclosed with sufficient specificity to
allow the facility or provider to know which information the authorization
references
The name or other specific identification of the person that is authorized to
make the disclosure
A specific expiration date, a specific expiration time period, or an event at
which the authorization will expire that is directly relevant to the individual
or the purpose of the disclosure
A statement of the individual’s right to revoke the authorization in writing
Instructions on how the individual may revoke the authorization in writing
A statement informing the individual that information may be subject to redisclosure by the recipient and may no longer be protected by the HIPAA
rule
A statement that the record may include provider records from other
facilities or providers of care
The individual’s signature and date of signature
If the authorization is signed by a personal representative of the individual,
the representative must indicate his or her authority to act for the
individual.
Specific Types of Releases
Deceased Patients
The surviving spouse or parents of a deceased patient, or a person the patient
designates in writing as a representative, may authorize release of the patient’s records.
4
RMC Release of Information Policies
If there is no surviving spouse or parents, the law does not specify who may authorize
release. The provider may require legal representation be established for a party to
authorize disclosure of the record. The legal representative of the patient (i.e. executor
of the estate) may authorize disclosure of the records. Legal documentation from the
court should be requested to provide proof of appointment.
The state’s ombudsman for mental health and mental retardation is not required to
obtain consent for access to private data on decedents who were receiving services for
mental illness, mental retardation or a related condition, or emotional disturbance.
Requirements:
A patient’s authorization or consent does not survive his or her death. A
deceased person cannot authorize in advance release of his or her own
patient information.
Powers of attorney are revoked by the death of the principal (patient).
The executor of the patient’s estate should sign the authorization for
release of information.
Prison Inmates
Federal Prison: health care records of an inmate of a federal prison do not belong to
the patient (inmate), therefore may not be release with an authorization signed by the
patient (inmate).
Permission from the Federal Government is required for release of any health care
records of an inmate of a federal prison.
Mentally or Physically Incompetent Patient
If a patient is not competent to sign an authorization to release health care information,
but has not been legally adjudicated to be incompetent, discretion must be used in
obtaining an authorization. It is recommended that the next of kin authorize to release
of information. If a person has been adjudicated to be incompetent, refer to Guardians
and Conservators.
Guardian/Conservator
A court may find that a person is incompetent to manage personal affairs. In this case a
guardian or conservator will be appointed. Guardians have the authority to release
health care information. Conservators may or may not have authority over an
individual’s health care needs. With either a guardian or conservator, proof of
appointment and authority to release health care information should be presented.
5
RMC Release of Information Policies
Custodial / Divorced Parents
When the parents of a child are divorced, either parent may authorize release or have
access to the health care information of the minor child, regardless of which parent has
been awarded legal custody. Only when the parental rights have been terminated or a
court has set specific limitations with respect to the child’s health care and access to
records can the parent be denied access to their minor child’s health care information.
The health information professional may contact the custodial parent to inform them that
a request has been received from the other parent for health record information, but this
is not required.
If one parent requests that access be denied to the other parent, legal documentation
from the court must be provided to prove termination of parental rights or other
restrictions.
HIV/AIDS Records
Specific patient access or release statutes do not regulate health care records
pertaining to HIV and AIDS testing and results. Health care providers should take extra
precaution to ensure patient confidentiality of these records due to the sensitivity of
information, public attitudes, and the potential consequences from an unnecessary HIV
test or inappropriate release of HIV/AIDS information. Even though law does not
specifically protect this information, the sensitivity issues may merit the development of
special procedures. Unless specifically asked for and authorized by the patient, HIV
and AIDS records should not be released.
County Attorney Requests
A county attorney is allowed access to health care records of incarcerated individuals in
the state prison if the Department of Corrections refers the case for commitment as a
sexual psychopath or sexually dangerous person. This would apply to prison inmates
who are nearing the completion of their sentence for sex crimes and whom the
Corrections Department feels would be a public risk if they are released.
Independent Medical Examination
In an independent medical examination (IME), there is no physician-patient relationship.
The results of the examination do not become part of the health care record. The
original report goes directly to the third party who requested or paid for the examination.
The examinee’s consent is not required for the provider who performed the examination
to release the report to the third party who requested and or paid for the examination.
6
RMC Release of Information Policies
Medical Examiner / Coroner
Release of health care records is allowed to the medical examiner / coroner. Health
care records on the deceased whose death is being investigated shall be made
promptly available to the medical examiner/coroner upon the written request of the
medical examiner/coroner. The medical examiner/coroner shall pay the reasonable
costs for copies of records or data provided.
Worker’s Compensation Requests
Statutes provide for release of medical data related to a current worker’s compensation
claim to the employee, employer, or insurer who are parties to the claim or to the
Department of Labor and Industry. A patient authorization is not required as consent is
implied when a claim is filed. A request for copies of health care records must be in
writing. Health care information not directly related to the specific injury or disability
should not be released without authorization of the patient. In addition, only written
data, which exists at the time the request is made, shall be released. Future information
may be released only with another written request.
Board of Medical Practice Requests
Physicians have the obligation to comply fully with the Board of Medical Practice
investigations. This includes providing copies of records, for which the Board of Medical
Practice will pay the usual and customary charges. The Board of Medical Practice
generally obtains patient authorization for release of records for all patient initiated
complaints. The Board of Medical Practice is not required to obtain patient
authorization in investigation of Board initiated complaints. In this case, the releasing
facility or provider should delete all patient identification information from the copies
being released.
7
Module 04 Written Assignment – Release of Information – Part 1
Read the following case and the 5 release of information (ROI) situations described beneath it. For
each of the 5 ROI scenarios, there is also a description of the action that Peggy took to handle the
situation. Comment on whether you agree or disagree with the action that Peggy took to handle the
situation and give your reasons for agreeing or disagreeing with her actions.
Peggy Smith, RHIA is Assistant Director of the Health Information
Department at Minnesota Hospital. As part of her assigned responsibilities
she supervises the release of information function within the department.
Until today, she had very little occasion to be involved in the day-to-day
operation of release of information, as she had an excellent ROI supervisor
who was the expert in this area. However, she has just learned that the ROI
supervisor will be out indefinitely because she was injured in an automobile
accident the previous evening. Unfortunately, there is no backup for Patsy’s
position because they have not filled the vacant ROI clerk position yet. The
department director Georgia Lang has informed Peggy that she will have to
handle the release of information duties until the supervisor returns or the
clerk position is filled. Peggy assigned the file room clerk, Matt, to handle
walk-in ROI requests in addition to her file room duties. She shows Matt how
to have patients complete an “Authorization for Release of Information” form
and gives him explicit instructions to refer all special requests back to her.
Peggy will handle telephone and mail requests. It has been a while since
Peggy graduated from an HIT program, so she is a little nervous about not
being knowledgeable about current ROI standards. She reminds herself that
next time there is continuing education money available in the budget; she
will request funds for attending a ROI/legal seminar.
Situation 1: An Emergency Services Department (ESD) physician at another hospital requests the
immediate transmission of a patient’s latest EKG and echocardiography report. The patient is now in his
ESD with chest pain.
Action: Peggy faxed the reports.
Comment:
Situation 2: Peggy opens a letter from Blue Cross/Blue Shield requesting copies of an individual’s
discharge summary and pathology report. BCBS is the patient’s payer, however, no patient authorization
is attached.
Action: Peggy sends back a letter informing BCBS that the hospital cannot release any patient
information without first having a properly executed patient authorization.
Comment:
Page 1 of 2
Situation 3: The department receptionist informs Peggy that a gentleman from the state Department of
Health has arrived and is requesting to review the medical records of three tuberculosis patients.
Action: Peggy contacts the file room and has the records brought to her office for the state
representative to review.
Comment:
Situation 4: Peggy takes a telephone call from an area high school principal who is requesting
information about one of the teachers at his school. He specifically wants to know the reason for her
hospitalization.
Action: Peggy tells the principal that health information is confidential and cannot be release
without the patient’s written authorization to do so.
Comment:
Situation 5: The Medical Examiner’s (ME) office calls requesting a copy of an operative report for a
patient who recently expired in the operating room at the hospital.
Action: Peggy tells them that an authorization is first needed from the deceased patient’s
estate before he can release any information.
Comment:
Page 2 of 2
HIPAA’S PRIVACY RULE AND RELEASE OF INFORMATION
AUTHORIZATIONS
SECTION 164.508
Unless otherwise permitted, PHI may not be used or disclosed without a valid authorization.
Special rules apply to:
Disclosure of psychotherapy notes
Marketing
Seven Core Elements of a Valid Authorization
1.
2.
3.
4.
5.
6.
7.
A description of information to be used or disclosed
The identification of the person or class of persons authorized to make the use or disclosure of the
PHI
The identification of the persons or class of persons to whom the covered entity is authorized to
make the use or disclosure
A description of each purpose of the use or disclosure
An expiration date or event
The individual’s signature and date
If signed by a person representative, a description of his/her authority to act for the individual
Three Required Statements of a Valid Authorization
1.
2.
An individual may revoke an authorization in writing. Plus:
a. An additional statement regarding the exceptions to an individual’s right to revoke and
specific instructions on how to revoke or;
b. A reference to the covered entity’s Notice of Privacy Practices, if this information is included.
Treatment, payment, enrollment, or eligibility of benefits may not be conditioned on obtaining the
individual’s authorization. (In other words, one cannot say “sign this or we won’t treat you” or “sign
this or we won’t cover your care.”
OR:
Where the Privacy Rule allows for such conditioning, delineation of the specific consequences to an
individual if he/she refuses to sign the authorization form.
3.
The potential for the PHI to be redisclosed by the recipient and thus, no longer protected under the
Privacy Rule
An example of a redisclosure:
You send patient information to Happy Hospital. Two years later Happy Hospital includes that information
in a disclosure to an attorney. (This should not happen but it could. We should never disclose information
we received from another facility. The requestor should go back to that facility for that information)
Other Considerations for a Valid Authorization
All authorizations “must be in plain language”.
Other elements or information may be included as long as they are not in conflict with
requirements.
Combined Authorizations
In general, an authorization for use and disclosure of PHI may not be combined with any other document to
create a compound authorization except for:
Research
Psychotherapy notes
Another authorization under Section 164.508
Documentation Requirements
A copy of the signed authorization form can be given to the patient or individual.
Covered entities must document and retain all signed authorizations for a period of six years
from date of creation or when last in effect, whichever is later.
Revoking an Authorization
Revocation of an authorization is allowed at any time as long as:
It is requested by the individual in …
Purchase answer to see full
attachment
How it works
- Paste your instructions in the instructions box. You can also attach an instructions file
- Select the writer category, deadline, education level and review the instructions
- Make a payment for the order to be assignment to a writer
- Download the paper after the writer uploads it
Will the writer plagiarize my essay?
You will get a plagiarism-free paper and you can get an originality report upon request.
Is this service safe?
All the personal information is confidential and we have 100% safe payment methods. We also guarantee good grades