Policy Statement #31 | Office of General Counsel

Policy Statement #31

Privacy and Confidentiality of Individually Identifiable Health Care Information under HIPAA

I. Introduction

A. This policy addresses The University of North Carolina at Charlotte's obligations to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its accompanying privacy regulations, which require the University's health care components to protect against unauthorized use or disclosure of individually identifiable health information (specifically "protected health information" or "PHI").

B. PHI under HIPAA excludes individually identifiable health information in education records, including student health records, covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 USC 1232g and records described at 20 USC 1232g(a)(4)(B)(iv). FERPA guidance is provided by the University's FERPA Policy (Policy Statement #69). Records protected by FERPA will be protected and disclosed as mandated by FERPA and University policy. It is the goal of the University, however, to apply HIPAA regulations and practices so long as such application does not result in a violation of FERPA.

II. Policy Statement

A. The University recognizes its obligations under federal and state law to protect the confidentiality of PHI. Uses and disclosures of PHI in any form are subject to HIPAA, applicable state law, this policy, and any related University policies, regulations, and rules.

B. When possible prior to providing care, a covered health care component of the University'shall obtain and retain from each patient or authorized representative a signed and dated general consent to use or disclose PHI to carry out treatment, payment, and health care operations.

C. To use or disclose PHI for any purpose other than treatment, payment, or health care operations, a covered component must obtain a signed and dated specific authorization (on a form approved by the University's HIPAA Privacy Officer) from the patient or authorized representative, unless authorization is waived or not required under HIPAA.

Any release of information for purposes other than treatment, payment, or health care operations without a signed authorization must be reviewed and approved by the University's HIPAA Privacy Officer, except (1) where the release is to the individual patient, (2) where delay in seeking such approval would impair response to a health or safety emergency, or (3) where such release is permitted by rules of the covered health care component.

D. Each covered health care component is delegated the authority to establish rules governing the release of PHI without authorization. Rules must be approved by the University's HIPAA Privacy Officer.

III. Definitions

A. Protected Health Information: PHI is health information, including demographic information, created or received by the University's health components which relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual and that identifies or can be used to identify any individual. PHI does not include education records subject to FERPA or de-identified PHI.

B.De-identified PHI: Health information that cannot be identified to the individual patient. De-identified PHI must remove specific identifiers (set forth in HIPAA) with respect to the individual, his or her relatives, employers, and household members.

C. Consent: Consent for purposes of this policy is permission for use and disclosure of an individual's PHI for treatment, payment, and health care operations.

D. Treatment: For the purposes of this policy, treatment is the provision, coordination or management of health care and related services by health care providers, the referral of a patient from one provider to another, or the coordination of health care or other services among health care providers and third parties authorized by the health plan or the individual.

E. Payment: For the purposes of this policy, payment includes the activities undertaken to obtain reimbursement, including insurance for the provision of health care.

F. Health Care Operations: Health care operations are the functions necessary for the support of treatment or payment. These functions include, but are not limited to, conducting quality assessment and improvement activities, reviewing the competence or qualifications of health care professionals, business planning and development, business management, and general administrative activities of a covered health care component.

G. Authorization: An authorization, for purposes of this policy, is a specialized written permission for use and/or disclosure of an individual's PHI for purposes other than treatment, payment, or health care operations. An authorization must contain specific elements as approved by the University's HIPAA Privacy Officer.

H. Covered Health Care Components: Covered health care components are those units that are health care providers and engage in HIPAA electronic transactions. The University's only covered health care component is its Student Health Services. The following functional units that provides support services to this covered component are also included:

Internal Audit Office
General Counsel's Office
Information Technology Services Office
Cashier's Office
Accounts Payable Office
Insurance Office
The University's HIPAA Privacy Officer and HIPAA Security Officer

I. Business Associate: A person or entity that is not a part of the University's workforce, which performs certain functions, activities, or services for the University's covered health care components involving the use and/or disclosure of PHI.

J. Designated Record Set: Records that are the medical and billing records used in part or in whole to make decisions about the patient, except for psychotherapy notes and other records which under the law may not be accessed by the patient.

K. HIPAA Privacy Officer and HIPAA Security Officer: Unless otherwise designated by the University, the Director of Student Health Services shall hold the titles of HIPAA Privacy Officer and HIPAA Security Officer.

IV. Operating Procedures

A. Notice of Privacy Practices. The University's covered health care components shall provide to each patient, no later than the date of the first service delivery, a Notice of Privacy Practices containing a description of (a) the uses and disclosures of PHI that may be made by a covered health care component of the University, (b) the covered component's duties with regard to PHI, and (c) the rights afforded to patients. The Notice of Privacy Practices must be posted by each covered component and made available to patients on request.

B. Generally Permitted Uses and Disclosures of PHI (other than for treatment, payment and health care operations).

De-identified PHI. De-identified PHI may be used or disclosed without consent or authorization as long as no means of re-identification is disclosed. Release of de-identified PHI by a covered health care component of the University must receive the prior approval of the University's HIPAA Privacy Officer.
Marketing. The use or disclosure of PHI for marketing purposes (communication intended to encourage the purchase or use of products or services) requires an authorization, except for face-to-face communications with the individual patient by the covered health care component (a) to describe health related products or services that are provided by or included in a plan of benefits; (b) for treatment of the patient; or (c) for case management or care coordination or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to that individual.
Business Associates. PHI may be used and disclosed to a business associate of a covered component provided the business associate has signed and is in compliance with a Business Associate Agreement in a form approved by the University's HIPAA Privacy Officer.
Research. Use or disclosure of PHI for University research purposes generally requires the permission of the patient(s). Such permission must be in the form of an authorization as defined above. Use or disclosure is permitted without authorization if the University's institutional review board (IRB) grants a waiver of the authorization.

C. Consent or Authorization Not Required under HIPAA. The disclosures without consent or authorization that are permitted by HIPAA are set forth below. To the extent that North Carolina law is more stringent or provides greater privacy protection, North Carolina law will apply.

Disclosures required by law. PHI may be disclosed to the extent required by law.
Public Health Activities. PHI may be used and disclosed to a public health authority that is authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability, including public health issues, vital records, child or adult abuse or neglect, adverse food or drug events, and investigations of work-related illnesses or injuries as required by law.
Victims of Abuse, Neglect or Domestic Violence. PHI may be used or disclosed to a government authority that is investigating a report of abuse, neglect, or domestic violence to the extent disclosure is required or permitted by law.
Health Oversight Activities. With certain exceptions, PHI may be used or disclosed to a health oversight agency for oversight activities authorized by law, including audits, civil, administrative or criminal investigations or proceedings, inspections, licensure, or disciplinary actions.
Judicial and Administrative Proceedings. PHI may be disclosed in the course of a judicial or administrative proceeding in response to a valid court order.
Law enforcement purposes. PHI may be disclosed for law enforcement purposes under certain conditions.
Decedents. PHI regarding decedents may be disclosed to coroners, medical examiners, and funeral directors if necessary to carry out their duties.
Serious Threats to Health or Safety. PHI may be used or disclosed under certain circumstances if a covered component believes in good faith that the use or disclosure is necessary to protect a person or the public from serious harm.
Specialized Government functions. PHI may be used or disclosed for specialized government functions such as military and veterans' activities, security and intelligence activities, protective services for officials, medical suitability, and correctional institutions and other law enforcement custodial situations.
Workers Compensation. PHI may be used or disclosed to the extent required to comply with workers' compensation laws and similar programs.

D. Revocation of Authorization. Under any circumstances other than those listed above, written authorization will be obtained before use or disclosure of patient's PHI. This authorization may be subsequently revoked by the patient in writing. Upon receipt of such revocation, a covered health care component of the University will not disclose the patient's PHI, except for disclosures which were in process prior to the receipt of the revocation.

V. Minimum Necessary Standard.

Covered health care components must limit uses and disclosures of PHI to the minimum necessary to accomplish the intended purpose of the use or disclosure except (1) disclosures to or requests by a health care provider for treatment purposes; (2) disclosures to the individual patient; (3) uses and disclosures with authorization; or (4) uses and disclosures for research with IRB waiver of authorization.

VI. Patient Rights.

A. Right to Receive a Notice of Privacy Practices. No later than the date of the first delivery of health care services, a patient has the right to receive a Notice of Privacy Practices containing a description of (a) the uses and disclosures of PHI that may be made by a covered health care component of the University, (b) the covered component's duties with regard to PHI, and (c) the rights afforded to patients. The Notice of Privacy Practices is provided by the applicable covered health care component.

C. Right to Request an Amendment of PHI. A patient has a right to request an amendment of PHI contained in designated records sets. A covered health care component is not required to grant the request for amendment and may deny the request under specified circumstances.

D. Right to an Accounting of Disclosures. A patient has the general right to receive an accounting of disclosures of PHI in the six years prior to the request. A patient must make a request for a list of disclosures to the applicable covered health care component.