Verification of Requestor

Op10.04-12 Verification of Requestor

Purpose

It is the policy of the University Health Care Components (HCC) to protect the privacy of individually identifiable health information in compliance with federal and state laws governing the use and disclosure of protected health information (PHI). To accomplish that policy, and to establish uniformity in the verification process, prior to disclosing individually identifiable PHI to third parties, the University or Unit Privacy Officer or designee shall verify the identity of the requestor and ensure the requestor has the proper authority to request such information.

Application

The University’s HCC

  1. Definitions
    1. Protected Health Information (PHI): Individually identifiable health information that is transmitted or maintained in any form or medium, by a covered entity, health plan or clearinghouse as defined under HIPAA administration simplification standards.
    2. Individually Identifiable Health Information: Any information, including demographic information, collected from an individual that –
      1. Is created or received by a health care provider, health plan, employer, health care clearinghouse or pharmacy clearinghouse; and
      2. Related to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual, and
      3. Identifies the individual, or
      4. With respect to which, there is reasonable basis to believe that the information can be used to identify the individual.
    3. Verification: Process to verify the identity of a person requesting PHI and the authority of any such person to have access to PHI under this subpart, if the identity or any such authority of such person is not known to the HCC; and must include obtaining any documentation, statements, or representations, whether oral or written from the person requesting the PHI when such documentation, statement or representation is a condition of the disclosure under this subpart.
    4. Privacy Officer: The person officially designated to oversee activities related to the development, implementation, maintenance of, and adherence to HCC regulations pertaining to the privacy of, and access to, patient health information in compliance with federal and state laws and the Notice of Privacy Practices. See HIPAA Procedure 1.005, Form 3.
    5. Public Official: A person who has been legally elected or appointed and who has been empowered by law/regulation to exercise the duties and functions of their office for the public good.
  2. Procedure
    1. The patient or personal representative must sign a valid authorization for the disclosure of confidential PHI before such PHI can be released, except in accordance with existing HIPAA requirements.
    2. All requests for disclosure shall be forwarded to the Unit Privacy Officer or designee including the following:
      1. The name of the requesting party or parties and
      2. Any documentation, statements or representations from the person requesting the PHI of his/her authority to request such information (i.e., legal representative of patient, law enforcement official, etc.).
    3. The patient must present identification prior to receipt of any records regarding themselves.
    4. The Unit Privacy Officer or designee may rely on the following information to demonstrate identity:
      1. Presentation of agency identification, credentials or other proof of government status (a badge, identification card, etc.);
      2. A written request on agency letterhead or an oral statement if a written statement would not be possible (a natural disaster, other emergency situations, etc.);
      3. If the disclosure is requested by a person acting on behalf of a public official, a written statement on government letterhead that the person is acting under the government’s authority, or a contract or purchase order evidencing the same; or
      4. A court order.
    5. The Unit Privacy Officer or designee shall verify identity of any phone requests from all individuals, including law enforcement officers and others who have an official need for PHI by using a callback phone number before releasing information.
    6. The Unit Privacy Officer or designee shall verify facsimile number of any faxed requests. The main number of the sending agency shall be called, and the fax number verified. Each HCC shall set its fax machines to imprint the origin. All incoming faxes shall be reviewed for imprint origin.
    7. The Unit Privacy Officer or designee shall verify email address by calling requestor. The general number for the sending agency shall be called, and then a request shall be made to be transferred to the specific individual who made the contact.
    8. The Unit Privacy Officer or designee is responsible for copying verification information or obtaining badge number, etc., and for maintaining it in the patient’s health information file.
    9. The Unit Privacy Officer or designee must review the forwarded information and determine if he or she is satisfied that the documents verify the identity of the requestor and that the requestor has authority to request the information under state and federal law.
    10. The Unit Privacy Officer or designee may disclose information to the requestor if all requirements for use and disclosure are met.
    11. The Unit Privacy Officer or designee shall contact agencies or other entities for further verification of identity or authority to receive PHI, if necessary.
    12. The Unit Privacy Officer or designee may deny access to information, if verification of identity or authority is not accomplished.
  3. Tracking Disclosures. The University Privacy Officer and Unit Privacy Officer shall assure that a mechanism is in place which tracks disclosure of both written and verbal PHI. One format shall be utilized for all HCCs.
  4. Sanctions. Any person found to have violated the requirements of this policy shall be subject to disciplinary action up to and including dismissal.
  5. Review Process. The University Privacy Officer will collect information from the Unit Privacy Officers during the month of April each year beginning in 2004 for the purpose of providing feedback to the HIPAA Management Team as to compliance with the procedure and any proposed modification or recommendation that additional training be implemented.

HISTORY: Effective March 21, 2003