Protected Health Information

Op10.04-3 Protected Health Information

Purpose

It is the policy of the Missouri State University (University) to ensure that the records of individually identifiable Protected Health Information ("PHI") are accurate and complete. It is also the policy to recognize the rights of patients to amend PHI pertaining to them in a designated record set, if the patient believes that information is incomplete or incorrect, as referenced in 45 CFR Section 164.526. The University further recognizes that amendments to PHI may be limited or restricted as defined in this policy, in the Notice of Privacy Practices (NPP) and as allowed by law. In cases where the patient has been civilly adjudicated as incapacitated (and therefore appointed a guardian) or is a minor, the parent (if a minor), or the legal guardian or personal representative may request the amendment.

Application

The University’s HCC

Contents
1. Definitions
2. Request for Amendment to PHI
3. Denial of Request for Amendment to PHI
4. Statement of Disagreement of Denial
5. Attachments
Definitions
1. Patient: any individual who has received or is receiving services from a HCC.
2. Designated record set: a group of any records under the control of a covered entity from which PHI is retrieved by the name of the individual or by identifying number.
3. Personal Representative: person with a court order appointing them as guardian or with a valid Power of Attorney signed by the patient specifying the authority to review and make decisions regarding medical, counseling, therapy, psychiatric, treatment or habilitation concerns. In the case of juveniles who have consented to treatment for alcohol and drug abuse issues as allowed under Section 431.061, RSMO, they are their own personal representatives.
4. PHI is defined as any information, including demographic information collected from an individual that –
  1. Is created or received by a health care provider, health plan, pharmacy, employer, or health care clearinghouse; and
  2. Related to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual, and
    1. Identifies the individual, or
    2. With respect to which, there is reasonable basis to believe that the information can be used to identify the individual.
5. Disclosure of PHI Summary: an accounting of disclosures of PHI (in paper or electronic format) containing: date of disclosure; name and address of the organization or person who received the PHI, a brief description of the information disclosed; purpose for which the PHI was disclosed.
Request for Amendment to PHI
1. A patient, parent of a minor, and personal representative or legal guardian as relevant to their representation, who believes PHI is incomplete or incorrect, may request an amendment or correction of the information as outlined below:
  1. For minor discrepancies, i.e., typos, misspelled name, wrong date, etc., the patient may approach the author of the entry, point out the error, and ask the author to correct it.
    1. If the entry author agrees, the entry can be corrected according to best documentation practices by drawing a single line through the error, adding a note explaining the error (such as "wrong date" or "typo"), date and initial it, and make the correction as close as possible to the original entry in the record.
    2. Any information added to a medical record, in the regular course of business is not considered an amendment. An example would be when a patient provides the name of a new private physician whom he/she sees in the community.
2. All other requests for amendment to PHI shall be in writing and provide a reason to support the amendment. Specifically, any request should be supported by documentation of any incorrect information or incomplete information.
  1. The "Amendment Request Form" shall be provided to facilitate the request. HCC personnel may assist in initiating the process requesting amendment to PHI and a copy shall be provided to the patient.
  2. All requests for amendment of PHI must be forwarded to the Unit Privacy Officer or designee who will route the original request to the author of the PHI or that individual’s supervisor.
  3. If the author chooses to add a comment to the request form, a second copy of the form will be given to the patient with the author’s comments.
  4. This request shall be processed in a timely consistent manner according to established timeframes but not more than 60 days after receipt of the request.
  5. If the request for amendment cannot be processed within the 60 days, the timeframe may be extended no more than an additional 30 days with notification in writing to the individual outlining reasons for the delay and the date the request will be concluded.
  6. If a patient with a guardian requests an amendment, a letter is to be sent to the guardian by the HCC stating that the patient is requesting an amendment, and further requesting that the guardian complete the Amendment Request Form.
3. If the request is granted, the HCC shall:
  1. Insert the amendment or provide a link to the amendment at the site of the information that is the subject of the request for amendment, and then document the change in the same section of the record as the original information.
  2. Inform the patient that the amendment is accepted.
  3. Obtain the authorization of the patient to notify all relevant persons or entities with whom the amendment needs to be shared.
  4. Within a reasonable time frame not to exceed sixty (60) days, make reasonable efforts to provide the amendment to the persons identified by the patient, and any persons, including business associates, that the covered entity knows has been provided the PHI that is the subject of the amendment and who may have relied on or could foreseeably rely on the information to the detriment of the patient. A reasonable time frame is defined as attempts to complete this process within sixty (60) days of the date of the amendment to the record.
  5. If the amendment affects a service for which billing or a charge has already been submitted, then the billing must be reviewed to see if it should be amended or changed as well to reflect the new information.
Denial of Request for Amendment of PHI
1. The HCC may deny the request for amendment to PHI if the PHI that is the subject of the request:
  1. Was not created by the HCC. However, if the patient can provide reasonable proof that the person or entity that created the information is no longer available to make the amendment, and the request is not denied on other grounds, the PHI will be amended.
  2. Is not part of the PHI kept by or for the HCC.
  3. Is not part of the PHI that the patient would be permitted to inspect and copy (for specifics on patient access to PHI, please see HIPAA Procedure 1.030).
  4. The information is accurate and complete.
2. If the HCC denies the requested amendment, it must provide the patient with a timely, written denial, written in plain language that contains:
  1. The basis for the denial;
  2. The patient’s right to submit a written statement disagreeing with the denial and how the patient may file such a statement;
  3. The name, title, address, and telephone number of the person to whom a statement of disagreement should be addressed;
  4. The steps to file a complaint with the Secretary of HHS;
  5. A statement that if the patient does not submit a statement of disagreement, the patient may request that the HCC provides the Amendment Request Form and the denial with any future disclosures of PHI. (See section 5 for further information).
  6. A copy must also be provided to the guardian, if applicable; to parent(s), if applicable; or to Missouri Department of Family Services if that agency has legal and physical custody of the juvenile.
Statement of Disagreement of Denial
1. Patients shall be permitted to submit to the HCC a written statement disagreeing with the denial of all or part of a requested amendment and the basis for the disagreement. This statement of disagreement shall be limited to one page.
2. The statement of disagreement shall be submitted in writing to the Unit Privacy Officer.
3. The HCC may prepare a written rebuttal to the statement of disagreement and must provide the patient with a copy of the rebuttal.
4. The HCC must identify the record of PHI that is the subject of the disputed amendment and append or link the request for an amendment, the denial of the request, the individual’s statement of disagreement, if any, and the HCC rebuttal statement if any.
  1. If the patient has submitted a statement of disagreement, the HCC must include the documents in 5.d., or an accurate summary of the information, with any subsequent disclosure of the PHI to which the disagreement relates.
  2. If the patient has not submitted a written statement of disagreement, the HCC must include the patient’s Amendment Request Form and its denial, or an accurate summary of the PHI, with any subsequent disclosure of PHI only if the patient has requested it.
5. If the HCC receives information from another HCC of an amendment of a patient’s PHI, the PHI from that sending HCC must be amended in written or electronic form.
Review Process. The University Privacy Officer will collect information from the Unit Privacy Officers during the month of April each year beginning in 2004 for the purpose of providing feedback to the HIPAA Management Team as to compliance with the procedure and any proposed modification or recommendation that additional training be implemented.
Sanctions. Any person found to have violated the requirements of this policy shall be subject to sanctions up to and including dismissal.

HISTORY: Effective March 21, 2003