Question

Section 164.510(b) of the Privacy Rule describes three ways that a provider can determine whether the patient agrees or objects to a disclosure, including:

1. Obtaining the individual's agreement to the disclosure;

2. Providing the individual with a specific opportunity to object to the disclosure, and the individual does not express an objection to the disclosure; and

3. Reasonably inferring from the circumstances, based on the exercise of professional judgment, that the individual does not object to the disclosure.

Part 1: Assume you are a hospital compliance officer and have been tasked with creating privacy and security policies and procedures for your organization. In crafting your policies and procedures, how would you structure your institution's approach and why? Many disclosures of PHI are permitted based on the relationship of the person seeking information to the patient. What techniques should your hospital adopt through its policies for verifying the identity of an individual to whom information about the patient could be disclosed or to verify the individual's relationship to the patient? Would you adopt a single approach or would your policy vary, for instance, based on the circumstances? Please write up a brief response (2-3 pages max., double-spaced) addressing these questions. Note that you do not have to create actual policies and procedures in crafting your response to these questions.

Part 2: How would your policy apply in each of the cases below (e.g., are there certain people or categories of individuals with whom information regarding the condition and treatment of the patient would always, sometimes, or never be shared)? Please give support for your conclusions. A. A school bus has overturned and 30 elementary school children are rushed to your hospital. Some are in serious condition; some are dead when they arrive at the hospital and some have merely cuts and bruises and will be released shortly. As the person the hospital has designated the contact person regarding patients involved in this terrible accident, from whom would you likely receive requests for information about these children and their condition? To whom would you disclose PHI and two whom would you not disclose PHI? Why? B. An elderly widow who lives alone is brought to the ER by a neighbor who found the woman partially conscious in the hallway of her apartment building. The neighbor tells the ER intake clerk that the patient lives alone, but has a daughter who lives 200 miles away and a grandson who lives in the same town but has not seen his grandmother in 10 years. Who could the hospital notify? Is there anyone else to whom information about the patient's condition could be disclosed? What, if anything, could the hospital tell the neighbor who brought the woman in about the patient's condition? C. A 12-year old girl is brought to the ER by a schoolmate and the schoolmate's mother. The girl claims that she has been attacked and raped. Her parents are divorced, and her mother, who is at work, has sole custody of the child, although her father lives nearby in the same town. Who could the hospital notify? To whom could information about the patient be disclosed, if asked? What, if anything, could the hospital tell the people who brought the girl to the ER about the patient's condition? D. A famous singer falls off her horse in a nasty riding accident and is rushed to the hospital. She signs in under an assumed name. What PHI could be disclosed about the singer and her medical condition, and to whom could it be disclosed? E. The Vice President of the United States, who has a history of heart disease, is rushed to the ER for treatment. Naturally, many inquiries are made about his condition. What PHI, if any, could be disclosed and to whom?

Answer 1

Part 1:
The hospital compliance officer should keep in the mind for some elements for an effective compliance program. The policy and procedure should reach all employees, volunteers, hospital management. Focus on the mission, and value statement and core values, laws and regulations. It should be a forward-thinking manner and proactive and focus on how changes are implemented and culture-based. Policies and procedures should be revisited and should be up to date the latest regulations. provide individual responsibility as a group and share the needs. Explain the communication and work with overall goals. Provide training and education with step by step documentation. Remember access, education, and enforcement. employees should find the policy easily and acknowledgment and testing capacities. communicating issues and should be accessed in detail. There should be regular auditing with effectiveness.
There should be regular corrective action plans compliance program should include the policy and procedure education and how to address the violations for the disciplinary action to prevent the issues. these policies and procedures should be organized and compliance needs to be managed as a whole compliance program. PHI used and disclosed by authorization. It provides coordinate, manages medical treatment and services. HIPAA regulations protect health information, covered entities may disclose PHI to anyone that maybe family members or someone responsible for patients. Health and human services have some regulations on the electronic transmission of health information. privacy rule protect protected health information(PHI) created by covered entities. privacy rule permits PHI with certain individual authorization. it can be with adequate safeguards by laws. it can be a vary based on the circumstances like for public health purpose for auditing, civil, law enforcement officials with a court order or for research, etc..