4.1.B.2 HIPAA/Privacy: General Rules - Minimum Necessary Uses and Disclosure of PHI for Non-Routine Disclosure Policy

  • POLICY:

    When Lister Healthcare Corporation makes a non-routine disclosure of protected health information, or when it makes such a request to another provider or organization, Lister Healthcare Corporation will, on a case-by-case basis and pursuant to the criteria specified in this policy and procedure, determine the minimum amount of information that is reasonably necessary to achieve the intended purpose and make the disclosure or request in accordance with its determination.(CFR 164.514d3ii and 4iii)

    Minimum necessary requirements, including the requirements set forth in this policy and procedure, will NOT apply to:

    • disclosures to or requests by a health care provider for treatment purposes.
    • authorized or required disclosures to a patient or a patients representative.
    • uses or disclosures made pursuant to a valid authorization when the authorization is initiated by the patient or the patients representative.
    • uses or disclosures to the Secretary of DHHS for enforcing the Privacy Rule.
    • uses or disclosures required by law
    • uses or disclosures that are required for compliance with the regulations implementing the other administrative simplification provisions of HIPPA. (CFR 164.502b2)

    PROCEDURE:

    • Individual Review.
      • Lister Healthcare Corporation will, on a case by case basis and in accordance with the review criteria established in the procedure, review all non-routine disclosures or, and requests to other organizations for, protected health information to determine and limit the disclosure or request to only the minimum amount of information that is reasonably necessary to achieve the intended purpose.
    • Review Criteria
      • Lister Healthcare Corporation will, in an attachment to this policy and procedure, identify review criteria designed to limit the information disclosed or requested to the information that is reasonably necessary to accomplish the purpose of the requested disclosure or request. (CFR164.514d3ii and 4iii)
      • Lister Healthcare Corporation will develop its review criteria following Lister Healthcare Corporation's assessment of the protected health information that is reasonably necessary for particular purposes.  The criteria will take into account the characteristics of Lister Healthcare Corporation's business and workforce, and will reflect and be consistent with professional judgement and standards.
    • Reasonable Reliance Exceptions for Certain Disclosures.
      • Lister Healthcare Corporation may rely, if reasonable under the circumstances, on the amount requested as the minimum necessary when:
        • making disclosures to public officials for public health activities, to report abuse, neglect or domestic violence, for health oversight activities and as otherwise authorized or required without a patients authorization if the public official represents that the information requested is the minimum necessary for the stated purpose(s);
        • the information is requested by another health care provider, health plan, or other entity subject to the Privacy Rule's requirements;
        • the information is requested by a professional who is a workforce member or business associate of Lister Healthcare Corporation for the purpose of providing professional services to Lister Healthcare Corporation, if the professional or business associate represents that the information requested is the minimum necessary for the stated purpose(s).
      • Reasonable reliance, however, is not required and Lister Healthcare Corporation retains its discretion to question any request that it believes is not warranted or excessive, and to make its own minimum necessary determination for any disclosures that it makes.(CFR 164.514d3iii)
    • Disclosing or Requested an Entire Medical Record.
      • Lister Healthcare Corporation may not disclose or request and entire medical record, except when the entire medical record is specifically justified, as indicated in Lister Healthcare Corporation's privacy workforce directory or in a Lister Healthcare Corporation policy and procedure, as the amount that is reasonably necessary to accomplish the purpose of the requested disclosure or request. (CFR 164.514d5)

    Revised 12/2013

  • Date Format: MM slash DD slash YYYY