4.2.A HIPAA/Privacy: Uses and Disclosures - Uses and Disclosures of PHI/Authorization

  • POLICY:

    Lister Healthcare Corporation will obtain a valid authorization from the patient, or the patient's legal guardian or other authorized representative, prior to the release of protected health information for purposes other than treatment, payment and health care operations, unless an exception as described in this policy and procedure applies. (164.508a1)

    Lister Healthcare Corporation will fulfill requests for information pursuant to a valid authorization in a timely manner, but in any event not later than 30 days after receipt of a valid authorization. (164.524b2)

    RESPONSIBILITY:

    It will be the responsibility of designated employees of Lister Healthcare Corporation's to obtain a signed authorization from the patient, or the patient's legal guardian or other authorized representative, when a request for the release of protected health information is made.

    PROCEDURE:

    • Obtaining a Patient's Signed  Authorization. Lister Healthcare Corporation will obtain a valid authorization from the patient, or the patient's legal guardian or other authorized representative, prior to the release of protected health information for purposes other than treatment, payment and health care operations, unless an exception as described in this policy and procedure applies. (164.508a1) Such authorizations will include requests for releases initiated by:
      • a patient for the use and disclosure of protected health information by the patient or other third party.
      • Lister Healthcare Corporation for its own use and disclosure of the protected health information that it maintains.
      • Lister Healthcare Corporation for the use and disclosure of protected health information maintained by a third party.
        • All requests initiated by patients will be processed in accordance with Lister Healthcare Corporation's policy and procedure on patient access to protected health information.
    • Uses and Disclosures Pursuant to Authorization.  When Lister Healthcare Corporation receives a valid authorization for the use or disclosure of protected health information, its use or disclosure will be consistent with the authorization. (164.508a1)
    • Exceptions for Uses and Disclosures Required or Authorized by Law.  A valid authorization is NOT required if the releases is authorized or required by law as described in Lister Healthcare Corporation's policies and procedures governing the following types of releases:
      • releases according to a patient's oral permission.
      • releases required or authorized by law.
    • Psychotherapy Notes.  Lister Healthcare Corporation will obtain a valid authorization for the release of psychotherapy notes unless use and disclosure of the notes is for any one of the following types of treatment or health care operations:
      • for treatment purposes by the health care professional who created the notes
      • for uses and disclosures by Lister Healthcare Corporation for its own training programs in which students, trainees or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling.
      • for uses or disclosures by Lister Healthcare Corporation to defend a legal action or other proceeding brought by the patient.
      • for uses and disclosures required by law or otherwise permitted without the patient's consent or authorization as described in Lister Healthcare Corporation's policy and procedures on releases required or authorized by law. (164.508a2)
        • The requirements applicable to psychotherapy notes will not apply to medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. (164.501 and 164.508a2)
    • Marketing. Lister Healthcare Corporation will obtain a valid authorization for any use or disclosure of protected health information for marketing purposes, unless one of the following exceptions applies:
      • a member of Lister Healthcare Corporation's workforce engages in a face-to-face communication with a patient.
      • a promotional gift of nominal value is provided by Lister Healthcare Corporation.
        • If the marketing involves direct or indirect remuneration to Lister Healthcare Corporation from a third party, the authorization shall state that such remuneration is involved. (164.508a3)
    • Contents of a Valid Authorization.  Lister Healthcare Corporation may use its own authorization form or can accept a written authorization supplied by the patient as long as the authorization meets the requirements of this procedure.  A valid authorization will be written in plain language and must include:
      • a description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.
      • the name, address, phone and fax numbers or other specific identification of the person(s) or class of persons authorized to make the requested use or disclosure.
      • the name, address, phone and fax numbers or other specific identification of the person(s) or class of persons or to whom Lister Healthcare Corporation may release information.
      • a description of each purpose of the requested use or disclosure.  If the patient is requesting access and does not wish to disclose this information, the statement "at the request of the patient" is sufficient.
      • an expiration date or event that relates to the patient or the purpose of the use or disclosure. If no expiration date is specified, calculate 30 days from the date of the request and enter this date on the authorization.
      • the signature of the patient and date of signature.  If the authorization is signed by a representative of the patient, a description of the person's authority to act for the patient.
      • a statement of the patient's right to revoke the authorization in writing and either a statement of the exceptions to the right to revoke and how the patient may revoke an authorization or, if this information is included in Lister Healthcare Corporation's Notice of Privacy Practices, a reference to the Notice.
      • a statement that Lister Healthcare Corporation may not condition the provision of treatment on the patient's provision of a signed authorization.
      • a statement that the information may be subject to redisclosure by the recipient and may no longer be protected by Lister Healthcare Corporation's privacy practices or applicable privacy law.
      • if the authorization is for marketing purposes and involves direct or indirect remuneration to Lister Healthcare Corporation, a statement that such remuneration is involved.
        • The authorization may include additional elements and information, provided that these elements are not inconsistent with the elements required by this procedure. (164.508a3ii,b1 and c1-3)
    • Copy to Patient.  If Lister Healthcare Corporation seeks an authorization from a patient for a use or disclosure of protected health information, Lister Healthcare Corporation will provide the patient with a copy of the patient's signed authorization. (164.508c4)
    • Attorney Requests.  If the request is from an attorney, it will be honored only upon receipt of a valid authorization signed by the patient (or the patient's legal guardian or other representative), or a court order directing Lister Healthcare Corporation to release the information to the named attorney.  If the request is from an attorney or marked for legal purposes, Lister Healthcare Corporation will follow its policy and procedure for handling such requests or, in the absence of any such policy, notify the Privacy Officer.
    • Defective Authorizations.  Lister Healthcare Corporation will NOT honor an invalid authorization.  An authorization is NOT valid if if contains ANY of the following defects:
      • the expiration date has passed or the expiration event is known to have occurred.
      • the authorization has not been filled out completely with respect to an element required by this procedure.
      • the authorization is known to have been revoked by the patient.
      • the authorization violates this policy and procedure's prohibition on the conditioning of authorizations.
      • the authorization violates this policy and procedure's restriction on compound authorizations.
      • any material information in the authorization is known to be false. (164.508b2)
    • Compound Authorizations. An authorization described in this policy and procedure may be combined with any other such authorization, except that an authorization for use or disclosure of psychotherapy notes may only be combined with another authorization for use or disclosure of psychotherapy notes. (164.508b3)
    • Prohibition on Conditioning of Authorizations.  Lister Healthcare Corporation will not condition the provision of treatment to a patient on the patient's provision of a signed authorization. (164.508b4)
    • Revocation.  A patient may revoke an authorization at any time, except to the extent that Lister Healthcare Corporation has taken action in reliance on the authorization.  All revocations must be in writing. (164.508b5)
    • Effect of Previously Obtained Authorizations. Lister Healthcare Corporation may use or disclose protected health information that it created or received prior to this policy and procedure's implementation date pursuant to an authorization or other express legal permission obtained from a patient prior to this policy and procedure's implementation date, provided that the authorization or other express legal permission specifically permits such use or disclosure and there is no agreed to restriction, as authorized by Lister Healthcare Corporation's policy and procedure on a patient's right to restrict the use and disclosure of protecting health information. (164.532b)
    • Documentation.  Lister Healthcare Corporation will retain signed authorizations for at least six years or such other period required by Lister Healthcare Corporation's privacy documentation policy and procedure or the Privacy Rule.  (164.508b6)
  • Date Format: MM slash DD slash YYYY