4.4.D HIPAA/Privacy: Other Requirements - Verification of Identity and Authority of Officials Requesting PHI Policy

  • POLICY:

    It is the policy of LHCC to verify the identity and the authority of a person making a request for the disclosure of PHI, if the identity or authority of such person is not known to LHCC. Further, LHCC will obtain from the person seeking disclosure of PHI such documentation, statement or representation, as may be required by the HIPAA Privacy Rule, prior to disclosure.

    PROCEDURE:

    • In general, LHCC may rely on required documentation, statements, or representations that, on their face, meet the verification requirements, if the reliance is reasonable under the circumstances.
    • For administrative requests, subpoena and investigative demand, verification is sufficient and LHCC will disclose the requested PHI if the administrative document itself or a separate written statement includes:
      • The information sought is relevant to a lawful inquiry.
      • The request is specific and limited in scope, as much as practicable, for the purposes of the inquiry.
      • De-identified information could not be used
    • If requests are made by a public official, it is sufficient verification of the identity of the requesting person to rely on any of the following, if reasonable under the circumstances:
      • A badge or other credential
      • A request on government letterhead
      • If the person making the request is acting on behalf of a public official, a written statement on government letterhead that the person is acting on behalf of a public official.  If other authority is presented, contact legal counsel for guidance before disclosure.
    • If requests are made by a public official, it is sufficient verification of the authority of the requesting person to rely on any of the following, if reasonable under the circumstances:
      • A written statement of the authority under which the information is requested, for example, a copy of the law or regulation.  Rarely, a written statement is impractical, and then an oral statement is sufficient.
      • Verification of authority is presumed if the request is made pursuant to a warrant, subpoena, order or other process issued by a grand jury, court or judge or administrative tribunal.
    • If the disclosure is sought by persons involved in the patient’s care, and it is relevant to the requesting party’s involvement in the care, LHCC may rely on reasonable professional judgement in verifying the identity and authority of the person seeking disclosure.
    • Verification requirements are met if LHCC, in good faith, makes a disclosure of PHI:
      • to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, or
      • to law enforcement authorities to identify or apprehend an individual.

    Revised 12/2013

  • Date Format: MM slash DD slash YYYY