PURPOSE:
To establish a policy and procedure for verifying the identity and authority of individuals requesting protected health information (PHI).
DEFINITION(S):
Authorization means the signed Authorization language used by DHS to obtain an individual’s permission prior to using or disclosing that individual’s PHI for purposes that do not fall within the definitions of Treatment, Payment, or Health Care Operations and other purposes that do not require the individual’s permission.
Disclose or Disclosure means, with respect to PHI, the release of, transfer of, provision of access to, or divulging in any manner of PHI outside of DHS’ internal operations or to other than its workforce members.
Personal Representative means a person who can act on behalf of an individual and exercise that individual’s rights under the HIPAA Privacy Standards. See DHS Policy No. 361.17, "Use and Disclosure of Protected Health Information (PHI) of Deceased Individuals and Minors and Making Disclosures to Personal Representatives."
Protected Health Information (PHI) means individually identifiable information relating to the past, present or future physical or mental health or condition of an individual, provision of health care to an individual, or the past, present or future payment for health care provided to an individual.
Public Official means a person exercising governmental powers in the course of performing his/her official duties. Such persons may include, for example: state and federal regulatory agency officials; judicial officials; and law enforcement officials.
Workforce or Workforce Members means employees, volunteers, trainees, and other persons whose conduct, in the performance of work for the department, its offices, programs or facilities, is under the direct control of the department, office, program or facility, regardless of whether they are paid by the entity.
POLICY:
It is the policy of DHS to verify the identity and authority of individuals requesting protected health information (PHI), as provided by this policy and procedure, if the identity or authority of that individual is not known to DHS. In addition, DHS must obtain statements or representations, whether oral or written, from the person-requesting PHI when they are required as a condition of disclosure of the PHI.
PROCEDURE:
I. Verification Requirements for Access by DHS Workforce
A. For any access to PHI, DHS:
1. Establishes a level of staff that can approve or grant access to PHI.
2. Verifies the identity of any person who is not known and determines the authority for access to PHI.
3. Obtains any required documentation, statement, or representations (oral/written) from the requestor. Any information received orally is documented for future reference.
II. Verification of Identity and Authority – Public Officials
A. Identity of Public Officials: Each DHS facility must verify the identity of public officials requesting PHI. The following are appropriate methods to verify the identity of a public official or person acting on behalf of a public official:
1. If presenting request in person: Presentation of an agency identification badge, other official credentials, or proof of government status;
2. If request is in writing: Appropriate government letterhead;
3. If the request is by a person acting on behalf of a public official: A written statement on appropriate government letterhead if the person presenting is acting under the government’s authority or some other evidence or agency documentation (e.g., contract for services, Memorandum of Understanding (MOU), Purchase Order (PO) that established that the person is acting on behalf of the public official.
B. Authority of Public Officials. The DHS facility must verify, by any of the following means, the authority of the public official or a person acting on his or her behalf.
1. A written statement of legal authority under which the PHI is requested;
2. If a written statement would be impracticable, an oral statement of such authority, unless a written statement would be required by law;
3. A request pursuant to a warrant, subpoena, order, or other legal process issued by a grand jury or a judicial or administrative tribunal.
C. Reliance on such means of verification is reasonable only if an average member of the public, placed in similar circumstances, would have no reason to question the validity or authenticity of proof regarding the authority of the person requesting PHI.
III. Verification of Identity and Authority – Other Persons in General
A. If the identity of a person requesting PHI is not known to DHS, DHS must verify the identity and/or authority of the person.
B. The verification requirement applies to any person requesting PHI if that person’s identity or authority is not known, including, for example, a person requesting his/her own PHI.
C. DHS may rely on any of the following means for verification of identity and/or authority:
1. Photo identification (e.g., driver license)
2. Certain personal information (e.g., date of birth, social security number, policy number);
3. Calling back the patient at the patient’s telephone number on file;
4. Calling back at a main organization switchboard (rather than a direct telephone number);
5. An authorization signed by the subject of PHI requested; and
6. Any other means appropriate and reasonable under the circumstances.
D. Reliance on such means of verification is reasonable only if an average member of the public, placed in similar circumstances, would have no reason to question the validity or authenticity of proof regarding the identity or authority of the person requesting PHI.
IV. Verification of Identity and Authority – Personal Representatives
A. If the authority of a person-requesting PHI as a Personal Representative is not
known to DHS, DHS must verify the authority of the person to act on behalf of the subject of PHI by
any of the following means:
1. A power of attorney signed by the subject of the PHI;
2. A court document appointing the person as a guardian; 3. Documents showing death of the subject of PHI, the person’s relationship to the subject, and the legal basis for the claim of authority (e.g., wife requesting decedent husband’s PHI as heir to his estate);
4. An adult’s knowledge of personal information about an unemancipated minor to determine the requisite relationship (e.g.,parent-child); or
5. Any other means appropriate and reasonable under the circumstance
B. Refer to DHS Policy No. 361.17, “Use and Disclosure of Protected Health Information (PHI) of Deceased Individuals and Minors and Making Disclosures to Personal Representatives” to determine whether the person qualifies as a Personal Representative.
C. Reliance on such means of verification is reasonable only if an average member of the public, placed in similar circumstances, would have no reason to question the validity or authenticity of proof regarding the identity or authority of the person requesting PHI.
V. Verification of Conditions for Disclosures
A. In addition to verification of the identity and authority of a person-requesting PHI, if a disclosure of the PHI under the HIPAA Privacy Standards is conditioned on obtaining certain statements or representations from the person requesting it, DHS must ensure that it obtains the required statements or representations before disclosing PHI.
B. If the required statements or representation were made orally, DHS must promptly document such oral statements or representations.
C. As a condition prior to disclosure of PHI, the HIPAA Privacy Standards require,
for example:
1. Business Associate Contract, for disclosing PHI to a Business Associate of another covered entity;
2. Data Use Agreement for disclosing limited data set PHI;
3. A waiver of authorization by the IRB, for disclosing PHI for research without an individual’s authorization;
4. Presentation of a court order for disclosing PHI for law enforcement purposes; and
5. Satisfactory assurances, accompanying a subpoena, that the recipient will protect PHI before disclosing PHI for judicial proceedings.
VI. Documentation and Retention
A. All documents created or obtained under this Policy shall be placed in the individual’s medical record. B. Documentation required or completed under this Policy shall be retained for at least six years after the date it was last in effect.
ATTACHMENTS/FORMS:
REFERENCE(S)/AUTHORITY:
45 Code of Federal Regulations, Part 164, Section 164.514(h), "Other Requirements Relating to Uses and Disclosures of Protected Health Information – Verification Requirements"
DHS Policy 361.17, Use and Disclosure of Protected Health Information (PHI) of Deceased Individuals and Minors and Making Disclosures to Personal Representatives
|
