Provide guidance to Advanced Radiology regarding the release of protected health information (PHI) for purposes requiring an individual’s authorization. The individual has the right to revoke the authorization at any time.

Advanced Radiology may not condition the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except under very limited circumstances,

It is the policy of Advanced Radiology to be in compliance with all federal and state regulation regarding the use and disclosure of PHI and to allow disclosure of patient PHI without a patient authorization only for the purposes of treatment, payment and healthcare operations or as otherwise allowed by the Privacy Regulations or under other state and federal law.

1. Authorization Not Required:

Authorizations are not required for the following uses and disclosures. All other uses and disclosures require an authorization, unless other state or federal law mandates the specific use or disclosure.

• To the individual or personal representative
• For treatment
• For payment
• For health care operations activities, including:
  • Fundraising (if only limited information is used/disclosed)
  • Marketing (under limited situations)
  • Summary Health Information to Plan Sponsor
  • Enrollment/Disenrollment information to Plan Sponsors
• For emergencies and disaster relief situations
• For public interest activities including:required by law;
  
  • public health
  • victims of abuse
  • health care oversight
  • judicial and administrative proceedings,
  • law enforcement,
  • about individuals who have been deceased for over 50 years
  • cadaveric organ, eye or tissue donation purposes
  • research (under certain conditions)avert serious threat to health or safety
  • specialized government functions
  • workers compensation

2. Authorization Required

Authorizations are required for the following uses and disclosures. Some use and disclosure purposes also have specific individual requirements. Authorizations are not to be used to circumvent prohibited uses and disclosures, such as for the sale of PHI.

• Use and disclosure of psychotherapy notes for any purpose
• For health care operations activities, including:
  • Fundraising (if more than limited information is used/disclosed)
  • Marketing (under most situations when direct or indirect payment is received)
  • Release to the media or public display
• For certain activities including:o about individuals who have been deceased for less than 50 years
  
  • o research (under certain conditions, particularly when individuals directly participate)
  • For any purpose not explicitly exempted from authorization.

Advanced Radiology must obtain a valid authorization for certain uses and disclosures and has adopted specific authorization forms for use when releasing or requesting PHI for purposes that require authorizations.

For disclosures made in response to a valid authorization, Advanced Radiology will disclose the information to the extent specified in the authorization. When requesting PHI that requires an authorization to use/disclose, Advanced Radiology will request the minimum amount of information needed to meet the purpose of the request.

A. Authorizations

1. Advanced Radiology may use and disclose PHI when a valid authorization is obtained.
2. For requests for authorization initiated by Advanced Radiology, all units must use Advanced Radiology standardized authorization form, Authorization for Release of Information, which can be obtained from any location. All sections must be complete. Changes or variations to the authorization forms must be approved by Advanced Radiology ‘s Privacy Officer. Treatment may not be conditioned on obtaining the authorization (unless related to approved research clinical trial).
3. If the authorization was received from the individual or third party, determine the validity of the authorization. The following elements must be present:
   • A description of the specific information to be used or disclosed.
   • Name of the specific person or entity authorized to disclose the information.
   • Name of the specific person or entity to whom Advanced Radiology may make the requested use or if disclosure and, if information is to be mailed, the address of the person or entity.
   • The date, event or condition upon which the authorization will expire.
   • The individual’s signature and date.
   • A description of the personal legal representative’s authority to sign, if applicable.
   • A description of the purpose of the disclosure. (Not required if the individual requests disclosure for own use).
   • A statement in which the individual acknowledges that he or she has the right to revoke the authorization, instructions on how to exercise such right, or to the extent the information is included in the covered entity’s notice, a reference to the notice.
   • A statement that treatment may not be conditioned on obtaining the authorization, unless it is research related and disclosure of the information is for the particular research study. If for purposes of research, where treatment may be conditioned on obtaining the authorization, a statement about the consequences of refusing to sign the authorization.
   • A statement in which the individual acknowledges that information used or disclosed to any entity other than a health plan or health care provider may no longer be protected by federal privacy law.
   • If the authorization is for marketing purposes and the marketing is expected to result in direct or indirect remuneration to Advanced Radiology from a third party, a statement of this fact.
   • If the disclosure requested involves mental health, substance abuse, HIV/AIDs, or reproductive health information, the authorization must also include (incorporate other federal and state law provisions here):
4. Defective Authorizations:
   An “authorization” is not considered valid if it has any of the following defects:
   • The expiration date has passed.
   • The form has not been filled out completely.
   • The authorization is known by Advanced Radiology to have been revoked
   • The form lacks any required element.
   • The information on the form is known by Advanced Radiology to be false.
   • Treatment was conditioned upon obtaining the authorization (except for research purposes).
5. Legal Representatives
   If the authorization is signed by a legal representative or other person authorized to act for the individual, the request must be accompanied by documentation of the representative’s legal authority to act on behalf of the individual.
6. Revocation of Authorization
   • A patient who has executed an authorization for disclosure or use of individual health information may revoke the authorization at any time by sending a written notice to Advanced Radiology as described in Advanced Radiology ‘s Notice of Privacy Practices.
   • The written notice must refer to the specific authorization being revoked (e.g., “my authorization of January 27, 2002”) and be signed and dated by the individual or his or her legal representative.
   • The revocation becomes effective upon receipt by Advanced Radiology, with the exception of uses or disclosures made by Advanced Radiology prior to receipt.
7. For Research-Related Health Information
   • The core elements of an authorization as described below may be combined with the informed consent to participate in the research.
   • An authorization for a research study may be combined with another authorization or other written permission for the same or another research study.
   • Advanced Radiology may condition the provision of research related treatment (related to the clinical trial) on obtaining authorization.
   • Advanced Radiology may use and disclose for a specific research study, PHI that is created or received before and after HIPAA’s compliance date (April 14, 2003), and/or prior to the new authorizations being implemented, as long as some other express legal permission to use and disclose the information for the research study was obtained.
   • Archived information may continue to be used and disclosed for the research study if an individual had originally signed an informed consent to participate in the research study, or IRB waived informed consent, in accordance with the Common Rule or FDA’s human subject protection regulations.
   • An accounting of all disclosures made under an authorization must be documented and maintained.

Authorization for Release to Third Party:

If Advanced Radiology receives a request from a third party for release of PHI for other than treatment, payment, healthcare operations or as otherwise authorized by law or for public interest purposes exempted from authorization, the request will be routed to Medical Records). The Medical Records Custodian will review the request and determine if a specific authorization is needed.

• The Medical Records Custodian will review the request and determine if specific authorization is required.
• If specific authorization is required, the specify position or department) will contact the patient, plan member or authorized representative in a written letter explaining the nature of the request for release and send the appropriate authorization form with the letter.
• The letter will state that if authorization is granted by an authorized personal representative, the returned authorization form needs to be accompanied by appropriate documentation validating the personal representative has the authority to represent the patient or the member.
• If authorization is granted, the Medical Records Custodian will notify the third party requesting the information that authorization has been granted and will include requested information with the letter.
• If the patient, plan member or authorized personal representative denies release, the (specify position or department) will notify the third party requesting the information that authorization has been denied by the patient, plan member or authorized personal representative. Notification will be in writing.
• All letters and signed acknowledgement forms shall become part of the patient or plan member’s permanent record.

Advanced Radiology’s Request for Third Party Release of Information:

If Advanced Radiology requires access to third party PHI for purposes other than treatment, payment, healthcare operations, as allowed by law or for public interest purposes exempted from authorization, the workforce member will first document the need and purpose for release.

• The appropriate authorization form will be mailed or transmitted to the third party specifying in as much detail as possible the PHI requested accompanied by a letter specifying the reason for the release of PHI.
• The Advanced Radiology authorized workforce member will follow up by phone with the third party if no response has been received within two weeks from the date of the request. The phone call will be documented and become a part of the patient or plan member’s permanent record.
• If the authorization is granted and the PHI forwarded to Advanced Radiology the released PHI shall only be used for the purposes documented. The authorization form received from the third party shall become part of the patient of plan member’s permanent record.
• If the authorization is denied, the request will be forwarded to (specify position or department) for review and to make a determination if Advanced Radiology intends to contact the specific patient or plan member to directly request authorization.
• If it is determined the PHI requested is critical, (specify position or department) will contact the patient or plan member in writing detailing the information requested and the reason for the release of PHI. The letter will be accompanied with the appropriate authorization form.
• If authorization is granted, (specify position or department), the third party will be contacted in writing. The letter to the third party shall be accompanied by a copy of the completed authorization request.
• If the authorization is denied, all documentation will become part of the patient or member’s permanent record and Advanced Radiology will be required to take appropriate action depending on the situation. This could include doing nothing, proceeding with the activity the information is to be released for without the requested PHI or, if the purpose of release is directly related to legal action, pursue obtaining a subpoena demanding release of specified information.

Advanced Radiology Request for Individual Authorization to Release Information:

If Advanced Radiology requires access to an individual’s PHI for purposes other than treatment, payment, healthcare operations, as allowed by law or for public interest purposes exempted from authorization, the workforce member will first document the need and purpose for release.

1. The appropriate authorization form will be mailed or transmitted to the individual specifying in as much detail as possible the PHI requested accompanied by a letter specifying the reason for the release of PHI.
2. The Advanced Radiology authorized workforce member will follow up by phone with the individual if no response has been received within two weeks from the date of the request. The phone call will be documented and become a part of the patient or plan member’s permanent record.
3. If the authorization is granted, Advanced Radiology shall only use the PHI requested for the purposes documented. The authorization form received from the individual shall become part of the patient or plan member’s permanent record.
4. If the authorization is denied, the response will be forwarded to the original requester and this response will be recorded in the patient or plan member’s permanent record. No further action to obtain or use the information will be made by Advanced Radiology

Individual Authorization to Release Information:

An individual can request Advanced Radiology to release his/her own PHI to a third party for any purpose at any time. The individual must complete an authorization for this release, and Advanced Radiology must, in almost all cases, honor the request.

1. The individual must complete the appropriate authorization form specifying in as much detail as possible the PHI requested. No reason for the release is required.
2. Any PHI release authorized by the individual must be granted. Advanced Radiology Medical Record Custodian will send the PHI directly to the third party upon individual request. A letter to the third party shall be accompanied by the PHI and a copy of the completed authorization request. The authorization and response letter will be documented and become a part of the patient or plan member’s permanent record.

Protected Health Information. The Privacy Rule protects all “individually identifiable health information” held or transmitted by a covered entity or its business
associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information “protected health information (PHI).”12 “Individually identifiable health information” is information, including demographic data, that relates to:

• the individual’s past, present or future physical or mental health or condition,
• the provision of health care to the individual, or
• the past, present, or future payment for the provision of health care to the individual,

and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual.13 Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number).

The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g.