PROTECTED HEALTH INFORMATION

The heart of the privacy regulations addresses the protection of individually identified health information. This is defined as “Protected Health Information” or “PHI”. PHI includes information that is a subset of health information, including demographic information collected from an individual, and:

  •  is created or received by a health care provider and
  • relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
  •  that identifies the individual .

All the information that health care providers currently collect that is individually identifiable related to a consumer/client is considered PHI including payment information.

Use and Disclosure of Protected Health Information

In order to effectively provide you care, there are times when we may need to share your confidential information with others both within and outside our agency. This includes releasing information for the purposes of:

  • Treatment: We may use your protected health information that we create or receive about you to provide you with care and services. We may disclose information about you to our staff who provide your care. We may share information about you with different programs within our facility in order to facilitate care. In certain instances we may share information about you with another facility. We may disclose your confidential information without your consent to the Illinois Department of Human Services for the purpose of admission, treatment, planning and discharge to and from State operated facilities. In order to release your information to any other person or agency for the purpose of admission, treatment, planning and discharge we must obtain your written permission
  • Payment includes coordination of health care benefits. Information will be sent to the appropriate companies or organizations in order to obtain payment for treatment and services provided. Such information will only be sent with your written consent.
  • Health Care Operations includes scheduling office visits, surgeries, or preadmission activities. We may use information about you, without your written consent, in order to coordinate our business activities. This may include setting up your appointments, reviewing your care, verifying your payment information, training staff, quality assurance activities, peer review, licensure and accreditation. Note under Illinois law, a consumer’s written consent to share information with a third party payor or other health care providers is required.

Information Disclosed Without Your Consent

Under Illinois and Federal law, information about you may be disclosed without your consent in the following circumstances:

  • Emergencies: Sufficient information may be shared to address the immediate emergency you are facing.
  • Follow Up Appointments / Care: We may contact you to remind you of future appointments or to provide information about treatment alternatives or other health related benefits and services that may be of interest to you. We may leave appointment information on your answering machine unless you tell us not to.
  • As Required By Law: This would include situations where we have a subpoena, court order, or are mandated by law to provide public health information such as concerning communicable diseases or suspected abuse and neglect such as child abuse, elder abuse, or institutional abuse. The information released must be relevant to the investigation.
  • Coroners: We are required to disclose information about the circumstances of a client’s death to a coroner who is investigating.
  • Governmental Requirements: We may disclose information to a health oversight agency for activities authorized by law such as audits, investigations, inspections, and licensure. We are also required to share information, if requested, with the U.S. Department of Health and Human Services to determine our compliance with federal laws related to health care and with Illinois state agencies that fund our services.
  • Criminal Activity or Danger to Others: If a crime is committed on our premises or against our personnel, we may share information with law enforcement to apprehend the criminal. We also have the right to involve law enforcement when we believe an immediate danger to someone might exist.
  • Release to the individual.
  • Incident to a use or disclosure as permitted under the HIPAA regulations.
  • To a Business Associate to carry out specific purposes.
  • For health oversight activities required by law, including audits, civil, administrative, or criminal investigation, inspections, licensure or disciplinary actions, civil, administrative, or criminal proceedings or actions.

Except for these instances when we can release information without your consent, we will not release confidential information about you without your written permission.

Authorization is Required for:

  • Targeted marketing, that is not related to specific medical needs of the consumer.
  • Fundraising. The materials must include a notice describing how the consumer can opt out of future solicitations.
  • To assess eligibility for certain public benefits or commercial products.
  • Patient’s next of kin or friend. Under Illinois law, except when the Surrogate Act applies, consent should be obtained from the consumer before speaking with others about the medical care of the consumer.
  • To a non-health related division of a Covered Entity. (e.g. if a hospital operates a health club, you would need consumer consent before the health club could contact the consumer).
  • To the Patient’s employer or others who the consumer wishes to have the information, including his/her attorney.

 Minimum Necessary. When using or disclosing PHI or requesting PHI from another covered entity, Elm City Center will make reasonable efforts to limit the PHI to the minimum necessary to accomplish the intended purpose of the disclosure or request. The minimum necessary standard does not apply to:

  • Disclosures to or requests by a health care provider for treatment.
  • Disclosures to the individual or those made with a written authorization from the consumer.
  • Disclosures to the Secretary of Health and Human Services.
  • Disclosures required by law.

When a request is made on a routine and recurring basis, Elm City Center will implement policies and procedures (which may be standard protocols) that limit the PHI requested to the amount reasonably necessary to accomplish the purpose for which the request is made. For all other requests Elm City Center will develop criteria designed to limit the request for PHI to the information reasonably necessary to accomplish the purpose of the request and review requests for disclosure on an individual basis in accordance with such criteria. Elm City Center cannot use, disclose, or request an entire medical record, except when the entire medical record is specifically justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure, or request.

The  “minimum necessary” standard will be consistent with, and not override, professional judgment.

  • Minors – Illinois law applies since it is more restrictive than HIPAA. It requires that a parent or guardian consent to release of records of the unemancipated minor. For mental health, substance abuse treatment, access to contraceptive information, and VD counseling, a minor 12 or older has a right to obtain information without parental consent or knowledge.
  • Guardians – All legal guardian relationships will be honored. Individuals claiming to be a person’s guardian my be asked to provide legal documents defining the relationship if these documents are not known by Elm City Center.
  • Abuse. Elm City may disclose PHI about an individual whom Elm City reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority. Under Illinois law, health care providers are mandated reporters in case of suspected child abuse and neglect, elder abuse, and abuse of institutional residents. Elm City may elect not to provide information to a personal representative of an individual if Elm City believes that the individual has been or may be subjected to domestic violence, abuse, or neglect by the personal representative, or treating such person as the personal representative could endanger the individual.
  • Crime. Elm City may disclose to a law enforcement official PHI that Elm City believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the Elm City. The information to be provided must be limited to name, address, date of birth, social security number, type of injury, blood type, date and time of treatment and a description of any physical characteristics to identify the person.
  • Psychotherapy Notes. Although psychotherapy notes are defined, and there are various restrictions on their release under HIPAA, these are not as restrictive as under the Illinois Mental Health and Developmental Disabilities Confidentiality Act, and therefore, Illinois law will apply.
  • Duty to Warn. HIPAA permits Elm City Center to use or disclose PHI, if the Provider in good faith believes the use or disclosure:
  1. Is necessary to prevent or lessen a serious and imminent threat of harm to the health or safety of a person or the public; and
  2. Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or
  3. is necessary for law enforcement authorities to identify or apprehend an individual
  4. because of a statement by an individual admitting participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to the victim; or
  5. where it appears from all the circumstances that the individual has escaped from a correction institution or from lawful custody. Such a disclosure cannot be made, if the information was learned during counseling or therapy or when the consumer is seeking a referral for counseling or therapy. Although Illinois has a duty to warn provision in the Mental Health and Developmental Disabilities Confidentiality Act-this is broader, in that it can be viewed as applying to any health care provider
  • Workers compensation. Elm City may disclose PHI as authorized by and to the extent necessary to comply with laws relating to workers compensation. A subpoena from the Illinois Industrial Commission is sufficient to release client/consumer information.