Statement of Policy
Washington University and its member organizations (collectively, “Washington University” or “WU”) are committed to conducting business in compliance with all applicable laws, regulations and WU policies. As part of this commitment, WU has adopted a policy to define the Uses or Disclosures of Protected Health Information (“PHI”) that are permitted or required under HIPAA without obtaining an Individual’s verbal agreement or written Authorization.
Scope of Policy
The scope of this Policy includes all Uses and Disclosures of PHI that may be permitted without an Individual’s verbal agreement or written Authorization.
1) WU is required to Disclose PHI without an Individual’s Verbal Agreement or Written Authorization for the following reasons:
a) Required Disclosures of PHI
i) Individual’s Request – WU must Disclose an Individual’s PHI to that Individual if he or she requests his or her own PHI (See WU HIPAA Policy on Access by Individuals to Protected Health Information).
ii) Department of Health and Human Services – WU must Disclose PHI to the Department of Health and Human Services if that agency requests PHI for compliance or enforcement purposes.
iii) Disclosures Required by Law – WU must Disclose PHI pursuant to certain federal or state laws. Required by law is defined as a mandate contained in law that compels a Covered Entity to make a Use or Disclosure of PHI and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to Health Care Providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if Payment is sought under a government program providing public benefits. For example, if an Individual is a victim of abuse, neglect or domestic violence.
2) WU is permitted to Use or Disclose PHI without an Individual’s Verbal Agreement or Written Authorization for the following reasons:
a) Permitted Disclosures of PHI
i) To a Public Health Authority:
1. authorized by law to collect or receive information for the purpose of preventing/controlling disease or injury or disability, including, but not limited to, reporting disease, injury, or vital events (birth and death), and to conduct public health surveillance or investigations or interventions or to a foreign health agency acting in collaboration with a Public Health Authority;
2. in charge of investigating child abuse or neglect and WU is authorized by law to notify the Public Health Authority;
3. if a person has been exposed to a communicable disease or is at risk of spreading a communicable disease and WU is authorized by law to notify the Public Health Authority;
4. for work-related injuries, PHI may be disclosed to an employer about an Individual who is a member of the Workforce of the employer and Health Care is provided to the Individual at the request of the employer to conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether the Individual has a work-related illness or injury and the PHI Disclosed consists of findings concerning a work-related illness or injury or Workplace-related medical surveillance and the employer requires such findings to comply with its obligations under federal and state law, and the Individual receives written notice of the PHI Disclosure to the employer; or
5. to another governmental agency if that governmental agency is acting at the direction or request of a Public Health Authority;
6. to a person subject to the jurisdiction of the FDA to report adverse events, product defects or problems, or biological product deviations and to track products, if the Disclosure is to the person required or directed to report such information to the FDA, to enable product recalls, repairs, or replacement or to conduct post-marketing surveillance to comply with requirements or at the direction of the FDA.
ii) Victims of Abuse, Neglect or Domestic Violence
To any governmental authority (e.g., adult protective or social service agencies, state survey and certification agencies, or the Division of Aging) authorized to receive reports of abuse, neglect, or domestic violence, other than child abuse or neglect which falls under 2, (a), (2) above, but only if
1. the Disclosure is required by law and the Disclosure complies
with and is limited to that required to be Disclosed; or
2. the Individual agrees to the Disclosure; or
3. WU is expressly authorized by statute or regulation to Disclose the PHI and WU believes that the Disclosure is necessary to prevent serious harm to the Individual or other persons; or the Individual is incapacitated and a Law Enforcement Official has informed WU that an immediate enforcement activity depends upon the Disclosure and that waiting for the Individual to regain capacity would materially and adversely affect the enforcement activity and that the Disclosure is not intended to be used against the Individual.
iii) Health Oversight Activities
To Health Oversight Agencies for health oversight activities that are authorized by law. Such activities include, but are not limited to, audits, civil, administrative or criminal investigations, inspections, licensure or disciplinary actions, civil, administrative or criminal proceedings or actions, or other activities necessary for appropriate oversight of the health care system, government benefit programs for which PHI is relevant, entities subject to government regulatory programs or entities subject to civil rights laws. Requested Disclosures are not considered Health Oversight Activities if:
1. the Individual is the subject of the investigation or activity; and
2. the investigation or activity does not arise out of, and is not directly related to (i) the receipt of Treatment, (ii) a claim for public benefits related to Health Care, or (iii) qualification for, or receipt of, public benefits or services in which the Individual’s health is integral to the claim for public services or benefits.
iv) Judicial or Administrative Proceedings
1. In the course of an administrative or judicial proceeding if the request is made through or pursuant to a court order or administrative tribunal or is in response to a subpoena issued by a court (not a party) or discovery request (if WU is a party);
2. Absent a court order or a subpoena issued by a court or administrative tribunal, WU may disclose PHI in response to a subpoena or discovery request only if WU does one of the following:
a. obtains satisfactory assurances, consisting of a written notice to the Individual’s last known address containing sufficient information concerning the situation and letting them know that the period of time for objection by the Individual has lapsed without the Individual objecting or with the Individual’s objections resolved, and that reasonable efforts have been made to give the Individual whose PHI has been requested notice of the request; or
b. obtains satisfactory assurances, including a statement and documentation that the parties have agreed to a “qualified protective order” or that the party seeking the PHI has requested such a protective order from a court, and that the party seeking the PHI has made reasonable efforts to secure a qualified protective order that will guard confidentiality of the PHI and requiring the return of the PHI to WU or the destruction of the PHI; and
WU may only Disclose PHI to the extent that it is within the scope of the permitted Disclosure (i.e., WU may only Disclose the amount of PHI authorized by a court order or requested in a subpoena).
v) Law Enforcement Purposes
If state law requires WU to report certain statistics (i.e. gunshot wounds) to Law Enforcement Officials or Disclosures made pursuant to
1. a court order or court-ordered warrant;
2. a subpoena or summons issued by a judicial officer;
3. a state or federal grand jury subpoena;
4. administrative requests including subpoenas or summons;
5. civil or authorized investigative demands; or
6. other similar processes allowed by law,
All such requests for Disclosures of PHI for law enforcement purposes must satisfy the following requirements:
1. specific and limited in scope to the extent reasonably practical in light of the purpose for which the PHI is sought;
2. relevant and material to a legitimate law enforcement inquiry; and
3. incapable of using “de-identified” PHI to satisfy the purpose of the requested Disclosure.
In certain instances, WU may disclose “limited identifying information” in response to a request by a Law Enforcement Official that does not meet the above listed requirements for the purposes of identifying or locating suspects, fugitives, material witnesses, missing persons, etc., when Law Enforcement Officials are seeking to identify and/or locate a person. Please note that WU is prohibited from initiating the Disclosure.
“Limited identifying information” includes name, address, social security number, date and place of birth, type of injury, ABO blood type, Rh factor, date and time of death, date and time of treatment, and distinguishing physical characteristics of the person. Specifically excluded from the list of “limited identifying information” are DNA records, dental records or typing, samples or analysis and bodily fluids or tissue, other than blood.
vi) Crime Victims
To a Law Enforcement Official, if the Individual agrees to the Disclosure, or if the Individual is unable to agree verbally due to incapacity or an emergency situation, WU may Disclose PHI if:
1. a Law Enforcement Official represents that PHI is needed to determine whether a violation of law by a person other than the victim has occurred and the PHI will not be used against the victim;
2. a Law Enforcement Official represents that an immediate law enforcement activity will be materially and adversely affected by waiting for the Individual’s verbal agreement; and
3. a WU employee in his or her professional judgment believes that it would be in the Individual’s best interest to make the Disclosure.
WU may inform Law Enforcement Officials of an Individual’s death if they have a suspicion that such death may have resulted from criminal conduct. WU may also Disclose PHI to Law Enforcement Officials if they believe in good faith that it constitutes evidence of a crime committed on WU’s premises.
vii) Coroners, Medical Examiners and Funeral Directors
To coroners, medical examiners, for the purpose of identifying the deceased or determining a cause of death, and to funeral directors to the extent necessary to carry out their duties with respect to the decedent prior to and/or in reasonable anticipation and to the extent otherwise allowed under state law.
viii) Organ Procurement/Donation
To procurement organizations or other entities engaged in the procurement, banking or transplantation of cadaveric organs, eyes or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.
ix) Aversion of Serious Threats to the Health or Safety of a Person or the Public
Consistent with applicable law and standards of ethical conduct, to persons reasonably able to prevent or lessen the threat, including the target, of a serious and imminent threat to the health or safety of a person or the public, or to law enforcement authorities to identify or apprehend an Individual because of a statement by an Individual admitting participation in a violent crime that WU employees reasonably believe may have caused serious physical harm to the victim or where it appears from all the circumstances that the Individual has escaped from a Correctional Institution or from lawful custody. PHI Used or Disclosed must be specific and limited and based on a good faith belief that Disclosure is necessary to avert or lessen the threat. PHI may not be Disclosed if learned by the Covered Entity in the course of Treatment to affect the propensity to commit the criminal conduct that is the basis for the Disclosure or counseling or therapy or through a request by the Individual to initiate or be referred for the Treatment, counseling or therapy.
x) Military Personnel
For activities deemed necessary by appropriate military command authorities to ensure proper execution of military missions, eligibility for or entitlement to benefits and medical suitability determinations. WU and its employees may Disclose PHI to authorized federal officials for lawful intelligence, counterintelligence and other national security matters.
To Correctional Institution or Law Enforcement Officials with lawful custody (i.e., not just detained) of PHI of an Individual incarcerated in a prison, jail, reformatory, work farm, detention center or halfway house (each one is considered a “Correctional Institution”) that is part of a criminal justice system. The Correctional Institution or Law Enforcement Official must represent to WU that Disclosure of such Individual’s PHI is necessary for:
1. the provision of Health Care to such Individual;
2. the health and safety of such Individual or other inmates;
3. the health and safety of the officers of, employees of or others at the correctional institution;
4. the health and safety of such Individuals and officers or other persons responsible for the transporting of the inmates or their transfer from one institution to another;
5. the law enforcement on the premises of the correctional institution; and
6. the administration and maintenance of the safety, security and good order of the Correctional Institution.
xii) Workers’ Compensation
WU may Disclose PHI to:
1. a person or entity responsible for the Payment of benefits on behalf of an Individual for a claim covered by the state’s workers’ compensation law, or
2. the state’s workers’ compensation agency responsible for administering claims.
The amount of PHI Disclosed must satisfy the “Minimum Necessary” requirement (see WU HIPAA Policy on Minimum Necessary Request, Use or Disclosure of Protected Health Information).
xiii) Disclosures by Whistleblowers
A member of WU’s Workforce or a Business Associate may Disclose PHI in good faith to (i) a Health Oversight Agency or Public Health Authority that is authorized by law to investigate or oversee the conduct of WU; (ii) an appropriate health care accreditation organization; or (iii) an attorney for the purposes of determining the Disclosing whistleblower’s options. This rule only applies to whistleblower actions against WU, not actions to expose alleged illegal or wrongful conduct of another person.
3) Procedure for Uses or Disclosures of PHI without an Individual’s Verbal Agreement or Written Authorization
i) Prior to Disclosing PHI pursuant to this Policy, WU must reasonably verify the identity of the person requesting the PHI and the authority of that person to have access to PHI if the person requesting the PHI is unknown to WU.
ii) If the Disclosure is conditioned upon obtaining documentation, statements or representation from the person requesting the PHI (for example, Sections 2,(a),(ii),(3) and 2,(a),(vi),(2) require such additional information), then WU must obtain such additional documentation, statements or representation.
iii) If a public official is requesting Disclosure of PHI, the identity of that person may be verified by submitting a written statement on agency letterhead, an identification badge or similar proof of official status to WU. The authority of a public official requesting PHI may be verified by a written statement (or an oral statement if a written statement would be impracticable) of the legal authority (i.e., statute or regulation) under which the PHI is requested.
iv) Requests made pursuant to legal process, warrant, subpoena, order, or other legal process issued by a grand jury or a judicial or administrative tribunal usually constitutes legal authority. Note that these requests must be made pursuant to a grand jury request or a request made by a judicial or administrative tribunal. Call WU Risk Management/Office of the General Counsel for assistance in responding to subpoenas.
v) In emergency situations, WU must exercise professional judgment in the best interest of the Individual in deciding whether to Disclose PHI.
Creation Date: December 3, 2002
Effective Date: April 14, 2003
Last Revision: January 9, 2003; January 11, 2010, September 5, 2014