|
|
HIPAA/LAW:
Special Edition
June 2003
"Use and Disclosure of PHI for Service Evaluation"
by Steve Fox & Rachel Wilson, Esqs., Pepper
Hamilton LLP
QUESTION: I am a field paramedic working for an ambulance
company that is not affiliated with any particular hospital. After
providing treatment to critical patients we often follow-up with
the hospital in order to evaluate the quality of our services. This
practice is a vital educational tool and enhances our ability to
provide more effective and efficient care. Is this use and disclosure
of protected health information ("PHI") permitted under
the HIPAA Privacy Rule (the "Privacy Rule")?
ANSWER: Generally, yes. Subject to certain limitations,
hospitals are permitted under HIPAA to disclose PHI to another covered
entity in support of the health care operations of that covered
entity. Assuming that the ambulance service is a covered health
care provider, the practice you describe is permissible under the
Privacy Rule.
Under the Privacy Rule, a covered entity may disclose PHI to another
covered entity in support of certain health care operations of the
entity receiving such PHI. These disclosures are permitted only
in those instances where each entity has (or had) a relationship
with the individual who is the subject of the PHI being requested.
In addition, the health care operations that are supported by the
disclosure must relate to: (i) quality assessment and improvement
activities; (ii) certain population-based activities including,
but not limited to, activities related to the reduction of health
care costs; (iii) the evaluation or review of the performance, competence,
or qualifications of health care professionals, (iv) training programs;
or (vii) accreditation, certification, licensing, or credentialing
activities.
It is equally important to remember that the minimum necessary
rule applies to these types of disclosures. Hospitals are permitted
to disclose only the minimum amount of PHI necessary for the ambulance
service to conduct its quality assessment and evaluation activities.
Because the ambulance service routinely makes these requests, the
hospitals served by the ambulance provider are required to implement
a standard protocol for responding to such requests in order to
insure that only the minimum amount of PHI necessary is disclosed.
The ambulance service can be of assistance in this regard by developing
a standard request form for this purpose. The form should require
specific information (e.g., diagnosis, outcome, length of stay)
and should be narrowly tailored so that the hospital is only required
to disclose that information that will assist the ambulance provider
to evaluate its quality of care.
Read past HIPAA Legal Q/A articles.
Steve Fox, Esq., is a partner at the Washington, DC office of Pepper
Hamilton LLP, www.pepperlaw.com.
This article was co-authored by Rachel H. Wilson, Esq., an associate
of Pepper Hamilton LLP. They may be reached at foxsj@pepperlaw.com.
Disclaimer: This information is general in nature and should
not be relied upon as legal advice.
|
 |
 |
