10.00 PUBLIC RESPONSIBILITY USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION

I. PURPOSE
To issue instructions to all ADAMH workforce members regarding uses and disclosures of protected health information (PHI) permitted or required in context of ADAMH’s public responsibilities.

II. APPLICABILITY:
This policy applies to all ADAMH workforce members.

III. AUTHORITY:
45 CFR Parts !60 & 164

IV. DEFINITIONS:

Covered Entity (CE) means a health plan, a health care clearinghouse, or a health care provider that transmits any health information in electronic form relating to any health care transaction.

Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.

Use means with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

Protected Health Information (PHI) means individually identifiable information relating to the past, present or future physical or mental health or condition of an individual, provision of health care to an individual, or the past, present or future payment for health care provided to an individual.

Health Oversight Agency means an entity acting under a grant of authority from, or a contract with a State, that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance.

Public Health Authority means a governmental agency or authority, or a person or entity acting under a grant of authority from or a contract with such a public agency, including the employees or agents of the public agency, its contractors and those to whom it has granted authority, that is responsible for public health matters as part of its official mandate.

Workforce Members means Board of Trustees members, employees, volunteers, trainees, and other persons whose conduct, in the performance of work for ADAMH, is under the direct control of ADAMH, regardless of whether they are paid by ADAMH.

V. POLICY

1. State and federal law permit and/or require certain uses and disclosures of PHI for various purposes related to public responsibility. Such uses and disclosures may be made without the agreement or authorization of the individual. The following uses and disclosures fall within this category:
   1. Health Oversight Activities: PHI may be used or disclosed for activities related to oversight of the health care system, government health benefits programs, and entities subject to government regulation, as authorized by law, including activities such as audits, civil and criminal investigations and proceedings, inspections, and licensure and certification actions. Specifically excluded from this category are investigations of an individual that are not related to receipt of health care, or the qualification for, receipt of, or claim for public benefits.
   2. Public Health Activities: PHI may be used or disclosed to:
      1. A public health authority authorized by law to collect or receive information for the purpose of preventing or controlling disease, injury or disability, reporting vital events, conducting public health surveillance, investigations or interventions;
      2. A public health or other government authority authorized by law to receive reports of child abuse or neglect;
      3. A person subject to the jurisdiction of the Food and Drug Administration (FDA) regarding his/her responsibility for quality, safety or effectiveness of an FDA regulated product or activity, to report adverse events, product defects or problems, track products, enable recalls, repairs or replacements, or conduct post-marketing surveillance;
      4. PHI of potential organ/tissue donors may be disclosed to the extent such use or disclosure complies with and is organization and tissue eye banks.
   3. Required by Law: PHI may be used or disclosed to the extent such use or disclosure complies with and is limited to the requirements of such law.
      1. Abuse and Neglect: Except for reports of child abuse or neglect, PHI about an individual believed to be a victim of abuse, neglect, or domestic violence may be disclosed to a governmental authority authorized to receive such reports if the individual agrees or the reporting entity believes, in the exercise of professional judgment, that the disclosure is necessary to prevent serious physical harm. If the individual lacks the capacity to agree, disclosure may be made if not intended for use against the individual and delaying disclosure would materially hinder law enforcement activity. The individual whose PHI has been released must be promptly informed that the report was made unless doing so would place the individual at risk of serious harm.
      2. Judicial Proceedings: PHI may be disclosed in response to a court order.
      3. Law Enforcement: PHI may be disclosed for the following law enforcement purposes and under the specified conditions:
         1. Pursuant to court order or as otherwise required by law, i.e. laws requiring the reporting of certain types of wounds or injuries; or commission of a felony [but note reporting exceptions for certain privileged communication].
         2. Decedent's PHI may be disclosed to alert law enforcement to the death if entity suspects that death resulted from criminal conduct;
         3. Limited PHI [medication history, physical health status and history, summary of course of treatment, summary of treatment needs and discharge summary] of inmates of a correctional facility may be disclosed to the facility as requested in order to provide care for the individual or ensure safety of the individual or others, but only if the individual is told of the request for records and does not object to the disclosure.
   4. Serious Threats to Health or Safety: Consistent with applicable law and ethical standards, PHI may be used or disclosed if the entity believes in good faith that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to a person or the public, and disclosure is to someone reasonably able to prevent or lessen the threat, or the disclosure is to law enforcement authorities to identify or apprehend an individual who has admitted to violent criminal activity that likely caused serious harm to the victim or who appears to have escaped from lawful custody. Disclosures of admitted participation in a violent crime are limited to the individual's statement of participation and the following PHI: name, address, date and place of birth, social security number, blood type, type of injury, date and time of treatment, date and time of death, if applicable, and a description of distinguishing physical characteristics. Disclosures of admitted participation in a violent crime are not permitted when the information is learned in the course of treatment entered into by the individual to affect his/her propensity to commit the subject crime, or through counseling, or therapy or a request to initiate the same.
   5. Decedents: PHI may be disclosed to coroners or medical examiners, as necessary for carrying out their duties, and to the designated organ procurement organization, and tissue and eye banks.
   6. Specialized Government Functions:
      1. National Security and Intelligence: PHI may be disclosed to authorized federal officials for the conduct of lawful intelligence, counter intelligence, and other activities authorized by the National Security Act.
      2. Protective services: PHI may be disclosed to authorized federal officials for the provision of protective services to the President, foreign heads of state, and others designated by law, and for the conduct of criminal investigations of threats against such persons.
      3. Public Benefits: PHI relevant to administration of a government program providing public benefits may be disclosed to another governmental program providing public benefits serving the same or similar populations as necessary to coordinate program functions or improve administration and management of program functions.
   7. Workers' Compensation: PHI may be disclosed as authorized and to the extent necessary to comply with laws relating to workers' compensation and other similar programs.
   8. Documentation: Documentation of disclosure made hereunder must be retained for a period of at least six (6) years.