Patient Confidentiality

Identify what is and is not PHI

• Information covered under HIPAA, includes all forms of information that

  • Relates to past, present, or future physical or mental health; provision of care or payment of care AND

  • ID the patient or could reasonably be expected to ID the patient

• Only applies to human health info - NOT vet info

What MUST we provide to each pt as the “Notice of Privacy Practice?”

1. How pharmacy intends to use and disclose information

2. Pharmacies obligation to notify the patient of a breach of unsecured PHI

3. Statement that the individual can restrict certain disclosures of PHI to an eHealth plan when the individual pays for the treatment out of pocket FULLY

4. Descriptions of the legal duties of the pharmacy to protect PHI

5. Statement regarding use and disclosure that require authorization

6. Statement of the patient rights a brief explanation of how the patient may exercise those rights

7. Statement that patients may complain to the pharmacy or DHHS and that explains the method for filing a complaint

8. Person in the company whom a patient may contact regarding privacy concerns, including person name or title and phone #

What does TPO stand for in disclosing PHI

1. Treatment

2. Payment

3. Operations 

When may PHI be fully disclosed?

• Complete or full disclosure of PHI is allowed when

  • Communicating to the patient or their agent

  • Communication with other providers regarding the txt of the patient

  • Authorized by the patient

  • Required by DHHS for compliance/enforcement

  • Required by law

When may PHI be only the minimum disclose?

• In all other situations, a pharmacy may disclose only the minimum amt of PHI necessary to accomplish the objective

When may PHI be not disclosed without authorization (including unique protections for psychotherapy notes and SUD records)

• Protects records of any program or act relating to substance use disorders

• Patient MUST provide consent at least once for all future uses and disclosures for TPO

• Psychotherapy notes

  • Notes mental health professionals document or analyze the contents of conversations during a private session is reparate front he rest of the patient's medical records

  • Special protection under HIPAA

    • Covered entities MUST obtain the patient's authorization prior to disclosure of these notes for any reasons

  • Exception

    • Disclosures required by the law

Exceptions to PHI breach?

• Unintentional and in good faith does not result in further use or disclosure

• When the unauthorized person (who received the PHI) would not reasonable have been able to retain it

• Inadvertent disclosure between the two authorized individuals at the same facility if the info is not further used or disclosed

If a PHI breach has occurred, what responsibility those the pharamcy have?

• If PHI breach has occurred, the pharmacy MUST notify the affected individuals by first-class mail (or electronically, if agreed to) within 60 days after the breach was discovered

• The pharmacy MAY have to notify DHA (and the media) for sufficiently large breaches!

Identify what is and is not a patient health care record in Wisconsin

1. Name of the patient whose record is being disclosed

2. Type of info being disclosed

3. Type of healthcare providers making the disclosure

4. Purpose of the disclosure: app for insurance, further medical care, etc

5. Individual, agency, or org to which disclosure may be made

6. Signature of the patient or person authorized by the patient (+ the relation to the patient)

7. Date on which the consent is signed

8. Period during which the consent is effective

Explain how patients and health care providers may access patient care records in Wisconsin

1. Records can be release to designated person or others with informed consent of the patient or of a person authorized by the patient

2. If the health records don’t contain info and the circumstances of the release don’t provide info that would permit the ID of the patient

3. MA, PA, APNP who believes the patient’s physical or mental condition may affect the patient’s ability to exercise reasonable and ordinary control over a motor vehicle may report the patient’s name and other relevant info

4. Optometrists may do the same as above

5. Can be provided upon request and with a statement of informed consent (unless not required)

List the prohibitions concerning patient health records in Wisconsin.

• Intentionally falsify patients records

• Conceal or withhold patient record with intent to prevent or obstruct an investigation

• Intentionally destroy or damage records in order to prevent or obstruct an investigation or prosecution