Page History

...

1. When requested by the Secretary of the United States Department of Health and Human Services (DHH) to investigate or determine compliance with the privacy standard;
2. When the disclosure is to the individual to whom the PHI pertains, or a legal personal representative, including requests for accounting or access to inspect or copy;
3. To carry out treatment, payment or healthcare operations (TPO);
4. Where an opportunity to agree or to object has been afforded to the individual and the individual does not object to the use and disclosure of PHI in the following circumstances:
   1. To include the individual in facility directories,
   2. To family and friends involved with the individual's care or payment related to the individual's healthcare, or
   3. To disaster relief agencies to coordinate the notification of family and friends regarding the individual's location, condition, or death;
5. Under the following circumstances when the use or disclosure meets the conditions and requirements detailed in EXHIBIT attachment B and in accordance with federal and any stricter state law:
   
   1. For public health activities as discussed under 45 CFR 164.512(b);
   2. To governmental authorities about victims of abuse, neglect and domestic violence under the conditions discussed in 45 CFR 164.512(c);
   3. To health oversight agencies for oversight activities authorized by law;
   4. For judicial and administrative proceedings under the conditions discussed in 45 CFR 164.512(e);
   5. To law enforcement officials for certain law enforcement purposes under the conditions discussed in 45 CFR 164.512(f);
   6. To coroners and medical examiners for the purpose of identifying a deceased person or cause of death, or other duties authorized by law; and to funeral directors to carry out their duties;
   7. For cadaveric organ, eye or tissue donation;
   8. For research purposes when the Institutional Review Board approved an alteration to or waiver of the individual authorization requirement in compliance with 45 CFR 164.512(i) and appropriate representations and documentation regarding the use and disclosure is obtained from the researcher in accordance with 45 CFR 164.512(i);
   9. To avert a serious threat to health or safety of a person or the public;
   10. For specialized government functions including military and veterans activities; for protective services to the President of the USA; for national security activities; and to a correctional institution or law enforcement official about a lawfully detained individual under certain conditions;
   11. To the extent that the use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law;
   12. To report health care fraud;
   13. To other health care entities for their treatment, payment and operational purposes (see EXHIBIT attachment C).
6. When the information has been de-identified and there is no actual knowledge by Rowan SOM that any of the remaining information could identify the individual. Attachment 1 contains a list of 18 pieces of information that must be removed to qualify as de-identified information.

...

1. Each unit will verify the identity and authority of persons requesting PHI. Verification procedures should be reflected in policies and procedures accordingly.
2. If the requesting person is a public official or someone acting on his or her behalf, units may rely upon the following:
   1. Agency identification badge, credentials or other proof of status;
   2. Government letterhead, if request is by letter;
   3. A written statement of the legal authority (or, if impracticable, an oral statement) under which the information is requested.
   4. If a request is made pursuant to a legal process, warrant, subpoena, order, or other legal process, it is presumed to constitute legal authority.
   5. For persons acting on behalf of the official, a written statement on government letterhead or other evidence or documentation that establishes that the person is acting under the public official's authority (such as contract for services, memo of understanding). In this event, units must contact the Office of Legal Management to inform of such request by Public Officials.
3. A unit may rely on the exercise of professional judgment as to disclosures pursuant to facility directories, to persons involved in a patient's care or payment and notification, and in relation to disaster relief as discussed in section V.F.3 and as to disclosures regarding serious threats to health and safety as discussed in EXHIBIT attachment B.

VI.   ATTACHMENTS

A. Attachment 1 - List of Identifiers and De-Identification Process

...