1. HIPAA TRIVIA QUEST December Edition

2. I’ll ask the questions - and you’ll give the answers.

3. HERE WE GO

4. Question 1 Does the HIPAA Privacy Rule require covered entities to keep patients’ medical records for any period of time?

5. The HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained. However, the HIPAA Privacy Rule does require that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records and other protected health information (PHI) for whatever period such information is maintained by a covered entity, including through disposal. New Mexico law requires that medical records be retained for at least 10 years.

6. Question 2 Is a health care provider permitted to disclose proof of a child’s immunizations directly to a school without a HIPAA authorization?

7. Provided the school is required by law to have proof of immunizations in order to admit the child, and a parent, guardian, or other person acting in loco parentis has agreed to the disclosure. Where the individual who is a student or prospective student is an adult or emancipated minor, the provider may make the disclosure with the agreement of the student herself. In either case, the agreement may be obtained orally or in writing, but must be documented by placing in the medical record a copy of a written request, or notation of an oral request, from a parent for the provider to disclose the proof of immunization to the school.

8. The Privacy Rule does not prescribe the nature and form of the documentation, allowing covered entities the flexibility to determine what is appropriate for their purposes and to address the varied circumstances in which parental agreement may be obtained. The documentation must only make clear that agreement was obtained. For example, if a parent or guardian submits a written or email request to a covered entity to disclose proof that his or her child has been immunized to the child’s school, a copy of the request would suffice as documentation of the agreement. Likewise, if a parent or guardian calls the clinic and requests over the phone that proof of his or her child’s immunization be disclosed to the child’s school, a notation in the child’s medical record or elsewhere of the phone call would suffice as documentation of the agreement. The documentation for these purposes need not include the signature of a parent or guardian or any of the other elements required under the Privacy Rule for a written HIPAA authorization.

9. Question 3 Does the HIPAA Privacy Rule allow a health care provider to disclose protected health information (PHI) about a student to a school nurse or physician?

10. The HIPAA Privacy Rule allows covered health care providers to disclose PHI about students to school nurses, physicians, or other health care providers for treatment purposes, without the authorization of the student or student’s parent. For example, a student’s primary care physician may discuss the student’s medication and other health care needs with a school nurse who will administer the student’s medication and provide care to the student while the student is at school.

11. Question 4 If someone has health care power of attorney for an individual, can they obtain access to that individual's medical record?

12. An individual that has been given a health care power of attorney will have the right to access the medical records of the individual related to such representation. However, when a physician or other covered entity reasonably believes that an individual, including an unemancipated minor, has been or may be subjected to domestic violence, abuse or neglect by the personal representative, or that treating a person as an individual’s personal representative could endanger the individual, the covered entity may choose not to treat that person as the individual’s personal representative, if in the exercise of professional judgment, doing so would not be in the best interests of the individual.

13. Question 5 If a patient’s family member, friend, or other person involved in the patient’s care or payment for care calls a health care provider to ask about the patient’s condition, does HIPAA require the health care provider to obtain proof of who the person is before speaking with them?

14. If the caller states that he or she is a family member or friend of the patient, or is involved in the patient’s care or payment for care, then HIPAA doesn’t require proof of identity in this case. However, a health care provider may establish his or her own rules for verifying who is on the phone. In addition, when someone other than a friend or family member is involved, the health care provider must be reasonably sure that the patient asked the person to be involved in his or her care or payment for care.

15. Question 6 What is the effect of most HIPAA presentations?

16. HIPAA-nosis

17. Additional HIPAA related questions and answers can be found under Frequently Asked Questions on the OCR website: http://www.hhs.gov/ocr/privacy