Registration Process and PHI

Section 4

HIPAA – Consent and Authorization Process

Consent is the process where the patient or his/her guardian states that can have access to PHI and in what situations.

In medical practices this is usually done in two parts. This first part is the registration form process that obtains demographic and other general information. The second part may be consent or authorization for specific invasive procedures or care (such as consent for a procedure or treatment). Not all settings use both types of consent or authorization. Consent for specific treatment in general medical settings is not longer required by the HIPAA rules as modified on August 14 th , 2002, however if a practice chooses to obtain general consent for treatment this is at the discretion of the practice. Consent or authorization for invasive procedures is required. (Consent information 45

CFR 164.506)

The difference between consent and authorization is that consent is general and authorization deals with specific disclosure. The more stringent authorization would be for a surgical procedure with risk and benefits reviewed, or for psychotherapy notes, HIV/Aides and ETOH/drug issues (the last two items are state of Ohio specific).

Authorization is covered in this section after the patient registration process and forms.

Any physician or provider who is involved with direct treatment of the patient before using or disclosing PHI must obtain consent. Exceptions are allowed for in cases when:

1.

Indirect care providers (such as interpreting physicians) do not require consent.

2.

Cases of emergency care, but this must be documented as to the attempt made to obtain consent.

3.

Cases where the patient is unable to communicate due to mental status, but this must be documented as well

4.

Cases where treatment is required by law.

Consent is only required once at the initiation of care and treatment. If specific procedures are rendered after the initial consent these authorizations would be procedure specific and do not need to cover the general items of initial consent.

Consent should be done after the provision to the patient of your privacy notice. This basically means that all practices will need to redo the consent process in conjunction with their creation and implementation of the practice privacy notice.

The consent should be signed prior to rendering of services. In most cases this will occur, except in cases where a patient was seen in a facility prior to the office setting.

The consent must:



Be in plain language



Inform individual of PHI use and disclosure



Refer to the privacy notice



State the patient has the right to review the notice prior to signing the consent



Review the right to restrict PHI disclosure for treatment, payment or operations (however this may make the services self pay)



If the practice agrees to the non disclosure requests of an individual this agreement is binding



The individual's right to revoke consent in writing, except to the extent that treatment, payment and operations have already proceeded.



Be signed and dated

The signed consent and any revocation of consent must be maintained in the medical record.

Section 4 – Page 2

If a patient dies, the right to access the PHI rests with the designated legal entity that the patient identified. PHI can be shared with coroners, medical examiners, and funeral directors, without consent.

Registration Process and PHI

Patient Registration Process:

All practices are expected to have a form of general consent with their registration process. In most cases this is a

“paper process.”. It is important with this process that the information be obtained, maintained and reviewed in confidence to assure the privacy rights of the individual. The need for guarding patient privacy is different in each setting based on the care issues presented. There are common issues to all practices with patients expecting that the practice will:

Maintain all PHI in confidence in accordance with the HIPAA rules and regulations.

Not disclose PHI without written consent except in the identified allowed instanced: health insurance verification, prior authorization procedures, pre-certification, coordination of medical care, emergency medical care, to governmental entities, or with written release.

Make ever attempt to assure that communications are maintained in the strictest of confidence by all professionals involved in the health care process.

At review of patient registration information, which may occur at each visit, this should be done discreetly as to not jeopardize the patient privacy in a general public are.

Patient Registration Form

The patient registration form is the main method of obtaining information about the patient and his/her insurance coverage. With the changes resulting from the implementation of HIPAA, all patients will be required to complete a new form identifying areas that are now a concern. This form will need to include a statement concerning the practice privacy notice,.

This form needs to be reviewed on an annual basis, but only “re-done” when the patient requests a change in release of information, has a new insurance coverage or and information change in release of PHI. The information section of a form may need to be re-done, but the actual consent portion does not.

Key issues that patients need to identify with this form include:



Permission to leave information on phone systems and/or significant others who may have

access to the patient phone system



E-mail communication currently or in the future



Emergency and general medical communication – who can the practice contact and talk with



Identification of other health care professionals whom the practice may contact and communicate with on a regular basis.

 In practices where there is a linkage between “family members” as part of the registration or billing process, the information shared between medical records is of administrative use only, except when pertinent to medical care.

Section - Page 3

Information obtained by the practice prior to face to face patient care services:

In some practice patient registration activities occur over the phone and may include some level of PHI. The patient administrative information of name, date of birth, insurance and demographic information and the reason for the visit or chief complaint contains some PHI. The PHI would be the reason for visit, a diagnosis or chief complaint in many cases. Though this information is generally vague in nature it is still PHI and needs to be managed and handled within the HIPAA framework.

In cases where a third party shares PHI with a practice with the expectation of patient care activities, this information should be protected throughout the presence in the practice, and destroyed at an identified time period as determined by the practice as reasonable to expect patient presence. Examples of patient information shared with physician practices would be referral for specific care, referral for specific testing or referral for after care or pre care needs (PAT). This would include post care coverage for emergency room visits.

If the patient does not enter the practices it is imperative that the information be purged and destroyed at an identified time if the patient does not come to the setting for care.

If this practice is provided this type of information routinely, or obtains it directly from patients, it is purged and destroyed as follows:

Purged from computer system: Quarterly

Paper documents shredded after: 6 Months

Continuity of Patient Care Issues

It is important to make sure that patients are aware, through the consent process and the practice privacy notice that information is shared for treatment, payment and operations unless the patient requests otherwise. And the request to not disclose may result in-patients being financially responsible for their medical care.

Other concerns with the registration process include:



Assuring that the information is obtained in a confidential manner



That the information on the registration form is timely and accurate. In some cases, this may require verification of the person’s identity with driver's license or other identification.

ARBOR VIEW FAMILY MEDICINE, INC. PATIENT REGISTRATION

Patient Name_____________________________________________ [] Male [] Female Birth date: ________________ Age______

(as it appears on your insurance card)

Address:__________________________________________________City__________________________State:_______Zip_______

Alternate address for mailing (optional):________________________________________Social Security #_______-____-_______

Home Phone:__________________________ Work Phone:_______________________Cell Phone:_________________________

Marital Status: () Single () Married () Divorced () Widowed Spouse_________________________ Birth date:_____________

Employer/School_____________________________ Occupation____________________________ Living Will () Yes () No

May we leave a message at your home with other residents? [] Yes []No On your answering machine/voice mail? []Yes [] No

May we communicate with you via the E-mail? () Yes () No E-Mail address_________________________________________

To Whom may we talk to about your medical concerns :___________________________________________________________

Relationship_________________________________________ Phone_________________________________

Is this contact for emergency purposes only ? [] Yes [] No

FOR MINORS ONLY: Child lives () with both parents () Mother () Father

Mother/Guardian: ____________________________Address (if Different)_______________________________________________

Date of Birth:____________________ Home Phone:_________________________ Work Phone: ____________________________

Father:_____________________________________Address (if Different)________________________________________________

Date of Birth:____________________ Home Phone:_________________________ Work Phone:_____________________________

Responsible party for insurance and bills: [] Patient [] Spouse [] Parents [] Mother [] Father []Other__________________

Obtain copy of Driver’s license [] Yes [] No

Primary Insurance Company :______________________________ Name on contract______________________________

Effective date ________________ Member I.D. Number__________________________

Relationship to card holder: [] Self [] Spouse [] Dependent Card Copied: [] Yes [] No Co-payment; $__________________

Secondary Insurance Company _______________________________________ Name on Contract:___________________________

Effective date ________________

Member I.D. Number:__________________________________ Card copied [] Yes []No Card holder: [] Self [] Spouse

Identification of other physicians/health care entities involved with my medical care that I authorize ongoing release of information for continuity of care:

Provider:______________________________________________________________________Phone:__________________________

Address:____________________________________________________________________________Zip:_______________________

Type of physician/ health care provided:_____________________________________________________________________________

Provider:______________________________________________________________________Phone:__________________________

Address:________________________________________________________________________Zip:___________________________

Type of physician/ health care provided:__________________________________________________________________________

Patient Signature_________________________________________ Date______________________________________

Patient Privacy Consent – For the Use and Disclosure of Protected Health Information

Arbor View Family Medicine, Inc.

This consent is required by the Health Insurance Portability and Accountability Act of 1996 to inform you of your rights for privacy with respect to your health care information.

I hereby give my consent to Arbor View Family Medicine, Inc. to use and disclose my protected health information for the purposes of treatment, payment and for healthcare operations like quality reviews.

Consent for treatment : I, with my signature, authorize this practice and any employee working under the direction of the physician, to provide medical care for me, or to this patient for which I am the legal guardian. This medical care may include services and supplies related to my health (or the identified person) and may include (but limited to) preventive, diagnostic therapeutic, rehabilitative, maintenance, palliative care, counseling, assessment or review of physical or mental status/function of the body and the sale or dispensing of drugs, devices, equipment or other items required and in accordance with a prescription. This consent includes contact and discussion with other health care professionals for care and treatment.

Consent for release of information for payment and operations: I also authorize this practice to furnish information to the identified insurance carrier(s) for any and all payment activities. I further consent to the use for any practice operational needs as identified in the practice privacy notice.

Consent related to the Privacy Notice: I have had a chance to review a Practice Privacy Notice as part of this registration process. I understand that the terms of the Privacy Notice may change and I may obtain these revised notices by contacting the practice by phone or in writing. I understand I have the right to request how my protected health information (PHI) has been disclosed. I also have the right to restrict how this information is disclosed, but this practice is not required to agree to my restrictions. If it does agree to my restrictions on PHI use, it is bound by that agreement.

Consent for assignment of benefits: I consent to assign all payments for these services to this practice. I understand that I am responsible for all co-payments, amounts applied to deductibles and other amounts that may be deemed my responsibility by the payment sources, as required by my contract with my insurance plan and state regulation. I further understand that my contract with my insurance entity may not cover some services. It is my responsibility to obtain information from my health plan about service coverage. If I seek care outside of the contract, I am aware that I may be responsible for all charges that are incurred.

Patient/Guardian initial: ______________________________ Date: __________________________________

I understand that this practice may refuse me services if I refuse to sign this consent. I may revoke this consent at any time, but the practice may refuse further services at that time. If I revoke this consent, the revocation does not take affect until the practice receives it.

Patient/Guardian______________________________________ Date:______________________________________

Name printed:_________________________________________ If not patient, relationship:_____________________

Copy of Practice Privacy statement signed or initiated with patient/guardian on:______________________________________

Patient unable to sign privacy statement due to: ____________________________________________________________________

REVOCATION:

I hereby revoke the consent given above:

Patient/Guardian______________________________________

Name printed:_________________________________________

Date:______________________________________

If not patient, relationship:_____________________


Authorization:

Authorization is a more specific and focused method for allowing release of specific PHI. Authorization is required when release of the PHI is for reasons other than treatment, payment or operations or when the specific item being released has a higher level of significance to the patient or is required by HIPAA or state law.

Treatment areas that require specific authorization include:

Psychotherapy notes

AIDS and HIV information (in Ohio)

Drug and Alcohol information (in Ohio)

Research

Marketing

Self disclosure (directly to patient or identified entity – patient, parent, guardian, etc.)

A valid authorization must have the following:



Description of the information being disclosed



Who the information is being disclosed to



An expiration date that relates to the disclosure (HIPAA has no set time requirements on this field)



Right to revoke authorization



The possibility that the disclosed information may be re-disclosed by a non-covered HIPAA entity.

 Individual’s signature and date.

Authorization for disclosure must be maintained in the medical record for 6 (six) years after the effective date.

Authorization for psychotherapy notes is required, except in the following circumstances:



Use for treatment



In training programs



To defend legal actions



To individual



Use permitted by law



For health care oversight activities



By coroner or medical examiner



To prevent or lessen imminent threat to the health or safety of a person or public

Validation of authorization:

It is expected that prior to allowing a person to sign an authorization form to release specific information, the practice is assured that this person is the person the PHI represents or their legal representative by verification of driver’s license or other means of identification.

ARBOR VIEW FAMILY MEDICINE, INC.

2405 N. Columbus Street, Suite 200 Lancaster, Ohio 43130

Phone 740-689-3627 Fax 740-687-5898

Authorization Form

This authorization is required by the Health Insurance Portability and Accountability Act of 1996 to inform you of your rights for privacy with respect to your health care information. It authorizes Arbor View Family Medicine to disclose my medical records relating to:

Description of the specific information to be used or disclosed:

_________________________________________________________________________

To be released to the identified person(s) or entity:

_________________________________________________________________________.

_________________________________________________________________________.

This authorization is in effect until ____________________.

Under the privacy rules I have the right to revoke this authorization at any time in writing and Arbor View Family Medicine

must cease using this authorization. However the practice may complete any actions it initiated with my PHI prior to my revocation which rely on the above records for completion. (An example of this would be ABC insurance may rely on these records to contest a claim)

I understand that by disclosing these records, the practice cannot guarantee the recipient will not re-disclose or use the records in violation of the Privacy Rules.

I must revoke this authorization in writing to: Arbor View Family Medicine, Inc.

2405 N. Columbus St. Suite 200

Lancaster, Ohio 43130

Date:_____________________________ Patient/Guardian___________________________________

Name printed:_____________________________________ If not patient, relationship:_____________________


PHI Disclosure

Disclosure of PHI is allowed as long as there is a valid consent for general PHI or an authorization for specific covered areas.

When information is disclosed to a treatment entity, in the course payment for health care or as part of health care operations the valid completed consent form is required.

When information is of a specific nature, such as psychotherapy notes, HIV/Aids information or drug and alcohol information than a specific authorization form must be completed.

Release of medical records would be a disclosure that should be logged on the PHI disclosure log. Other types of disclosures would be those disclosures for extraneous purposes such as application for life insurance, disability forms, and financial aide.

All disclosures, with the exception of those required by governmental entities, require a valid patient signature for release.

This would include a subpoena for medical records, unless signed by a judge or court order (not simply an attorney).

Copies of the consent form should remain in the medical record for as long as the medical record is intact.

Original or copies of all authorizations for release of information or medical record release are to be maintained with the disclosure log for at least six (6) years after the expiration date, or as long as the medical record in intact.

The sample disclosure log is on the next page. A disclosure log should be maintained in all medical records, in the administrative section for physician practices, for patients who have had a disclosure made. If there is not disclosure made, this form is not required to be in the medical record (at this time).

Disclosure tracking is not required for governmental agencies, worker’s compensation or activities initiated by a court proceeding.

PHI Disclosure Log

Patient Name:_____________________________ DOB:_____________________

This disclosure log was initiated beginning _________________ for tracking disclosures for the above patient. A copy or the original release is maintained in this section. No release of PHI is made without written consent or authorization.

Date________________ Disclosed information:_________________________________ To Whom:__________________

Date(s) disclosure covered:__________________________________ Purpose of disclosure:__________________________

Written authorization obtained and in the medical chart [] Yes [] No, circumstances of______________________________
















Page ____ of ______ Disclosure Log

Patient:_________________________________ Date of Birth:________________________




















Patient Access to their HPI and the Amendment Process

Request to review the medical record by the patient or their legal guardian (for minors)

A patient can ask at any time to review their medical record and therefore their protected health information. A practice can set parameters in how this can take place, including scheduling of time with a clinical person for this review. When this process happens the practice is responsible for several things:



Assure that the person looking at the record has signed an authorization form to ensure that tracking takes place

 Validates that the person is who they say they are by review of diver’s license or other identification f the practice or setting is not familiar with the patient.



Assure that the practice maintains the integrity of the medical record, and this may include supervision of the review by the patient with clinical or clerical staff.



If a physician believes that the information in the medical record may be of harm to the patient they may refuse access but must state the reasons. The refusal of access to the patients PHI may be reviewed by the Office of

Civil Rights if the patient pursues a complaint, and a determination for access may result. The patient can also see access through the court system.

As part of the Privacy Notice the practice needs to determine that time frame for PHI access and other factors involved>

In this practice we attempt to schedule time for medical record review within thirty (30) days of the request by the patient or legal guardian.

All record reviews are done with the Privacy Officer and Medical Assistant ( a specific person or position role within the practice. This may be clinical, clerical or administrative, but should be someone knowledgeable about the medical record process and medical issues should clarification be required.

The review of the medical information is done in the presence of a qualified person from the practice to allow the opportunity for questions or clarification. The patient or his/her representative is not allowed to remove the original chart from the practice, but may have a copy with the appropriate release of information and payment of fees as outlined in Ohio law. The access to the medical record is for the patient only, and if any other individuals are present for this review, a release of information form must be completed and signed by the patient.

Request for Medical Record (PHI) Amendment by Patient or guardian for a minor.

The patient or his/her legal entity may request that an amendment or clarification be made to the medical record by HIPAA regulation on or after April 14, 2003. The following form must be completed by the person requesting the amendment and a response will be provided to them and maintained in the medical record.

The patient or their legal guardian may seek to amend their record with a practice, however the practice is not obligated to automatically process the amendment or change. Amendments must be done as follows:



A review must be completed within 60 days of the request and if the amended is not allowed, the reason provided to the patient.



If an amendment is granted, updating of all related disclosures as identified by the patient as needing this amended material as part of their role in the patient’s health care or as otherwise identified.



Copy business associates on the amendment as it pertains to their accurate functioning on behalf of the patient and/or practice.


Amendments can be denied for one of the following reasons:



The information was generated from another source, not this practice



The information was not part of the medical record or part of the information available for access, such as an inmate.



The record as it stands is accurate as recorded.

If a patient is denied the amendment must be documented and a copy sent to the patient. Copies of this information should be maintained in the chart separate from valid or accurate PHI. This information would not be copied without authorization from the patient and would include the rebuttal or disagreement statement as well.

State law prohibits any destruction or removal of medical records beyond the medical record retention rules at the time the medical record is no longer an active entity.

ARBOR VIEW FAMILY MEDICINE, INC.

Request for Amendment of Health Information

Today’s date:___________________

MR#___________

Patient Name:_________________________________________________________________________________________

Date of Birth:________________________________ SS#_____________________________________________________

Patient Address:_______________________________________________________________________________________

City:________________________ State:_______________ Zip:_______________ Phone:___________________________

Reason for amended information:_________________________________________________________________________

Date (or dates) involved:________________________________________________________________________________

How is the information incorrect/incomplete or invalid:_______________________________________________________

____________________________________________________________________________________________________.

Information to be amended is as follows:___________________________________________________________________

____________________________________________________________________________________________________.

____________________________________________________________________________________________________.

____________________________________________________________________________________________________.

____________________________________________________________________________________________________.

____________________________________________________________________________________________________.

____________________________________________________________________________________________________.

Do you know if anyone has received or relied on this information in question (such as another physician, pharmacy, health plan, home health agency) [] Yes [] No

If yes, please identify so that additional information can be forwarded to the proper entity:

_____________________________________________________________________________________.

_____________________________________________________________________________________.

Patient/Guardian signature: Date:

Practice Use Only:

Request for amendment to PHI [] Accepted [] Denied because of the following: [] Denial letter sent ___________

[] Not created by this practice [] Not part of this patients PHI [] PHI is accurate and complete as is

Practice Representative:______________________________________

Printed Name and title:______________________________________

Date:_____________

Date:_____________

Release of Medical Information

Information is only allowed to be copied and released, except in cases of medical emergency, with the completion of the

Release of Information Form. All medical records are reviewed by the physician prior to their being mailed to the patient or identified entity. This form is similar to the authorization form but is unique for medical records from one practice to another,

This practice charges the patient a fee of $15.00 to process this medical record and an additional fee of $1.00 per page up to the first 10 pages, $0.50 for pages 11 through 50, and $0.20 per page 51 and higher. This can be waived in cases of financial hardship and would not be charged in cases where the medical information was required for transfer of care or continuity of care.

Retention of PHI and related information is as follows based on Federal and State regulations, laws and requirements.

Patient medical records

Diagnostic films, x-rays and diagnostic images

If no invasive procedure 7 years after last encounter ; If major surgery, 2 years after death

Laboratory test results

7 years after last contact, unless related to death.

* years in accordance with Ohio Administrative Code 5101 that impacts hospitals more than physician practices.

Annual Reports

Practice bylaws

Major surgery

If no invasive procedure 7 years from last encounter, if major procedure, 2 years after

Permanently

Permanently

Permanently Practice minutes

Copies of insurance contracts

Copies of EOB’s from Insurance

Physician personnel records

Payroll, IRS documents

Unemployment records

7 years

7 years

Permanently

7 years

7 years

Personnel information (OSHA, etc.)

Banking and Reconciliation data

Clinical

Appointment books/backup disc

Encounter/billing forms

Sample Medication log

Patient lists (computer)

30 years

7 years

3 years

3 months

2 years

Permanently

ARBOR VIEW FAMILY MEDICINE, INC.

2405 N. Columbus Street, Suite 200 Lancaster, Ohio 43130

Phone 740-689-3627 Fax 740-687-5898

Authorization for Release and Examination of Medical Records (PHI)

Patient Name:________________________________________ Date of Birth:__________________________

I hereby authorize and request ______ David M. Scoggin, M.D. ______ Richard B. Sielski, M.D.

______ John E. Lloyd, M.D. ______ Theresa A. Dyar, D.O.

____________ Obtain Medical Information from:

____________ Release Medical Information to:

Physician or Facility’s Name: __________________________________________________________________

Address: ___________________________________________________________________________________

Information Requested:

_______ Complete Records _______ ER Report _______ Clinical Summary

________ Immunization Records _______ Lab Report _______ Discharge Summary

________ Other _______ X-Ray Report _______ Tests

A complete copy of the requested medical record, medical information, also known as PHI and related data for the above identified person from ____________________ (date) to ____________________ (date). I am aware that there may be information in this medical record that relates to substance abuse, mental illness or HIV/Aids that is of a highly confidential level.

I am aware that I can revoke this release at any time prior to the records being released to the above named entity and that this release is valid for a limited time of 90 days.

I am also aware that effective April, 2010, I may be charged a fee to process this medical record request as follows:

$2.83 per page up to the first 10 pages, $0.59 per page for pages 11 through 50, and $0.24 per page 51 and higher.

____________________________________________

Signature of Patient/Legal Guardian

____________________________________________

Witness

________________________________

Date:

________________________________

Date

Records reviewed:_______________ Sent:_________________

Fee charged/collected: $________________

____________________________________________

Martha S. Scott, RN, Practice Manager

By:____________________________

__________________________________________

Kathleen M. Wingenter, Medical Records Custodian

Registration Process and PHI

Related documents

Products

Support

Registration Process and PHI

Related documents

Add this document to collection(s)

Add this document to saved

Suggest us how to improve StudyLib