You work at Rasmussen Hospital and just completed an in-service training designed to familiarize you with the hospital's Access and Disclosure Policy to ensure you know how to apply the processes for access, release, and disclosure of the patient health record.

To assess the effectiveness of the training, the instructor asked each participant to address the following:

• Review the policy document below.

Page 1 of 3 + HIM2410 Module 04 Assignment- RASMUSSEN UNIVERSITY Rasmussen Hospital Health Information Management POLICY AND PROCEDURES NUMBER: R01 SUBJECT: Access and Disclosure Policy POLICY: Workforce members can use or disclose protected health information (PHI) without the consent or authorization of patients for purposes other than treatment, billing or health care operations. Access, use, and disclosure of PHI will not be limited to the minimum necessary to perform their roles, regardless to the extent of access provided. PROCEDURE: A. Confidential patient records will be released only upon receipt of consent from the patient, legal guardian, or authorized representative. 1. If the patient is a minor, the parent should sign the consent form. There should not be any exception to this rule. 2. Any authorization signed by a deceased patient's family member shall be honored. 3. If the patient is unable to sign the authorization by reason of physical or mental incapacity, the authorization should be signed by an authorized representative or legally appointed guardian. B. CONTENT OF RELEASE OF INFORMATION AUTHORIZATION Authorizations to release information should be completed in entirety. They must include the following information: 1. First and last name of the patient. 2. Name of person, agency, or organization that will be releasing information. 3. Name of person, agency, or organization to which the information is to be released. 4. Specific information to be released. 5. Purpose of disclosure 6. Signature and date of patient, parent/guardian or authorized representative. 7. Notice that the authorization is valid for a specified period of time. C. VALID CONSENT The written consent of a patient, legal guardian or authorized representative is considered valid only if the following conditions are met: 1. Patient or the representative is informed, to their understanding, of the specific type of information that has been requested and, if known, the benefits and disadvantages of releasing the information. 2. Consent is given voluntarily.Page 1 of 3 C. VALID CONSENT The written consent of a patient, legal guardian or authorized representative is considered valid only if the following conditions are met: 1. Patient or the representative is informed, to their understanding, of the specific type of information that has been requested and, if known, the benefits and disadvantages of releasing the information. 2. Consent is given voluntarily. 3. Services are not contingent on their decision concerning the release of information. 4. Patient's consent is acquired in accordance with applicable law and regulation. Page 4 of 4 HIM2410 Module 04 Assignment RASMUSSEN UNIVERSITY D. Forward any written requests or phone calls from a commercial insurance company for onsite record review to a Nurse Account Specialist at the Shared Services office. E. PROCESSING TIME Act upon each request no later than 30 days (or more stringent state-required time frame) after the request is received. If any challenges are encountered fulfilling an access request within the initial 30 day timeframe (i.e. the requested PHI is in off-site storage and may take some time to retrieve, etc.), notify the requester about the status and the intent to provide the requested PHI within the next 30 days. F. COSTS - determined by state statute or regulation 1. Nonpatient-initiated requests, charge state regulated fee. 2. Charge flat rate of $6.50 for the following requests a. All patient-initiated requests and attorney requests on behalf of the patient b. All records released via SFTP (secure e-mail) 3. Payment received for copies of medical records must be sent to the hospital's Shared Services Director of Finance at the address below. Note: Cash is not accepted. Check, money order or cashier's check only made payable to the hospital. Please see Attachment A for current Record Copy Fees by state 4. Patients and other authorized representatives may be reminded that there is no charge for viewing a record onsite, and that electronic transfer of records (via secure file transfer protocol, known as SFTP or other available method) is preferable and less costly compared with paper release.Page 1 of 3 and the intent to provide the Te SKED of wau au UILIN F. COSTS - determined by state statute or regulation 1. Nonpatient-initiated requests, charge state regulated fee. 2. Charge flat rate of $6.50 for the following requests a. All patient-initiated requests and attorney requests on behalf of the patient b. All records released via SFTP (secure e-mail) 3. Payment received for copies of medical records must be sent to the hospital's Shared Services Director of Finance at the address below. Note: Cash is not accepted. Check, money order or cashier's check only made payable to the hospital. Please see Attachment A for current Record Copy Fees by state 4. Patients and other authorized representatives may be reminded that there is no charge for viewing a record onsite, and that electronic transfer of records (via secure file transfer protocol, known as SFTP or other available method) is preferable and less costly compared with paper release. G. REQUESTS FOR INFORMATION 1. When authorization is received, hospitals will log request in Release of Information logbook and stamp request with date of receipt. 2. Review authorization for completeness. If authorization is incomplete or more information is needed, complete Release of Information Response Letter and return to requester. 3. Request prepayment on all record requests that are billable. (See letter E for handling payments received) - Cash is not accepted. Check, money order or cashier's check only made payable to the hospital. 4. If authorization is complete and prepayment has been received, copy the requested information. 5. Hospitals will complete Release of Information log. 6. Release copies of records via the method requested to requester. 7. File original request and authorization in the correspondence section of the paper medical record if the chart is available on site. Add or scan the original request/authorization and index to the HIM ROI Authorization in the EMR. H. TELEPHONE REQUESTS Telephone requests for release of information will be discouraged and limited to emergency or urgent situations at the request of other health care providers. Information will be released only on a "call back" basis as a means of verifying the Page 4 of 4 HIM2410 Module 04 Assignment - A RASMUSSENPage 1 of 3 Page 4 of 4 HIM2410 Module 04 Assignment RASMUSSEN UNIVERSITY identification of the person making the request. Documentation of the nature of the release of information, circumstances that led to the release of information and to whom the information was released to shall be noted in the medical record 1. FAXING INFORMATION Information may be faxed to other health care professionals or facilities treating the patient or for record completion. Hospital staff should verify the location and name of staff who will be receiving the faxed information. J. REQUEST FROM INSURANCE OR QUALITY IMPROVEMENT ORGANIZATION Information may not be sent to an organization for treatment, payment or health care operations. Employees must not comply with requests for information from Public Health reporting entities, oversight organizations, or family members. K. REQUESTS FOR RADIOLOGY When requests for information with appropriate authorizations include a request for radiology images, obtain images or films from the onsite Radiology Tech or Radiology department of the host hospital or other contracted radiology group. L. All releasing of records will be tracked with the Release of Information function in the EMR. Records can still be released in paper format, via fax, or electronic release. Reference: HIPAA Policy H06-A and H10-A