Q: What is Protected Health Information (PHI) (Otherwise known as "individually identifiable health information")?

A: Any and all health information records that identify the patient; or there is a reasonable basis to believe the information can be used to identify the patient.

Q: How are covered entities (like our healthcare system) expected to determine what is the minimum necessary information that can be used, disclosed or requested for a particular purpose?

A: The Privacy Rule requires a covered entity to make reasonable efforts to limit use, disclosure of and requests for PHI to the minimum necessary to accomplish the intended purpose. The minimum necessary standard is intended to make covered entities evaluate and enhance protections as needed to prevent unnecessary or inappropriate access to PHI. It is intended to reflect and be consistent with, not override, professional judgment and standards.

Q: How is minimum necessary defined?

A: The least amount of PHI required to satisfy a request. For example, records compiled in response to a PHI request for a specific date of service should not include treatment records for other dates of service.

Q: Do the minimum necessary requirements prohibit covered entities from maintaining patient medical charts at bedside, require that covered entities shred empty prescription vials or require that X-ray light boards be isolated?

A: No. The minimum necessary standards do not require that covered entities take any of these specific measures. Covered entities must, in accordance with other provisions of the Privacy Rule, take reasonable precautions to prevent inadvertent or unnecessary disclosures.

Q: What is an Authorization?

A: Authorization permits a covered entity to use and disclose only specific PHI to specified individuals for specified purposes that are almost always for purposes other than treatment, payment or healthcare operations.

Q: What information can a hospital provide if one inquires about a patient by name?

A: Information about the patient's general condition and location of an inpatient, outpatient or emergency department patient may be released only if the inquiry specifically identifies the patient by name. No information may be given if a request does not include a specific patient's name or if the patient requests that the information not be released.

Q: If healthcare providers engage in confidential conversations with other providers or with patients, have they violated the rule if there is a possibility that they could be overheard?

A: The Privacy Rule is not intended to prohibit providers from talking to other providers and to their patients. We would consider the following practices to be permissible, if reasonable precautions are taken to minimize the chance of inadvertent disclosures to others who may be nearby (such as using lowered voices, talking apart):

· Healthcare staff may orally coordinate services at hospital nursing stations.
· Nurses or other healthcare professionals may discuss a patient's condition over the phone with the patient, a provider or a family member.
· A healthcare professional may discuss lab test results with a patient or other provider in a joint treatment area.
· Healthcare professionals may discuss a patient's condition during training rounds in an academic or training institution.

Q: Does the Privacy Rule require hospitals and doctors' offices to be retrofitted, to provide private rooms and soundproof walls to avoid any possibility that a conversation is overheard?

A: No. The Privacy Rule does not require structural changes be made such as creating private rooms, soundproofing rooms, or the encryption of telephone systems or wireless or other emergency medical radio communications that can be intercepted by scanners.

Q: Can a physician's office or hospital FAX patient medical information to another physician's office or hospital?

A: The Privacy Rule permits the disclosure of PHI to another healthcare provider for treatment purposes. This can be done by fax or by other means. Covered entities must have in place reasonable and appropriate administrative, technical and physical safeguards to protect the privacy of PHI that is disclosed using a fax machine.

Q: Can we still use the sign-out/in sheets at the desk to track patient locations off the unit?

A: Yes, so long as the information disclosed is appropriately limited. For example, a sign-in sheet may not display medical information (such as, the medical problem for which the patient is being seen) that is not necessary for the purpose of signing in.

Q: How will this affect students having access to patient information during their training?

A: The Privacy Rule provides for "conducting training programs in which students, trainees or practitioners in areas of healthcare learn under supervision to practice or improve their skills as healthcare providers." BAPTIST HEALTH'S policies and procedures will continue to permit medical trainees access to patients' medical information, including entire medical records.

Q: Are hospitals able to inform the clergy about parishioners in the hospital?

A: Yes. The Privacy Rule allows this communication to occur, as long as the patient has been informed of this use and disclosure, and does not object. The Privacy Rule provides that a hospital or other covered healthcare provider may maintain in a directory the following information about that individual:

1) the individual's name;
2) location in the facility;
3) health condition expressed in general terms; and
4) religious affiliation. The facility may disclose this directory information to members of the clergy. For example, a hospital may disclose the names of Methodist patients to a Methodist minister unless a patient has restricted such disclosure.

Q: A hospital customarily displays patients' names next to the door of the hospital rooms that they occupy. Will the Privacy Rule allow the hospital to continue this practice?

A: Disclosure of patient names by posting on the wall is permitted by the Privacy Rule, if the use or disclosure is for treatment (i.e., to ensure that patient care is provided to the correct individual) or healthcare operations purposes (i.e., as a service for patients and their families).

Q: Can physician offices use patient sign-in sheets or call out the names of patients in their waiting rooms?

A: Yes. Covered entities such as physician offices may use patient sign-in sheets or call out patient names in waiting rooms, so long as the information disclosed is appropriately limited. The Privacy Rule explicitly permits certain "incidental disclosures" that occur as a by-product of an otherwise permitted disclosure.

For additional information or questions, please contact Kathy Roberts, Privacy Officer, at 501-202-1323