TUSDM Policy on Authorization Requirements

I. Purpose and Scope:

The purpose of this Policy is to explain: (1) when a written authorization is required, and (2) the relevant procedures Tufts University School of Dental Medicine (TUSDM) must follow when using or disclosing protected health information (“PHI”) pursuant to a valid authorization.
This policy applies to TUSDM Workforce, including faculty, employees, volunteers, trainees, students and other persons as defined below.

II. Policy Statement:

The HIPAA authorization is a written document that gives TUSDM permission to use specified PHI for particular purposes or to disclose PHI to a third party identified by the individual. In most situations, TUSDM must obtain a signed, valid authorization from the individual before using or disclosing the individual’s PHI for purposes other than treatment, payment, and health care operations. When TUSDM receives a valid authorization for its use or disclosure of PHI, TUSDM may only use and disclose PHI in the ways permitted by the authorization.

III. Definitions:

Protected Health Information

IV. General Rules:

When an Authorization Is Required.
1. An authorization is required before TUSDM uses or discloses PHI for “non-routine” purposes, such as disclosures to third parties for the following purposes:
  1. research activities where a waiver from an Institutional Review Board or Privacy Board has not been obtained;
  2. publication of an article;
  3. presentation outside of TUSDM;
  4. sales of PHI; and
  5. most marketing activities.
2. As long as specific conditions are satisfied, among the uses and disclosures for which an authorization is not required are:
  1. for treatment, payment, and health care operations;
  2. for involvement in the individual’s care and notification purposes;
  3. required by law;
  4. for public health activities;
  5. about victims of abuse or neglect as required by law;
  6. for health oversight activities;
  7. for judicial and administrative proceedings;
  8. for law enforcement purposes in accordance with state and federal law;
  9. about decedents;
  10. for research purposes where a waiver has been obtained;
  11. to avert a serious threat to health or safety;
  12. for specialized government functions;
  13. for workers’ compensation;
  14. to the individual;
  15. to the Secretary of Health and Human Services for enforcement of the Privacy Regulation; or
  16. when patient has been de-identified (Appendix A: TUSDM Patient De-Identification Standards).
3. Under the Privacy Regulation, psychotherapy notes are provided special protection. Accordingly, TUSDM must obtain an authorization for any use or disclosure of psychotherapy notes, except where:
  1. the use is by the originator of the psychotherapy notes for treatment purposes;
  2. the use or disclosure occurs in the context of TUSDM’s own training programs in which students, interns, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling;
  3. the use or disclosure is to defend TUSDM in a legal action or other proceeding brought by the patient;
  4. the use or disclosure is required by the Secretary to investigate or determine TUSDM’s compliance with the Privacy Regulation;
  5. the use or disclosure is required by law;
  6. the use or disclosure is to a health oversight agency for oversight activities authorized by law relating to the originator of the psychotherapy notes;
  7. the use or disclosure is to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other legally authorized duties; or
  8. TUSDM, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the use or disclosure is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.
Content Requirements.
1. Plain Language. All authorizations must be written in “plain language.” This means that TUSDM must make a reasonable effort to:
  1. organize material to serve the needs of the reader;
  2. write short sentences in the active voice, using “you” and other pronouns;
  3. use common, everyday words in sentences; and
  4. divide material into short sections.
2. Core Elements. All authorizations must contain the following core elements:
  1. a description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion;
  2. the name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure;
  3. the name or other specific identification of the person(s), or class of persons, to whom TUSDM will disclose the information;
  4. a description of each purpose of the requested use or disclosure (the statement must provide enough information to allow patients to make an informed decision whether to release the information – broad or blanket authorizations requesting the use or disclosure of PHI for a wide range of unspecified purposes are prohibited). If the individual is initiating the authorization for his or her own purposes, the purpose may be described as "at the request of the individual";
  5. an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The authorization may expire on a specific date (e.g., June 1, 2003), a specific time period (e.g., 3 years from the date of the signature), or an event directly relevant to the individual or the purpose of the use or disclosure (e.g., for the duration of the individual's participation in a clinical trial). In general, authorizations may not have an indeterminate expiration date. However, an authorization for research purposes is not required to have an expiration date, so long as the authorization form states this fact;
  6. signature of the individual and date; and
  7. if the authorization is signed by a personal representative of the individual, a description of the representative’s legal authority to act for the individual.
3. Required Notifications. In addition to the core elements, all authorizations must contain the following notifications:
  1. a statement that the individual has the right to revoke the authorization in writing and either a discussion of the exceptions to the right to revoke together with a description of how the patient may revoke the authorization, or, to the extent that this information is included in the Notice of Privacy Practices, a reference to the Notice;
  2. a statement that treatment, payment, enrollment, or eligibility for benefits may not be conditioned on obtaining the authorization if such conditioning is prohibited by the Privacy Regulation or, if conditioning is permitted by the Privacy Regulation, a statement about the consequences of refusing to sign the authorization; and
  3. a statement that information used or disclosed pursuant to the authorization may be subject to re-disclosure by the recipient and no longer be protected by the Privacy Regulation;
4. Non-Required Elements. Valid authorizations may also contain other, non-required elements, so long as those additional elements are not inconsistent with the required elements.
5. Copy to the Individual. TUSDM must provide the individual with a copy of the signed authorization.
6. Defective Authorizations. An authorization is not valid if it has any of the following defects:
  1. the expiration date has passed or the expiration event is known by TUSDM to have occurred;
  2. the authorization has not been filled out completely, with respect to the required elements;
  3. the authorization is known by TUSDM to have been revoked;
  4. the authorization lacks a required element;
  5. the authorization violates the rule on compound authorizations; or
  6. any material information in the authorization is known by TUSDM to be false.
7. Combining Documents. Except in the case of certain research authorizations, an authorization for use or disclosure of PHI may not be combined with any other types of documents (i.e., a consent for treatment, notice of privacy practices) to create a compound authorization. However, multiple authorizations for the use or disclosure of PHI (other than psychotherapy notes) may be combined, so long as TUSDM has not conditioned the provision of treatment or payment on obtaining the authorization. An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes.
8. Conditioning Authorizations. In general, TUSDM may not condition the provision of health care items and services on a patient’s signing an authorization. For example, TUSDM may not refuse to provide health care services to a patient because the patient refused to authorize a disclosure to a pharmaceutical manufacturer for the purpose of marketing a new product. However, TUSDM may condition certain research activities on the provision of an authorization. For example, TUSDM may condition a patient’s receipt of experimental medication on the patient’s authorization for the disclosure of PHI for the research.
9. Research Authorizations. An authorization for the use or disclosure of PHI for a research study may be combined with any other type of written permission for the same or another study, including a consent to participate in research or an authorization to create or maintain a research database or repository.
  1. Where TUSDM has conditioned the provision of research-related treatment on an authorization, any compound authorization referencing that treatment must clearly differentiate between conditioned and unconditioned research activities and permit the individual to opt-in to the unconditioned research activities. Note that the individual cannot be required to opt-out of unconditioned research activities (for example, the individual cannot be required to opt-out of a research database).
10. Receiving Authorizations from Third Parties. Authorizations for use or disclosure of TUSDM records may be obtained by persons other than TUSDM. For example, an attorney may obtain a patient’s authorization for TUSDM to disclose medical records to the attorney for use in litigation. Whether the authorization is submitted to TUSDM by the individual or by another person on the individual’s behalf, TUSDM may not use or disclose the PHI pursuant to an authorization unless the authorization meets the specified requirements set forth in this section of the Policy.
Revocation of Authorizations.
1. An individual may revoke an authorization at any time by means of a written revocation, except to the extent that TUSDM has acted in reliance upon the authorization.
2. When an individual revokes an authorization, TUSDM must stop making uses and disclosures pursuant to the authorization to the greatest extent practical.
3. When an individual revokes a research authorization, TUSDM may continue to use and disclose PHI that was obtained prior to the time the individual revoked his or her authorization, as necessary to maintain the integrity of the research study. However, TUSDM is not permitted to continue disclosing additional PHI to a researcher or to use for its own research purposes information not already gathered at the time the individual withdraws his or her authorization.
Records Retention Requirements.
1. TUSDM must document and retain signed authorizations for six years from the date of their creation or the date when they were last in effect, whichever is later.

V. Policy Compliance Monitoring and Enforcement:

The TUSDM Security and Privacy Officer is responsible for the monitoring and enforcement of this policy; however, directors and managers are also responsible for monitoring compliance with procedures specific to their areas.

VI. Potential Disciplinary Actions and Sanctions:

Failure to follow standard operating procedures may trigger review for potential disciplinary action under the TUSDM Sanctions for HIPAA Violations Policy.

VIII. Approval and Review Cycle:

This policy shall be subject to annual review, revision, and approval by the TUSDM Compliance Committee.

Attachments:

Appendix A: TUSDM Patient De-Identification Standards

The HIPAA Privacy Rule protects all “individually identifiable health information” held or transmitted by a covered entity or its business associates, in any form or medium, whether electronic, paper, or oral. The Privacy and Security Rules call this information "protected health information” (PHI) or “electronic Protected Health Information” (ePHI) if in electronic format.
“Individually identifiable health information” is information, including demographic data, that relates to:

the individual’s past, present or future physical or mental health or condition,
the provision of health care to the individual, or
the past, present, or future payment for the provision of health care to the individual;
and that identifies the individual, or for which there is a reasonable basis to believe it can be used to identify the individual. Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security number).

PHI may be shared if it has been “de-identified.”

Guidance on Satisfying the Safe Harbor Method

In §164.514(b), the Safe Harbor method for de-identification is as follows:

The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:

Names.
All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of the ZIP code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000.
All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older.
Telephone numbers.
Vehicle identifiers and serial numbers, including license plate numbers.
Fax numbers.
Device identifiers and serial numbers.
E-mail addresses.
Web Universal Resource Locators (URLs).
Social security numbers.
Internet Protocol (IP) addresses.
Medical record numbers.
Biometric identifiers, including finger and voice prints.
Health plan beneficiary numbers.
Full-face photographs and any comparable images.
Account numbers.
Any other unique identifying number, characteristic, or code.
Certificate/license numbers.

The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.
This method would demonstrate that a covered entity has met the standard in §164.514(a) above. De-identified health information created following these methods is no longer protected by the Privacy Rule provided that:

Disclosure of a code or other means of record identification designed to enable coded or otherwise de-identified information to be re-identified constitutes disclosure of protected health information; and
If de-identified information is re-identified, a covered entity may use or disclose such re-identified information only as permitted or required by the HIPAA Privacy Rule.