UAMS ADMINISTRATIVE GUIDE
|SUBJECT:||MINIMUM NECESSARY POLICY|
To inform the UAMS workforce about the minimum necessary requirements for the use and disclosure of Protected Health Information (PHI).
Disclosure means the release, transfer, provision of access to, or divulging of information in any manner (verbally or in writing) by UAMS to persons who are not UAMS employees or students, or to any other person or entity OUTSIDE of UAMS.
Legal Representative means the person authorized by law to act on behalf of the patient, such as the parent of a minor, a court-appointed guardian or a person appointed by the patient in a Power of Attorney document.
Minimum Necessary means limiting Protected Health Information to the minimum necessary to accomplish the intended purpose of the use, disclosure or request.
Protected Health Information (PHI) means information that is part of an individual’s health information that identifies the individual or there is a reasonable basis to believe the information could be used to identify the individual, including demographic information, and that (i) relates to the past, present or future physical or mental health or condition of the individual; (ii) relates to the provision of health care services to the individual; or (iii) relates to the past, present, or future payment for the provision of health care services to an individual. This includes PHI which is recorded or transmitted in any form or medium (verbally, or in writing, or electronically). PHI excludes health information maintained in educational records covered by the federal Family Educational Rights Privacy Act and health information about UAMS employees maintained by UAMS in its role as an employer.
Required by Law means a mandate contained in law that compels UAMS to make a use or disclosure of information and that is enforceable in a court of law. “Required by Law” includes, but is not limited to, court orders and court-ordered warrants, grand jury subpoenas, a governmental or administrative body authorized by law to require the production of the information being sought, Medicare or Medicaid conditions of participation, and statutes or regulations that require the production of the information. For purposes of compliance with HIPAA, “Required by Law” does not automatically include a subpoena issued or signed by a non-governmental entity since certain subpoenas require that a signed HIPAA Authorization accompany the subpoena. See UAMS Use and Disclosure Policy 3.1.28 for more information regarding compliance with subpoenas and persons who are authorized to sign a HIPAA authorization.
UAMS Workforce means for purposes of this Policy, physicians, employees, volunteers, trainees, and other persons whose conduct, in the performance of work for UAMS, is under the direct control of UAMS, whether or not they are paid by UAMS.
Use means the sharing, employment, application, utilization, examination, or analysis within UAMS.
For Protected Health Information (PHI) that is subject to the minimum necessary requirements of the HIPAA regulations, UAMS will make reasonable efforts to limit the use or disclosure of, and requests for, PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. This policy is not intended in any way to impede access to patient information necessary for healthcare providers to make medical decisions and provide treatment to the patient whose information is requested. UAMS health care professionals must have timely and sufficient access to patient information for treatment purposes and will use their professional judgment to determine the minimum necessary patient information required to provide such treatment.
1. Exclusions: The minimum necessary requirement does not apply to any of the following:
A. Disclosures to or requests by a health care provider (outside UAMS) for treatment purposes;
B. Uses or disclosures made to the individual who is the subject of the information;
C. Uses or disclosures made pursuant to a valid and HIPAA-compliant authorization signed by the patient or patient’s Legal Representative;
D. Disclosures made to the United States Department of Health and Human Services, or any officer or employee of that Department to whom the authority involved has been delegated;
E. Uses or disclosures Required by Law; and
F. Uses or disclosures required for compliance with other applicable laws and regulations.
2. UAMS will identify the classes of persons or job titles within the UAMS workforce who need access to PHI to carry out their job responsibilities. UAMS will identify the category or categories of PHI to which these individuals need access, and the conditions appropriate to such access.
3. For Uses of PHI by UAMS health care professionals for treatment: UAMS physicians, nurses or other health care professionals may have access to and use the entire medical record of a patient, as needed, for purposes of treatment of that patient. The UAMS physicians, nurses and other health care professionals will use their professional judgment to determine the minimum necessary PHI needed for purposes of treatment, and will not be precluded from having access to the entire medical record or any other Protected Health Information determined by the health care professional to be needed for this purpose.
4. All other uses or disclosures subject to the minimum necessary requirements will be reviewed by persons having an understanding of the UAMS privacy policies and practices, and sufficient expertise to understand and weigh the necessary minimum necessary factors.
A. Except for the uses or disclosures of PHI specifically excluded from the “minimum necessary” rule identified under “exclusions” in this policy, UAMS will only use, disclose, or request an entire medical record when the entire medical record is specifically justified as being reasonably necessary to accomplish the purpose of the use, disclosure, or request.
B. Authorized levels of access shall be determined by job classifications or functions. In unusual or emergency situations, the classes of persons or job titles of UAMS employees may be re-evaluated to determine if additional access to PHI is needed to carry out job responsibilities.
C. Although UAMS is not required to rely on the following requests to be the minimum necessary, UAMS workforce may reasonably rely on requests made by:
a. public health and law enforcement agencies to determine the minimum necessary information for certain disclosures; or
b. other covered entities to determine the minimum necessary information for certain disclosures; or
c. a professional who is a member of the UAMS workforce, or is a business associate of UAMS for the purpose of providing professional services to UAMS, if the professional or business associate represents that the information requested is the minimum necessary for the stated purpose; or
d. a researcher with appropriate documentation from an Institutional Review Board (IRB) or Privacy Board.
D. For determination of the minimum amount of PHI necessary for disclosures in connection with research purposes, refer to UAMS HIPAA Research Policy, #3.1.27.
5. Need-To-Know: UAMS Workforce are permitted to access PHI only on a need-to-know basis for carrying out their specific job duties.
SIGNATURE: ________________________________ DATE: ____________________