Health Insurance Portability & Accountability Act (HIPAA)

Protected Health Information (PHI)

All rules governing the use and disclosure of Protected Health Information (PHI) will be governed by nationally recognized standards, rules, regulations, policies, and procedures.

Generally, there is limited access to a patient's medical record without the express, written consent of the patient or without meeting the specific criteria set by the Federal Register. Medical Record Information may include but not be limited to the following items:

• Patient's history
• Treatment Provided
• Results of tests
• Exam reports
• Signed consent forms
• Other notes pertaining to the biographical information and medical treatment of the patient

HIPAA Manual

Moore County Emergency Medical Services, to ensure compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Standards for Privacy of Individually Identifiable Health Information (45 CFR Part 160 and 164), will develop a HIPAA manual to be used by all Emergency Services personnel when using and disclosing Protected Health Information (PHI).

The HIPAA Manual will be updated as needed to ensure the latest policies, procedures, and forms are available. Appropriate training and education will be conducted on initial employment and thereafter as needed.

When in contact with a physician, who is actively directing the treatment of a patient, and where information is obtained through oral communication or observation (which would be necessary for the physician to direct treatment), the information becomes Protected Health Information.

Release of EMS Patient Information & Records

Patient Care Reports, Basic or Advanced Life Support, may be, from time to time, requested by the patient, the patient's legal guardian, executor, administrator, or next of kin for various purposes; examples include:

• Processing of insurance claims
• Legal counsel use
• Court of law use

Medical information covered by the patient/physician privilege may be released to any person who presents a properly authenticated release for the information signed by the patient or legal designee.

When Releases are Authenticated

A release is properly authenticated if it adheres to any of the following:

• The patient provides written documentation requesting the release of the information in person, with picture identification available to verify his/her ID.
• The signature of the patient's legal guardian, executor, administrator, or next of kin is present and verified through picture identification
• Medical information covered by the patient/physician privilege shall not be released by field personnel to any government or private agency for the purpose of obtaining data for study projects, statistics, or similar uses without the consent of each patient, the personal representative of each patient's estate, or if there is no personal representative of an estate, that patient's next of kin. (Exception: Proper Waiver of Authorization obtained from a recognized Institutional Review Board for purposes of medical research.)
• During daily operations, all EMS personnel will take every step possible to ensure the privacy and security of patient information is maintained. The proper procedure to following includes at a minimum the following:
  • Patient Care Reports will remain in secure locations at all times (clipboard, secured desk drawer designated for patient records, and/or devices designated for safe and secure transport of all patient records.
  • During verbal and written disclosure of protected health information, all employees will conduct business in a manner that minimizes the "incidental disclosure" of confidential information. This will include:
    • Discussion of patient information in private locations and not in the open hall or waiting rooms of receiving facilities.
    • Destruction of all documents not deemed part of the medical record in such a manner that all identifiable information becomes unrecognizable.
    • Disclosure and release of the minimum necessary information to carry out the needs of the department's daily health care operations.

Viewing by Legal Representatives

In the event a patient or legal representative requests to view patient documents or requests copies of the Patient Care Report in the field setting or at any of the Moore County EMS operational facilities, the individual should be provided with the following information:

• The phone number of the Administrative Officer (910-947-6500)
• Ask the individual to request information concerning the release of medical information for a specific patient(s)
• Inform the individual requesting the information that in order for the patient's medical records to be released, one or more of the following may need to be provided:
  • The signature of the patient whose records are being requested
  • Verification that the signature is valid.
  • A subpoena directed to the Custodian of Medical Records requesting the release of patient medical records to the courts (applies only if the patient is different from the individual requesting records) with accompanying patient/guardian authorization.
  • A Court Order mandating the release of Medical information pursuant to an issued subpoena
  • Proof and signature of Legal guardianship, administrator, executor, or next of kin of the patient in question.