Which of the following requires authorization from the patient for disclosure of phi?

Layout for printingPolicy Number:UW-104Old Policy Number:3.3Responsible Office:Office of Compliance

University Policy

In enacting HIPAA, Congress mandated the establishment of Federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by State or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a Federal floor of safeguards to protect the confidentiality of medical information. State laws which provide stronger privacy protections apply over and above the new Federal privacy standards.

DisclosureThe release, transfer, provision of access to, or divulging in any manner of PHI by an individual within the HCC or ACE with a person or entity outside the HCC or ACE.Health care operationsAny of a number of business and administrative activities, including

• Conducting quality assessment and improvement activities
• Reviewing the competence or qualifications of health care professionals
• Conducting training programs
• Accreditation
• Credentialing
• Conducting or arranging for medical review, legal services and auditing functions
• Business planning and development
• Business management and general administrative activities

Health care operations do not include research and many fundraising and marketing activities. See UW-107 Uses and Disclosures of Protected Health Information for Marketing and UW-108 Uses and Disclosures of Protected Health Information for Fundraising for more information.

Applies to all members of the UW HCC.

Policy Summary

The HIPAA Privacy Rule does not require that patients provide written or verbal authorization prior to some uses or disclosures of their protected health information. UW-Madison follows HIPAA regulations regarding when patient authorization, written or verbal, is not required prior to certain uses or disclosures of their protected health information. 

Policy Detail

Note that special rules apply to records or information concerning HIV status, substance abuse treatment and mental health. Unless otherwise specified, the information below applies to general treatment records and information (i.e. excludes HIV status, substance abuse treatment and mental health). Contact the HIPAA Privacy Officer or the UW Office of Legal Affairs for more information.

Under the HIPAA Privacy Rule, the following uses and disclosures do not require obtaining patient authorization or providing the patient with an opportunity to agree or object to the use or disclosure:

1. Use for Treatment, Payment, or Health Care Operations.

   Use of PHI for treatment, payment, or health care operations (as defined above), within the UW HCC or the UW ACE, does not require patient authorization or providing the patient an opportunity to agree or to object.

   Except for uses for treatment, these uses are subject to the minimum necessary standard (see UW-109 Minimum Necessary Standard).

2. Disclosure for Treatment, Payment, and Health Care Operations
   1. PHI concerning HIV test results and substance abuse treatment does require written patient authorization for disclosure or release.
   2. PHI may be disclosed without patient authorization or providing an opportunity to agree or to object in the following situations:
      1. PHI may be disclosed by an individual within the UW HCC or UW ACE for its own treatment activities. In addition, PHI may be disclosed to another health care provider for its treatment activities.
      2. PHI may be disclosed by an individual within the UW HCC or UW ACE for its own payment activities. In addition, PHI may be disclosed to another covered entity (e.g., health care provider or health plan) for that entity’s payment activities.
      3. PHI may be disclosed by an individual within the UW HCC or UW ACE for certain health care operations of another health care provider or health plan, if the other provider or health plan also has a relationship with the patient who is the subject of the PHI. Health care operations include teaching/training, conducting quality assessment and improvement activities and reviewing the competence or qualifications of health care professionals.
   3. It is not required that disclosures for treatment, payment, and health care operations be included in the accounting of disclosures (see UW-119 Requests by Patients for an Accounting of Certain Disclosures).
   4. The minimum necessary standard does not apply to disclosures for treatment purposes to other health care providers, but does apply to the other disclosures listed in this section “II” (see UW-109 Minimum Necessary Standard).
3. Other Uses and Disclosures That Do Not Require Patient Authorization or Patient Opportunity to Agree or Object

   1. Uses and Disclosures Required by Law

      (Note: the minimum necessary standard does not apply to uses and disclosures required by law.)

      1. In response to a court order (may disclose only the PHI expressly authorized by such order, and may include HIV status, substance abuse treatment or mental health).
      2. In response to a written request by a federal or state agency to perform a legally authorized function, such as management audits, financial audits, program monitoring and evaluation, and investigation of patient complaints.
      3. In response to a request by a county agency or other investigating agency for investigation of elder abuse or by a county protective services agency for investigation of suspected abuse of a vulnerable adult.
      4. In response to a request by the designated protection and advocacy agency for the purpose of protecting and advocating the rights of a person with developmental disability or mental illness.
      5. To a county department, a sheriff or police department or a district attorney for purposes reporting suspected child abuse.
      6. In response to a request by a county department, a sheriff or police department or a district attorney for purposes investigating suspected child abuse/neglect or for purposes of prosecution of alleged child abuse/neglect, if the person conducting the investigation or prosecution identifies the subject of the record by name.
      7. To school district employee or agent, if the employee or agent has responsibility for preparation or storage of patient health care records or if access to the patient health care records is a requirement of state or federal law.
      8. To the Department of Health Services or to a sheriff, police department or district attorney for investigation of death of patients related to the uses of physical restraints or psychotropic medications or suicides.
      9. To a coroner, deputy coroner, medical examiner, or medical examiner assistant for purposes of completing a death certificate.
      10. To a funeral director for medical certification of cause of death on death certificate.
      11. To a coroner, deputy coroner, medical examiner or medical examiner assistant for purposes of reporting and investigating deaths which are unexplained, unusual or suspicious, homicides, suicides, deaths following an abortion, deaths due to poisoning, and deaths following accidents.
      12. To the appropriate organ procurement organization, disclosure may be made regarding patient deaths.
      13. To the police department or county sheriff’s office, disclosure must be made regarding gunshot wounds, any wound if there is reasonable cause to believe that wound occurred as the result of a crime, and burns if there is reasonable cause to believe that the burn occurred as a result of a crime.
      14. To the local health officer or to the Department of Health Services, disclosure may be made regarding:
          1. Communicable disease cases and deaths (including all reportable conditions listed in Chapter HFS 145, Appendix A);
          2. Sexually transmitted disease cases;
          3. Sexually transmitted disease cases in which there has been cessation or refusal of treatment.
      15. To the state epidemiologist, disclosure may be made regarding positive HIV test results and persons significantly exposed.
      16. To the Wisconsin Department of Health Services, disclosure may be made regarding:
          1. Birth defects;
          2. Lead poisoning cases;
          3. Induced abortions;
          4. Cancer and precancerous cases;
          5. Deaths of patient admitted to any facility or unit providing treatment of alcoholic, drug dependent, mentally ill or developmentally disabled persons for which there is reasonable cause to believe that the death was related to the use of physical restraint or a psychotropic medication or that the death was a suicide; and
          6. Caregiver misconduct.
      17. To the U.S. Food and Drug Administration, disclosure may be made regarding adverse device and drug events.
      18. To a Worker’s Compensation carrier for a person who has filed a Worker’s Compensation claim.

4. Uses and Disclosures Permitted by Law

   (Note: the minimum necessary standard applies to the following uses and disclosures.)

   1. To the Wisconsin Department of Transportation, disclosure may be made regarding impaired drivers (report must be made by a physician).
   2. To law enforcement officials (or another person reasonably able to prevent or lessen the threat), disclosure may be made regarding serious or imminent threats to the health or safety of a person or the public.
   3. To researchers if the IRB has granted a waiver of authorization.
   4. To a prisoner’s health care provider, the medical staff of a prison or jail in which a prisoner is confined, or the receiving institution intake staff at a prison or jail to which a prisoner is being transferred.
5. The disclosures of PHI in the categories listed above in I. and II., including verbal disclosures, must be included in an accounting of disclosures, if requested by a patient (see UW-119 Requests by Patients for an Accounting of Certain Disclosures).
6. Contact the UW-Madison Privacy Officer with questions about the need for patient authorization for other types of disclosures.

Consequences for Non-Compliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such non-compliance.

Further, the US Department Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s non-compliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into Corrective Action Plans and Resolution Agreements. Failures to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.

Supporting Tools

Additional information may be found at www.compliance.wisc.edu/hipaa.

45 C.F.R. § 164.510

Policy Administration

06-13-2014: Effective date of the revised policy: 06-13-2014.
03-26-2020: Effective date of the revised policy: 03-26-2020.

Which situation would require a written authorization from a patient to disclose the PHI?

What is the release of PHI?