Uses and Disclosures of Protected Health Information that Require Providing the Patient with an Opportunity to Agree or to Object

Layout for printing
Policy Number:
UW-105
Old Policy Number:
3.4
Responsible Office:
Office of Compliance

University Policy

Rationale/​Purpose:

In enacting HIPAA, Congress mandated the establishment of Federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by state or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a federal floor of safeguards to protect the confidentiality of medical information. State laws that provide stronger privacy protections apply over and above the federal privacy standards.

Definitions:
Disclosure
The release, transfer, provision of access to, or divulging in any manner of protected health information by an individual within the health care component (HCC) or affiliated covered entity (ACE) with a person or entity outside the HCC or ACE.
Protected health information (PHI)
Health information or health care payment information, including demographic information collected from an individual, which identifies the individual or can be used to identify the individual. Protected health information does not include student records held by educational institutions or employment records held by employers.
University of Wisconsin affiliated covered entity (UW ACE)
The UW–Madison health care component (except University Health Services and the State Laboratory of Hygiene), the University of Wisconsin Medical Foundation, and the University of Wisconsin Hospital and Clinics. See UW-101 Designation of UW Affiliated Covered Entity.
UW–Madison health care component (UW HCC)
Those units of the UW–Madison that have been designated by the university as part of its health care component under HIPAA. See UW-100 Designation of UW-Madison Health Care Component for a listing of these units.
Scope:

Applies to all members of the UW HCC.

Policy:

Policy Summary

The HIPAA Privacy Rule requires that patients be provided with an opportunity to agree or object to certain uses or disclosures of their protected health information and, if the patient objects, the use or disclosure may not be made. UW–Madison follows HIPAA regulations regarding when patients must be provided with an opportunity to agree or object to certain uses or disclosures of their protected health information. 

Policy Detail

Under HIPAA, several types of uses and/or disclosures require that the patient be given the opportunity to agree or to object in advance of the use or disclosure and, if the patient objects, the use or disclosure may not be made. UW staff may orally inform the patient of the intended use or disclosure and obtain the patient’s oral agreement or objection, as follows:

  1. Disclosures of PHI to Those Involved in the Care of the Patient and For Notification Purposes

    1. UW HCC staff may disclose a patient’s protected health information to:
      1. A family member, other relative, or a close personal friend of the patient or any other person identified by the patient, the protected health information directly relevant to such person’s involvement with the patient’s care or payment related to the patient’s health care.
      2. Notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the patient, or another person responsible for the care of the patient of the patient’s location, general condition, or death.
    2. The disclosure described above may be made only in accordance with the following procedures:
      1. If the patient is present for, or otherwise available prior to, such disclosure and has the capacity to make health care decisions, UW HCC staff may disclose the protected health information if they:
        1. Obtain the patient’s agreement;
        2. Provide the patient with the opportunity to object to the disclosure and the individual does not express an objection; or
        3. Reasonably infer from the circumstances, based on the exercise of professional judgment, that the patient does not object to the disclosure.

        It is expected that in most circumstances, UW HCC staff will be able to disclose protected health information to those involved in the care of the patient and/or for notification purposes based on options ii or iii above. For example, if the patient allows a family member or friend to be present during treatment, it is reasonable to infer that the patient would not object to disclosures of most types of protected health information to the family member or friend.

        However, if UW HCC staff is aware of circumstances (e.g., “sensitive” diagnoses, dysfunctional family dynamics, etc.) that might result in the patient objecting to such disclosure, staff should obtain the patient’s agreement and document such agreement in the medical record before proceeding with the disclosure.

      2. If the patient is not present, or the opportunity to agree or object to the disclosure cannot practicably be provided because of the patient’s incapacity or an emergency circumstance, UW HCC staff, in the exercise of professional judgment, may determine whether the disclosure is in the best interests of the patient. If so, UW HCC staff may disclose only the protected health information that is directly relevant to the person’s involvement with the individual’s care or payment related to the individual’s health care or needed for notification purposes. Unless circumstances dictate otherwise, it is generally in the patient’s best interest to disclose relevant protected health information to those present, accompanying the patient, or otherwise involved in the patient’s care.

  2. Use and Disclosure of PHI for Notification in Disaster Relief Situations

    UW HCC staff may use or disclose protected health information to a public or private organization authorized by law or its charter to assist in disaster relief efforts, for the purpose of coordinating with such entities for the notification of, or to assist in the notification of (including identifying or locating), a family member, a personal representative of the patient, or another person responsible for the care of the patient of the patient’s location, general condition, or death, as follows:

    1. If the patient is present for, or otherwise available prior to, such use or disclosure and has the capacity to make health care decisions, UW HCC staff may use or disclose the protected health information as described above if they:
      1. Obtain the patient’s agreement;
      2. Provide the patient with the opportunity to object to the use or disclosure and the individual does not express an objection; or
      3. Reasonably infer from the circumstances, based on the exercise of professional judgment, that the patient does not object to the use or disclosure.

      It is expected that in most circumstances, when the patient is present, UW HCC staff will be able to disclose protected health information to disaster relief agencies for notification purposes, based on options B or C above.

      However, if UW HCC staff are aware of circumstances that might result in the patient objecting to such disclosure, staff should obtain the patient’s agreement and document such agreement in the medical record before proceeding with the disclosure.

    2. If the patient is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the patient’s incapacity or an emergency circumstance, UW HCC staff, in the exercise of professional judgment, may determine whether the use or disclosure is in the best interests of the patient. If so, UW HCC staff may disclose only the protected health information that is directly relevant to the person’s involvement with the patient’s health care. Unless circumstances suggest otherwise, it is generally in the patient’s best interest to disclose relevant protected health information for notification purposes to disaster relief agencies.

  3. Uses and Disclosures When the Individual Is Deceased

    If the individual is deceased, UW HCC staff may disclose to a family member or another person as described in I.1.A above (who were involved in the individual’s care or payment for health care prior to death), protected health information that is relevant to such person’s involvement unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

  4. Minimum Necessary Standard

    The minimum necessary standard applies to disclosures made under this policy. See UW-109 Minimum Necessary Standard.

  5. Accounting

    Disclosures made under this policy are not required to be included in the accounting of disclosures to the patient.

Consequences for Noncompliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.

Further, the U.S. Department Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties. 

Supporting Tools

Additional information may be found at www.compliance.wisc.edu/hipaa.

Related UW-Madison Policies:
Related UW–Madison Documents, Web Pages, or Other Resources:
External References:

46 C.F.R. § 164.510

Policy Administration

Approval Authority:
Vice Chancellor for Legal Affairs
Policy Manager:
HIPAA Privacy Officer
Contact:
HIPAA Privacy Officer -- Jack Talaska, JACK.TALASKA@WISC.EDU, (608) 265-4077
Effective Date:
04-14-2003
Revised Dates:

09-22-2014: Effective date of the revised policy: 09-22-2014.
03-26-2020: Effective date of the revised policy: 03-26-2020.

Retrieved:
01-18-2025 16:13:33