Patient Request for Protected Patient Health Information

Section 2 - EMERGENCY OPERATIONS

PURPOSE:

To ensure that all patients treated by Maitland Fire Rescue are apprised of their rights with regard to PHI and that Maitland Fire Rescue provides the necessary tools to facilitate patient requests.

Notice of Privacy Practices (NPP)

Maitland Fire Rescue field providers will furnish a copy of Maitland Fire Rescue’s NPP to the patient at or prior to treatment in non-emergency situations and as circumstances permit after treatment in an emergency. In non-emergency situations only, field personnel should attempt to get a signed acknowledgement from patient or note why a signature was not obtained.

Non-emergency Transport

• Provide a copy of the NPP to the patient.
• Indicate on your trip sheet that a copy has/has not been given to the patient, family member or with hospital staff.
• Have the patient sign an Authorization/Acknowledgement form.
• An authorized personal representative of the patient may sign on the patient’s behalf.
• If no signature can be obtained, please explain reason.

Emergency Transport

• Indicate on your trip sheet that a copy has/has not been given to the patient, family member or with hospital staff.
• You do not need the patient to acknowledge receipt of NPP.
• Be sure you obtain any other necessary signatures if possible.
• If unable to obtain patient’s signature, please provide reason.
• A copy of the NPP will be provided to the transported patient by mail after the incident has occurred.

Refusals of Care

• Provide a copy of the NPP to the patient.
• Indicate on your trip sheet that a copy has/has not been given to the patient, family member or with hospital staff.
• Have the patient sign the Refusal form.

Patient Access, Amendment or Restriction to PHI

• Only information contained in the Designated Record Set (DRS) outlined in this policy is to be provided to patients who request access, amendment and restriction on the use of their PHI in accordance with the Privacy Rule and the Privacy Practices of Maitland Fire Rescue.

Patient Access

• Upon presentation to the business office, the patient or appropriate representative will complete a Request for Access Form.
• The Department employee must verify the patient’s identity, and if the requestor is not the patient, the name of the individual and reason that the request is being made by this individual. The use of a driver’s license, social security card, or other form of government-issued identification is acceptable for this purpose.
• The completed form will be presented to the Privacy Officer for action.
• The Privacy Officer will act upon the request within 30 days, preferably sooner. Generally, the Department must respond to requests for access to PHI within 30 days of receipt of the access request, unless the designated record set is not maintained on site, in which case the response period may be extended to 60 days.
• If Maitland Fire Rescue is unable to respond to the request within these time frames, the requestor must be given a written notice no later than the initial due date for a response, explaining why Maitland Fire Rescue could not respond within the time frame and in that case Maitland Fire Rescue may extend the response time by an additional 30 days.
• Upon approval of access, the patient will have the right to access the PHI contained in the DRS outlined below and may make a copy of the PHI contained in the DRS upon verbal or written request.
• The business office may establish a reasonable charge for copying PHI for the patient or appropriate representative.
• Patient access may be denied for the reasons listed below, and in some cases the denial of access may be appealed to Maitland Fire Rescue for review.
• The following are reasons to deny access to PHI that are not subject to review and are final and may not be appealed by the patient:
  • If the information the patient requested was compiled in reasonable anticipation of, or use in, a civil, criminal or administrative action or proceeding;
  • If the information the patient requested was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.
• The following reasons to deny access to PHI are subject to review and the patient may appeal the denial:
  • If a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person;
  • If the protected health information makes reference to another person (other than a health care provider) and a licensed health professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to that person;
  • If the request for access is made by a requestor as a personal representative of the individual about whom the requestor is requesting the information, and a licensed health professional has determined, in the exercise of professional judgment, that access by you is reasonably likely to cause harm to the individual or another person.
  • If the denial of the request for access to PHI is for reasons a, b, or c, then the patient may request a review of the denial of access by sending a written request to the Privacy Officer.
  • Maitland Fire Rescue will designate a licensed health professional, who was not directly involved in the denial, to review the decision to deny the patient access. Maitland Fire Rescue will promptly refer the request to this designated review official. The review official will determine within a reasonable period of time whether the denial is appropriate. Maitland Fire Rescue will provide the patient with written notice of the determination of the designated reviewing official.
  • The patient may also file a complaint in accordance with the Procedure for Filing Complaints About Privacy Practices if the patient is not satisfied with Maitland Fire Rescue’s determination.
• Access to the actual files or computers that contain the DRS that may be accessed by the patient or requestor should not be permitted. Rather, copies of the records should be provided for the patient or requestor to view in a confidential area under the direct supervision of a designated Maitland Fire Rescue staff member. UNDER NO CIRCUMSTANCES SHOULD ORIGINALS OF PHI LEAVE THE PREMISES.
• If the patient or requestor would like to retain copies of the DRS provided, then Maitland Fire Rescue may charge a reasonable fee for the cost of reproduction.
• Whenever a patient or requestor accesses a DRS, a note should be maintained in a log book indicating the time and date of the request, the date access was provided, what specific records were provided for review, and what copies were left with the patient or requestor.
• Following a request for access to PHI, a patient or requestor may request an amendment to his or her PHI, and request restriction on its use in some circumstances.

Patient Amendment

• The patient or appropriate requestor may only request amendment to PHI contained in the DRS. A Request for Amendment Form must be accompanied by any request for amendment.
• Maitland Fire Rescue must act upon a Request for Amendment within 60 days of the request. If Maitland Fire Rescue is unable to act upon the request within 60 days, it must provide the requestor with a written statement of the reasons for the delay, and in that case may extend the time period in which to comply by an additional 30 days.
• All requests for amendment must be forwarded immediately to the Privacy Officer for review.

Granting Requests for Amendment

• If the Privacy Officer grants the request for amendment, then the requestor will receive a letter indicating that the appropriate amendment to the PHI or record that was the subject of the request has been made.
• There must be written permission provided by the patient so that Maitland Fire Rescue may notify the persons with whom the amendments need to be shared. Maitland Fire Rescue must provide the amended information to those individuals identified by having received the PHI that has been amended as well as those persons or business associates that have such information and who may have relied on or could be reasonably expected to rely on the amended PHI.
• The patient must identify individuals who may need the amended PHI and sign the statement in the Request for Amendment form giving Maitland Fire Rescue permission to provide them with the updated PHI.
• Maitland Fire Rescue will add the request for amendment, the denial or granting of the request, as well as any statement of disagreement by the patient and any rebuttal statement by Maitland Fire Rescue to the designated record set.

Denial of Requests for Amendment

• Maitland Fire Rescue may deny a request to amend PHI for the following reasons:
  • if Maitland Fire Rescue did not create the PHI at issue
  • if the information is not part of the DRS
  • the information is accurate and complete.
• Maitland Fire Rescue must provide a written denial, and the denial must be in plain language stating the reason for the denial; the individual’s right to submit a statement disagreeing with the denial and how the individual may file such a statement; a statement that, if the individual does not submit a statement of disagreement, the individual may request that the provider provide the request for amendment and the denial with any future disclosures of the PHI; and a description of how the individual may file a complaint with the covered entity, including the name and telephone number of an appropriate contact person, or to the Secretary of Health and Human Services.
• If the individual submits a “statement of disagreement,” the provider may prepare a written rebuttal statement to the patient’s statement of disagreement. The statement of disagreement will be appended to the PHI, or at Maitland Fire Rescue’s option, a summary of the disagreement will be appended, along with the rebuttal statement of Maitland Fire Rescue.
• If Maitland Fire Rescue receives a notice from another covered entity, such as a hospital, that it has amended its own PHI in relation to a particular patient, the ambulance service must amend its own PHI that may be affected by the amendments.

Patient Restriction

• The patient may request a restriction on the use and disclosure of their PHI.
• Maitland Fire Rescue is not required to agree to any restriction, and given the emergent nature of our operation, we generally will not agree to a restriction.
• ALL REQUESTS FOR RESTRICTION ON USE AND DISCLOSURE OF PHI MUST BE SUBMITTED IN WRITING ON THE APPROVED DEPARTMENT FORM. ALL REQUESTS WILL BE REVIEWED AND DENIED OR APPROVED BY THE PRIVACY OFFICER.
  

If Maitland Fire Rescue agrees to a restriction, we may not use or disclose PHI in violation of the agreed upon restriction, except that if the individual who requested the restriction is in need of emergency service, and the restricted PHI is needed to provide the emergency service, Maitland Fire Rescue may use the restricted PHI or may disclose such PHI to another health care provider to provide treatment to the individual.

• The agreement to restrict PHI will be documented to ensure that the restriction is followed.
• A restriction may be terminated if the individual agrees to or requests the termination. Oral agreements to terminate restrictions must be documented. A current restriction may also be terminated by Maitland Fire Rescue as long as Maitland Fire Rescue notifies the patient that PHI created or received after the restriction is removed is no longer restricted. PHI that was restricted prior to Maitland Fire Rescue voiding the restriction must continue to be treated as restricted PHI.

Accounting

To provide guidance to management and staff concerning the patient’s right to an Accounting and the types of uses and disclosures of PHI for which Maitland Fire Rescue is required to document.

• All patient records will be kept by Maitland Fire Rescue for a period of six (6) years from the date of service.
• All patient accounting requests should be received directly from a patient or personal representative.
• Maitland Fire Rescue will provide a list of uses and disclosures of the patient’s PHI, made by Maitland Fire Rescue or by a Business Associate on Maitland Fire Rescue’s behalf, for the last six (6) years or to the extent that Maitland Fire Rescue has maintained that patient’s information if less than six (6) years.
• All uses and disclosures of a patient’s PHI, made by Maitland Fire Rescue, must be documented for accounting purposes except:
  • Disclosures to carry out treatment, payment and health care operations;
  • For national security or intelligence purposes;
  • Uses and disclosures incident to an unaccountable use or disclosure;
  • That occurred prior to the compliance date.
• A common use or disclosure that must be accounted for and information provided upon a request for accounting is the disclosure of PHI in response to a subpoena, summons or warrant.

Patient Complaints

Patients have the right to complain to the Department about any concerns they may have concerning patient privacy. Any patient or family member who expresses a concern or complaint to you should be directed to contact the Privacy Officer. The Privacy Officer is responsible for receiving, investigating, and documenting all complaints from patients concerning patient privacy issues.