Here’s a reminder from Ballad Health’s Compliance Department about patients’ Protected Health Information (PHI).
Patients have the option to exercise their privacy right to request limits on the use or disclosure of their Protected Health Information (PHI).
Request for Restrictions
All requests should be submitted in writing and reviewed to determine if Ballad Health can comply with the request per the Patient/Resident Restriction Request of the Use and/or Disclosure of Protected Health Information Ballad Health policy IM-900-021.
The Ballad Health-approved Patient Request for Restriction of the Use and/or Disclosure of Their Protected Health Information form MS-7004 should be utilized for restriction request.
When a request is accepted or approved
Once a patient requested restriction is accepted/approved, that restriction must be complied with throughout Ballad Health. Examples of types of reasonable restrictions that we have received and accepted in the past are: opt-out of the facility directory, objection to disclosing PHI to family members and friends, request of an alternative form of communication of their PHI (mail, phone message, etc.).
What is Break the Glass (BTG)?
This refers to the process of accessing patient information for patients whose visits are systematically marked as restricted. BTG should not be presented to patients as a way to restrict access to their medical record, as that is not what BTG does. Applying BTG to patient records does not prevent someone from accessing a patient’s record and it does not prevent information from being shared on a “need to know” basis. It does require the Epic user to provide a reason why they are accessing the record.
Privacy monitoring and access reviews are functions performed by the Ballad Health Corporate Compliance department. Any privacy concerns you or a patient have that are related to access should be reported to Corporate Compliance for follow-up per the Reporting Potential or Actual Breaches of Patient Protected Health Information Ballad Health policy IM-900-026.
Remember:
It is the patient’s right to request a copy of the Notice of Privacy Practices (NPP) to learn about their privacy rights and how their PHI may be used and disclosed.
If you have a HIPAA question or concern, please contact:
- HIPAA Privacy and Security Officer
- Donna.Coomes@balladhealth.org
- 423-302-3401
