click here to download MS Word format

UNIVERSITY POLICY

I.        PURPOSE

To establish a policy to ensure UMDNJ’s compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in providing an individual the right of access to inspect and obtain a copy of Protected Health Information (PHI) about the individual in a designated record set.

II.       ACCOUNTABILITY

Under the direction of the President, the Deans, the Senior Vice President for Administration and Finance, the Senior Vice President for Academic Affairs, Vice President for Legal Management, Vice President for Research, Presidents/CEOs of the Healthcare Units, and the University Hospital Medical Director shall ensure compliance with this policy.

III.      APPLICABILITY

This policy shall apply to health information that is generated during provisions of health care to patients in any of the University’s patient care units, patient care centers or faculty practices as well as Human Subjects research under the auspices of the University or by any of its agents in all UMDNJ Schools, Units, Departments and University owned or operated facilities.

IV.     REFERENCES

A.      45 CFR 164.524, Title 45, Code of Federal Regulations, Part 164, Section 524, Security and Privacy, Access of Individuals to Protected Health Information

B.      Privacy Act, 5 U.S.C. 552a

C.      The following policies provide additional and related information:

1.       Standards for Privacy of Individually Identifiable Health Information         00-01-15-05:00

2.       Uses and Disclosures of Health Information
          With and Without an Authorization                                                          00-01-15-15:00

V.      POLICY

UMDNJ and/or its covered entities must provide an individual with the right of access to inspect and obtain a copy of protected health information pertaining to the individual in a designated record set as long as the record is maintained by UMDNJ.  UMDNJ requires individuals to make requests for access in writing.  A copy of the Request for Access to Protected Health Information form may be accessed at the following website:  http://www.umdnj.edu/complweb/policies/hipaapols/RequestforAccesstoPHI.pdf.

A.       Requirements:

1.       UMDNJ and/or its covered entities must provide access to inspect and obtain a copy of an individual’s PHI, except for:

a.       psychotherapy notes

b.       information complied in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding

c.       PHI maintained by UMDNJ that is subject to Clinical Laboratory Improvements Act (CLIA) amendments of 1988 to the extent that CLIA would prohibit an individual’s access to the information in question.

2.       UMDNJ may deny an individual access without providing the individual an opportunity for review in the following circumstances:

Unreviewable Grounds for Denial

a.       The PHI is the subject of one of the items in section V.A.

b.       The PHI was created or obtained by a covered health care provider in the course of research that includes treatment, provided that the individual had agreed to the denial of access at the time consent was given by the individual for participation in the research.  In this instance, the right of access for PHI is temporarily suspended and will be reinstated upon the completion of the research.

c.       The PHI was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.

d.       The PHI that is contained in records that are subject to the Privacy Act, 5 U.S.C. 552a, if the denial of access under the Privacy Act would meet the requirements of that law.

3.       UMDNJ may deny an individual access providing the individual is given a right to have such denial reviewed by a licensed health care professional who is designated by UMDNJ to act as a reviewing official and who did not participate in the original decision to deny in the following circumstances:

Reviewable Grounds for Denial

a.       A licensed health care professional has determined that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person.

b.       The PHI makes reference to another person and a licensed health care professional makes the determination that the access requested is reasonably likely to cause substantial harm to such other person.

c.       The request for access is made by the individual’s personal representative and a licensed health care professional makes the determination that the provision of access to the personal representative is reasonably likely to cause substantial harm to the individual or another person.

B.       Responsibilities:

1.       If the individual has requested a review of a denial, UMDNJ must promptly designate, and refer the request to a licensed health care professional, who was not directly involved in the denial, to review the decision to deny access.  The designated reviewing official, within a reasonable period of time, must determine whether or not to deny the access requested based on the standards put forth in this policy.  UMDNJ must promptly provide written notice to the individual of the determination of the designated reviewing official and take other actions as required to carry out the designated reviewing official’s determination.

2.       UMDNJ and/or its covered entities must act on requests to access PHI within thirty (30) days after receipt of request.  If the request is for PHI not maintained or accessible to UMDNJ on-site, UMDNJ must take action by no later than sixty (60) days from the receipt of such a request.  However, UMDNJ must provide a written statement of the reasons for the delay and the date by which UMDNJ will complete its action on the request.  No other time extensions will be granted in excess of sixty (60) days.

3.       If UMDNJ and/or its covered entities grant the request to access the PHI, in whole or in part, UMDNJ must inform the individual of the acceptance of the request and provide the access requested by:

a.       Providing the access requested

UMDNJ must provide the access requested by individuals, including inspection or obtaining a copy, or both, of the PHI about them in designated record sets.  If the same PHI that is the subject of a request for access is maintained in more than one designated record set or at more than one location, UMDNJ need only produce the PHI once in response to a request for access.

b.       Form of access requested

i.         Must provide the individual with access to the PHI in the form or format requested by the individual, if it is readily producible in such form or format; or in a readable hard copy form or such other form or format as agreed to by UMDNJ and the individual.

ii.        May provide the individual with a summary of the PHI requested, instead of providing access to the PHI, or may provide an explanation of the PHI to which access has been provided, if:

·        The individual agrees in advance to such a summary or explanation.

·        The individual agrees in advance to the fees imposed, if any, by the covered entity for such summary or explanation.

c.       Time and manner of access

i.                  UMDNJ must provide the access, including arranging with the individual for a convenient time and place to inspect or obtain a copy of the PHI; or mailing the copy of the PHI at the individual’s request.  UMDNJ may discuss the scope, format, and other aspects of the request for access with the individual as necessary to facilitate the timely provision of access.

ii.        If the individual requests a copy of the PHI or agrees to a summary or explanation of information, UMDNJ may impose a reasonable cost-based fee, provided that the fee includes only the cost of:

·        Copying the PHI, including the cost of supplies and labor.

·        Postage when the individual requested the copy, summary or explanation to be mailed.

·        Preparing an explanation or summary of the PHI.

d.       If UMDNJ and/or its covered entities deny the request to access the PHI, in whole or in part, UMDNJ must provide the individual with a timely written denial.  The denial must be in plain language and contain:

·        The basis for the denial

·        A statement of the individual’s review rights, including a description of how the individual may exercise such review rights.

·        A description of how the individual may complain to UMDNJ, or the Department of Health and Human Services (DHHS), pursuant to the compliant procedures. The description must include the name, or title, and telephone number of the contact person or office.

e.       If UMDNJ and/or its covered entities do not maintain the PHI that is the subject of the individual’s request for access, and UMDNJ knows where the requested information is maintained, UMDNJ must inform the individual where to direct the request for access.

UMDNJ must document and retain the following information:

·        The designated record sets that are subject to access by individuals.

·        The titles of the persons or offices responsible for receiving and processing requests for access by individuals.

f.        All requests made for access to PHI must be made to the individual designated by the Dean, President/CEO of the Healthcare Unit and Unit Privacy Officer.

By Direction of the President:

                                                                               
Vice President for Legal Management

Policy Manual Table of Contents

OPPM Home Page

UMDNJ Home Page