click here to download MS Word format

UNIVERSITY POLICY

To establish a policy to ensure UMDNJ’s compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in providing an individual the right to restrict uses and disclosures of Protected Health Information (PHI).

II.       ACCOUNTABILITY

Under the direction of the President, the Deans, Senior Vice President for Administration and Finance, Senior Vice President for Academic Affairs, Vice President for Legal Management, Vice President for Research, Presidents/CEOs of the Healthcare Units and University Hospital Medical Director shall ensure compliance with this policy.

III.     APPLICABILITY

This policy shall apply to health information that is generated during provisions of health care to patients in any of the University’s patient care units, patient care centers or faculty practices as well as Human Subjects research under the auspices of the University or by any of its agents in all UMDNJ Schools, Units, Departments and University owned or operated facilities.

III.     DEFINITIONS

A.       Protected Health Information (PHI) - For a full definition of what constitutes protected health information, see University policy, 00-01-15-15:00, Uses and Disclosures of Health Information With and Without an Authorization.

B.       Designated record set - Medical or billing records about individuals maintained by or for a healthcare provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or records used in whole or in part by or for the provider to make decisions about individuals.

IV.     REFERENCES

A.       Code of Federal Regulations Title 45, Section 164, Part 522, Right to Request Privacy Protection for Protected Health Information

B.       Uses and Disclosures of Health Information
           With and Without an Authorization                                                                00-01-15-15:00

The following policies provides additional and related information:

C.       Standards for Privacy of Individually Identifiable Health Information               00-01-15-05:00

D.       Access of Individuals to Health Information                                                   00-01-15-10:00

V.      POLICY

A.       Requirements:

1.       Units must permit an individual to request that it restrict:

·      uses and disclosures of PHI about the individual to carry out treatment, payment or health care operations (TPO); and

·      disclosures related to involvement in an individual’s care.

The Request for Restriction of Health Information form can be accessed at the following website:  http://www.umdnj.edu/complweb/policies/hipaapols/RequestforRestrictionForm.pdf.

2.       Units may, however, deny the request.

3.       All requests for restrictions and termination of the agreement to restrict must be in writing.

4.       All requests made for restrictions to PHI must be made to the individual designated by the Dean, President/CEO of the Healthcare Unit and/or Unit Privacy Officer.

B.       Responsibilities:

1.       UMDNJ must review all requests that are made by individuals to restrict use and disclosure of the individuals PHI; however, UMDNJ is not required to agree to the restrictions requested if UMDNJ determines that the restrictions would interfere with legitimate treatment, payment or health care operations.

2.       If a unit agrees to an individual’s restriction request, the restriction must be appropriately documented and such documentation be retained.  Also, the restriction must be communicated in a manner as to assure that anyone accessing the information becomes aware of the restriction.  For example, clearly indicate the restriction on the face of the chart or somewhere obvious to anyone accessing the chart.

3.       If a unit agrees to an individual’s restriction request, UMDNJ is not permitted to use or disclose the specified PHI in any manner, except in the event that the individual is in need to emergency treatment and the restricted PHI is needed to provide such treatment.  In this case, the unit may use the restricted PHI or disclose the PHI to a healthcare provider to provide such treatment to the individual.  In this event, UMDNJ must request that such health care provider not further use or disclose the information.

4.       A unit may terminate its agreement to a restriction if:

·      the individual agrees to or requested the termination in writing;

·      the individual orally agrees to the termination and the oral agreement is documented; or

·      the unit informs the individual that it is terminating its agreement to restriction.

5.       In the event that a unit, for any of the above mentioned reasons, terminates the agreement to restriction, the termination is only effective with respect to PHI created or received after it has so informed the individual.

By Direction of the President:

                                                                                               
Vice President for Legal Management

Policy Manual Table of Contents

OPPM Home Page

UMDNJ Home Page