Emergency Preparedness, HIPAA and Medical Records

Generally speaking, government legislation allows permissible disclosures that covered entities must make to respond to patients during times of crisis. For example, did you know that health plans and health care providers may disclose prescription information and other health information to other health care providers at shelters to facilitate the treatment of evacuees?

The use of Business Associate Agreements as a part of your Emergency Preparedness Plan is also strongly encouraged. Click here for guidelines and a sample version of an agreement.

Providers and health plans covered by the Privacy Rule can share patient information in the following ways:

• TREATMENT – Health care providers can share patient information as necessary to provide treatment.
  
  • Treatment includes:
    
    • sharing information with other providers (including hospitals and clinics)
      
    • referring patients for treatment (including linking patients with available providers in areas where the patients have relocated)
      
    • coordinating patient care with others (such as emergency relief workers or others that can help in finding patients appropriate health services)
      
    • Providers can also share patient information to the extent necessary to seek payment for these health care services.
      

       

• NOTIFICATION – Health care providers can share patient information as necessary to identify, locate and notify family members, guardians, or anyone else responsible for the individual’s care of the individual’s location, general condition, or death.
  
  • The health care provider should get verbal permission from individuals, when possible; but, if the individual is incapacitated or not available, providers may share information for these purposes if, in their professional judgment, doing so is in the patient’s best interest.
    
  • Thus, when necessary, the hospital may notify the police, the press, or the public at large to the extent necessary to help locate, identify or otherwise notify family members and others as to the location and general condition of their loved ones.
    
  • In addition, when a health care provider is sharing information with disaster relief organizations, like the American Red Cross, that are authorized by law or by their charters to assist in disaster relief efforts, it is unnecessary to obtain a patient’s permission to share the information if doing so would interfere with the organization’s ability to respond to the emergency.
    

     

• IMMINENT DANGER – Providers can share patient information with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public — consistent with applicable law and the provider’s standards of ethical conduct.
  

   

• FACILITY DIRECTORY – Health care facilities maintaining a directory of patients can tell people who call or ask about individuals whether the individual is at the facility, their location in the facility, and general condition. Of course, the Privacy Rule does not apply to disclosures if they are not made by entities covered by the Privacy Rule. Thus, for instance, the Privacy Rule does not restrict the American Red Cross from sharing patient information.
  

For more emergency preparedness tips and techniques, click on the resources below.

Work Cited

U.S. Department of Health & Human Services. (n.d.). Disclosures for Emergency Preparedness – A Decision Tool. Retrieved November 12, 2012, from U.S. Department of Health & Human Services: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/emergency/decisiontoolintro.html