Workforce Access to Protected Health Information
The Health Center will limit the access of its workforce members to protected health information to the minimum amount necessary to carry out their job duties. [§§ 164.502(b)(1) & 164.514(d)(2)]
The limitations and requirements set forth in this policy and procedure will not apply to:
• disclosures to or requests by a health care provider for treatment purposes.
• authorized or required disclosures to a patient or a patient’s representative.
• uses or disclosures made pursuant to a valid authorization when the authorization is initiated by the patient or the patient’s representative.
• uses or disclosures to the Secretary of DHHS for enforcing the Privacy Rule.
• uses or disclosures required by law.
• uses or disclosures that are required for compliance with the regulations implementing the other administrative simplification provisions of HIPAA.
Procedure
1. Identification of Workforce and Access Categories. The Health Center will identify the members in its workforce who need access to protected health information to carry out their job duties and, as to each, will identify the categories of protected health information to which access is needed and any conditions appropriate to such access. A case-by-case review of each use is not needed. [§ 164.514(d)(2); OCR Guidance, July 6, 2001]
2. Workforce Directory. The Health Center will maintain a privacy workforce directory that lists by category the Health Center’s current workforce and, as to each, the level of access, the records to which access is authorized, and any conditions that apply. The Health Center may revise this procedure and its privacy workforce directory as may be needed to ensure necessary and appropriate access of its workforce members to protected health information.
3. Access to Entire Medical Record. A member of the Health Center’s workforce may not access a patient’s entire medical record, except when the entire medical record is specifically justified, as indicated in its privacy workforce directory or in a Health Center policy and procedure, as the amount that is reasonably necessary to carry out the workforce member’s job duties. [§ 164.514(d)(2)]
4. Workforce Categories. The Health Center’s privacy workforce directory will include the following workforce categories:
a. Primary Providers – a member of the Health Center’s workforce who is a licensed health care professional or other licensed or registered health care personnel, or a medical student or other health care professional trainee, with patient care duties.
b. Ancillary Providers – a member of the Health Center’s workforce who is a licensed health care professional or other licensed or registered health care personnel, or a medical student or other health care professional trainee, with specifically defined patient care duties.
c. Administrative Staff – a member of the Health Center’s workforce who provides administrative support services relating to patient care, payment or health care operations.
d. Facilities Staff – a member of the Health Center’s workforce who provides support services not relating to patient care, payment or health care operations.
A member of the Health Center’s workforce will have access to protected health information in accordance with the privacy workforce directory without regard to whether the member is employed by the Health Center, is working as a volunteer, or is working pursuant to a contract.
5. Access Categories. The Health Center’s access categories will include:
a. Unrestricted Access – a workforce member with unrestricted access will have full access to a patient’s protected health information, including the patient’s entire medical record, for patient care purposes.
b. Restricted Access – a workforce member with restricted access will have limited access to a patient’s protected health information as described in the workforce directory and as needed to perform his or her job duties. A workforce member in this category may not access or use a patient’s entire medical record, except when the access or use is specifically identified in the directory or in a Health Center policy and procedure as the amount that is reasonably necessary to perform the member’s job duties.
c. Access Prohibited – a workforce member with prohibited access will not have access to any protected health information.
6. Reasonable Efforts. The Health Center will make reasonable efforts to limit access to protected health information to those in its workforce who need access based on their Health Center roles, including undertaking reasonably adjustments to its facilities to appropriately minimize workforce member access. Examples of appropriate adjustments include isolating and locking file cabinets and records rooms or providing additional security, such as the use of passwords or restricting access to certain data fields on computers maintaining personal information. [§ 164.502(b)(1); OCR Guidance, July 6, 2001]
7. Exception for Emergency Treatment Situations. A member of the Health Center’s workforce may use or disclose a patient’s protected health information without regard to restrictions established in this procedure or the Health Center’s privacy workforce directory if the patient is in need of emergency treatment and the information is needed to provide the emergency treatment.
8. Sharing Your Information. The Health Center does not sell, rent or lease its customer lists to third parties. The Health Center may share data with trusted partners to help us perform statistical analysis, send you email or postal mail, provide customer support, or arrange for deliveries. All such third parties are prohibited from using your personal information except to provide these services and they are required to maintain the confidentiality of your information.
Contact Us
If you have any questions about this Policy or our data practices, please contact us at:
Broward Community and Family Health Centers, Inc.
5010-5012 Hollywood Blvd., Hollywood, FL 33021
(954) 624-3200
This policy is designed to provide clear and comprehensive information about how we handle your personal information. We are committed to maintaining your privacy and ensuring that your information is protected.