Privacy

B. Uses and Disclosures for Treatment, Payment and Health Care Operations (TPO)

---

Unless the agency has received a specific written authorization from the consumer for, or applicable law otherwise requires or permits, a particular use or disclosure of protected health information, protected health information may only be used or disclosed for purposes of (i) our agency’s treatment activities, payment activities, and health care operations, and (ii) certain treatment activities, payment activities, and health care operations of other health care providers and of health plans.

Treatment

For purposes of this policy, the term “treatment” means providing, coordinating or managing the consumer’s health care and any related services. Some examples of treatment activities involving the use or disclosure of protected health information are:

• using protected health information about a consumer’s disease or condition to diagnose or provide care to the consumer
• disclosures of protected health information to other health care providers who are involved in taking care of the consumer
• disclosures of protected health information to another health care provider in order to obtain advice about how best to diagnose or provide care to the consumer
• disclosures of protected health information to another health care provider to whom the consumer has been referred to ensure that this health care provider has the necessary information to diagnose or provide care to the consumer

Payment

For purposes of this policy, the term “payment” generally means the activities undertaken by the agency to obtain or provide reimbursement for the provision of health care. Some examples of payment activities involving the use or disclosure of protected health information are:

• disclosing the consumer’s protected health information to a health insurance plan to determine whether it will provide coverage for the consumer’s treatment
• disclosing the consumer’s protected health information to obtain pre-approval before providing a treatment or service, such as admitting the consumer to the agency for a particular type of surgery
• disclosing the consumer’s protected health information to his or her health insurance plan to obtain reimbursement after the agency has treated the consumer

Uses and disclosures of protected health information for the agency’ payment purposes are subject to the HIPAA Privacy Regulations’ "minimum necessary" standard.

Health Care Operations

For purposes of this policy, the term “health care operations” generally refers to those general business and administrative functions of the agency that are required in order to operate and perform its health care functions. Some examples of uses and disclosures of protected health information for health care operations are:

• uses and disclosures of protected health information for quality assurance and utilization review purposes
• uses and disclosures of protected health information for education and training of students and other trainees
• uses and disclosures of protected health information to recommend possible treatment options or alternatives, or health-related benefits or services, that may be of interest to the consumer
• uses and disclosures of protected health information for legal services, business planning, and other business management and general administrative activities
• uses and disclosures of protected health information to raise funds for the benefit of the agency

Uses and disclosures of protected health information for the agency’s health care operations are subject to the HIPAA Privacy Regulations’ "minimum necessary" standard.

Disclosure for Other Persons’ TPO

Our agency also may disclose protected health information to others for their treatment, payment and health care operations as follows:

• Our agency may disclose protected health information to another health care provider for its treatment activities.
• Our agency may disclose protected health information to a health plan or another health care provider for its payment activities.
• Our agency may disclose protected health information to a health plan or another health care provider for its health care operations, but only if
  • (i) both our agency and the other party have, or had, a relationship with the consumer whose information is being disclosed
  • (ii) the protected health information being disclosed pertains to that current (or previous) relationship
  • (iii) the disclosure is for certain limited health care operations activities, including conducting quality assurance and/or quality improvement activities, education or training of students and other staff, reviewing the competence or qualifications, or the performance, of health care professionals, accreditation, licensing, credentialing, and fraud and abuse detection or compliance activities

Disclosures of protected health information for others’ payment activities or health care operations are subject to the HIPAA Privacy Regulations’ minimum necessary standard.

C. De-identified Information Not Subject to TPO Restriction

---

Protected health information is considered “de-identified” when all elements that have the potential to identify the consumer have been removed. Protected health information will be deemed de-identified when (i) a person with appropriate knowledge and experience in scientific and statistical principles for de-identifying information has determined that there is a very small risk that that the information can be used to identify the consumer and has documented the analysis that justifies that decision, or (ii) certain specific identifying elements regarding the consumer and his or her relatives, employers and household members have been removed and the remaining information cannot be used to identify the consumer.

• names
• all geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code and their equivalent geocodes
• all elements of dates (except year) for dates directly related to the individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements (including year) indicative of such age, except that ages and elements may be aggregated into a single category of 90 or older
• telephone numbers
• fax numbers
• electronic mail (e-mail) addresses
• Social Security numbers
• medical record numbers
• health plan beneficiary numbers
• account numbers
• certificate/license numbers
• vehicle identifiers and serial numbers, including license plate numbers
• device identifiers and serial numbers
• World Wide Web Universal Resource Locators (URLs)
• internet protocol (IP) address numbers
• biometric identifiers, including finger and voice prints
• full face photographic images and comparable images
• any other unique identifying number, characteristic or code

Because de-identified information is no longer considered protected health information, such de-identified information is not subject to the TPO restriction and generally may be used and disclosed without limitation. However, agency staff must obtain approval from Peggy Himes, Privacy Officer that protected health information has been appropriately de-identified prior to treating such information as de-identified information.

D. Uses of Protected Health Information for Reasons Other Than TPO

---

Agency staff are instructed to consult their department supervisors if they are unsure whether a particular use or disclosure satisfies the definition of TPO, or if they believe they need to use or disclose protected health information for reasons other TPO and they are unsure whether an exception applies or if the agency has obtained an authorization for that particular use or disclosure. The department supervisors will be responsible for providing guidance or directing the individual to the agency staff member or the department better able to provide the necessary guidance.