Chancellor’s Office/system Wide Services
Health Information Policy
I. Uses and disclosures of health information
1. Policy Statement
It is the policy of the Chancellor’s Office/System Wide Services Health Care Component (“University”) to inform individuals about the institution’s privacy practices as they relate to health information that may be stored in any campus file or depository, or stored electronically or that exists in any recording device or in any clinical or research data base, hereafter collectively referred to as the “health record,” to safeguard health information in its possession, and, to the extent practicable, to protect the communication of health information, including oral information, from intentional or unintentional use or disclosure. It is further the University’s policy to accommodate, to the extent practicable, requests of individuals regarding the place, time, and method of communicating to them their own health information. For the purposes of compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), employment records and UM System student records subject to the Family Educational Rights and Privacy Act (FERPA) and UM System student medical records, are specifically excluded from the definition of “protected health information.”
2. Policy Purpose
The purpose of this policy is to assure that all individuals are provided with adequate notice of the University’s privacy practices and that our employees treat health information to which they have access whether in oral, written or electronic form, confidentially within each campus and also to those outside the institution.
3. Policy Standards
Health care recipients at the University, including those who are participants in treatment-oriented research and from who protected health information will be obtained, will be provided the campus Notice of Privacy Practices. A good faith effort will be made to receive an acknowledgment of such notice prior to treatment or research. The University will also provide the Notice to participants in the Health Care Advantage Account Plan and the System EAP. The University will not knowingly use or disclose health information in a manner inconsistent with its privacy notice, except in instances where emergency patient care would be compromised. The University reserves the right to amend its Notice of Privacy Practices as deemed necessary and, to the extent and in a manner practicable, will inform health care recipients of these material changes. This policy statement and the Notice of Privacy Practices are official University policies and may not be amended or otherwise altered without the approval of the University of Maine System Privacy Official.
Health information that is communicated in any form is to be treated as confidential and in a manner that reasonably protects the communication from being intentionally or unintentionally overheard or intercepted by those who do not have a need or right to know the information. The University recognizes that in a treatment setting, communications must occur freely and quickly and there can be no assurance of absolute privacy. However, it is the responsibility of the University to implement procedures, to achieve a reasonable degree of confidentiality within its respective departments or divisions, and to establish operating policies and procedures that reasonably protect the confidentiality of oral, written and electronic communications. Written communications that include identifiable health information, medical files, electronic storage devices, fax machines, and other electronic equipment over which protected health information may be read or transmitted are to be maintained in secure sites and/or away from public access. Computer screens containing protected health information are to be inaccessible to public view. Computers that store protected health information are to be secured before being left unattended.
The University will communicate health information to personal representatives authorized by our health care recipients. We will also communicate health information in accordance with state and federal law. The University may, however, communicate health information to persons directly involved in care where necessary due to an emergency or other professionally sound reason without prior authorization.
4. Minimum Necessary Standards
An individual’s health information may only be accessed, used or disclosed by authorized personnel. With the exception of the uses and disclosures of health information directly related to treatment, to the individual, pursuant to an authorization, as required by law and for compliance purposes, and to the extent practicable, access to health information by University employees or other authorized personnel is restricted to the minimum necessary to execute their job responsibilities. It is the responsibility of each University department or administrative unit to identify those persons or classes of persons who are authorized to access, use or disclose health information and specifically to identify what health information they may have access to, and limit their access to that information.
5. Violations
Violations of this policy by any University employee or student which result in or have the potential to result in the unauthorized use or release of identifiable health information, may result in disciplinary action up to and including termination of employment or suspension from a student employment program.
II. Notification and authorization
1. Policy Statement
It is the policy of the University Health Care Component that an individual’s identifiable health information may typically only be used or disclosed pursuant to notification and/or permissions granted by the individual, or unless otherwise permitted or required by statute.
2. Policy Purpose
The purpose of this policy is to assure that identifiable health information is used and disclosed only for the purposes for which an individual has been notified, or where a reasonable attempt of such notification has been made. It may also be disclosed pursuant to the prior written authorization of the individual or, where the information is to be used in research, a waiver of that authorization has been granted by the University’s Institutional Review Board. It may also be disclosed without prior permission where disclosure is required by law.
3. Policy Standards
The University will provide individuals with its Notice of Privacy Practices prior to initial treatment, unless an emergency or a communications barrier makes providing or obtaining this advanced notice and/or acknowledgment impossible orimpracticable. It will also make good faith efforts to obtain the individual’s written acknowledgment and receipt of the Notice. The University will also provide the Notice to participants in the Health Care Advantage Account Plan and the System EAP. Except in emergency situations where patient care might be compromised, the University will not use or disclose identifiable health information in a manner inconsistent with its Notice of Privacy Practices. Only the approved Notice of Privacy Practices may be used for providing notification and no additions, deletions, or modifications may be made to the Notice without the approval of the University of Maine System Privacy Official.
The University allows individuals to request restrictions of the use and disclosure of their health information for treatment, payment and healthcare operations. The University may choose not to agree with the requested restrictions, however, it will adhere to any restrictions to which it agrees. Except where patient care may be compromised, the University may condition provision of services on obtaining acknowledgment of receipt of the Notice of Privacy Practices. Acknowledgments of the Notice of Privacy Practices will be retained by the University for a minimum of six years. Any agreed upon restrictions arising out of the notification will remain in effect until revoked by the individual or until the individual is notified by the University that it will no longer honor the agreed restriction(s).
In the event that the University receives more than one authorization or permission from a patient that appear to be in conflict with each other, the University will abide by the more restrictive patient permission until the conflict is resolved. The University will attempt to determine the true intentions of the individual and thus resolve the issue as soon as practicable. An individual’s health information may be used, or disclosed, by the University for purposes other than treatment, payment, or healthcare operations, such as for research. Use and disclosure for such purposes, except where otherwise required or permitted by law, requires a valid, signed authorization specifically detailing what information will be used or disclosed, how and by whom the information will be used or disclosed, and during what time period the information will be needed or a statement indicating that there is no defined time period.
Only an approved University Authorization Form may be used and no additions, deletions, or modifications may be made without the approval of the University of Maine System Privacy Official. Authorizations are valid only for the conditions outlined in the document and may not be used for any purposes not specifically stated and agreed to by the signing individual. The University will allow an individual to revoke their authorization at any time by submitting a written request. However, any such revocation shall not be retroactive to the extent that the University has already relied and acted on the authorization. A copy of the revocation must be kept with the authorization.
Treatment of an individual at the University may not be conditioned on obtaining a signed authorization, except treatment associated with a research protocol or with treatment performed by a third party. Except where otherwise permitted or required by statute, the requirement to obtain authorization for purposes other than treatment, payment, or healthcare operations may only be waived by the University’s Institutional Review Board (IRB) and in accordance with the Board’s stated policies and procedures.