| Disclosure: The release, transfer, provision of access to, or divulging in any other manner of PHI by an individual within DMH to a person or entity outside DMH.
Minimum Necessary Rule: Health care providers may only access, transmit, or handle the minimum amount of PHI necessary to perform a given task.
Protected Health Information (PHI): Individually identifiable information relating to the past, present, or future physical or mental health condition of a client; provision of health care to a client; or the past, present, or future payment for health care provided to a client.
Use: The sharing, employment, application, utilization, examination, or analysis of PHI within an entity that maintains such information.
Workforce Member: Employees, business associates, contracted employees, consultants, volunteers, other County departments and/or individuals whose conduct in the performance of work for DMH, its offices, programs, or facilities is under the direct control of the Department, office, program, or facility regardless of whether the person is paid or unpaid.
|
| Workforce members shall limit the use and disclosure of PHI to only the minimum necessary needed to accomplish the intended purpose. - Workforce members shall not use or disclose an entire medical record unless they can justify the whole record is needed to meet the intended purpose.
- It is a violation of the minimum necessary rule for a health care provider to access the PHI of clients with whom the provider has no treatment relationship, unless for research purposes (DMH Policy 500.05).
The minimum necessary rule does not apply to: - Disclosures to or requests by a health care provider for treatment;
- Disclosure to an individual who is the subject of the information, or the individual's personal representative;
- Uses or disclosures made pursuant to an authorization;
- Disclosure for Health and Human Services (HHS) Office of Civil Rights (OCR) for complaint investigation, compliance review, or enforcement;
- Uses and disclosures required by law (DMH Policy 500.02); and
- Uses and disclosures required for compliance with the Health Insurance Portability and Accountability Act (HIPAA).
DMH shall designate the workforce member who needs access to PHI and the level of access needed. - Access granted to students and interns shall be determined and monitored by the supervisor on a case-by-case basis.
|
