LOS ANGELES COUNTY
DEPARTMENT OF MENTAL HEALTH
  Policy 500.06 Verification of Individuals Requesting Protected Health Information 
 
  PROCEDURES
  1. REQUESTS OF PROTECTED HEALTH INFORMATION
     
    1. The local DMH program/clinic manager must be responsible for taking steps to ensure that DMH workforce members, including all full or part time paid staff, students, interns and volunteers who handle PHI, appropriately verify the identity and authority of persons requesting access to PHI.
       
    2. DMH workforce members must verify the identity and authority of an individual requesting PHI, unless such individual is already known to the DMH workforce member, through one of the following methods.
       
      1. If the request for PHI is from the individual who is the subject of the PHI, DMH workforce members must verify that the individual is who the individual says he/she is by taking the steps set forth in Section 4.1.2.1 of this policy.
         
      2. If the request for PHI is from the parent or guardian of a minor who is the subject of the PHI, DMH workforce members must verify the identity of the individual requesting the PHI by taking the steps set forth in Section 4.1.2.2 of this policy.
         
      3. If the request for PHI is from the spouse of the individual who is the subject of the PHI or other family member or friend involved in the individual’s care or payment for that care, the requirements set forth in the policy of Use and Disclosure of PHI Requiring an Opportunity to Agree of Object apply and DMH workforce members must consult that policy and comply with its requirements.
         
      4. If the request for PHI is from an individual who claims to be the personal representative of an adult or emancipated minor, DMH workforce members must follow the steps set forth in Section 4.1.3 of this policy.
         
      5. If the request for PHI is from a public official, then DMH workforce members must follow the steps set forth in Section 4.2 of this policy.If the request for PHI is from a source with no known authority, DMH workforce members should not respond without consulting their appropriate supervisor or Program Head.
         
        • Verifying Identity (a) The identity of a person requesting PHI shall be obtained by viewing a valid picture ID in the form of a driver’s license, passport or other state or government issued identification card or pursuant to any other reasonable method to verify identity; (b) The identity of a person requesting PHI over the telephone shall be obtained by asking for name, address or Social Security Number.
           
        • Verifying Authority The authority of an individual requesting PHI may be verified as follows:
           
          • By viewing a signed Authorization Form; or
             
          • By obtaining any documentation, statements or representations, whether oral or written, from the person requesting the PHI, if such documentation, statement or representation is a condition of disclosure.
             
          • Conditions on disclosure as set forth in Section 4.2.3 of this policy are considered satisfied upon receipt of an administrative request, including an administrative subpoena or summons, a civil or an authorized investigative demand or similar process authorized under law that, on its face,demonstrates that (a) the PHI sought is relevant and material to a legitimate law enforcement inquiry, (b) requests specific PHI which is limited in scope to the extent reasonably practicable in light of the purpose for which it is sought, and (c) de-identified information could not reasonably be used.
             
    3. The identify and authority of personal representatives, if not already known, may be verified as follows:
       
    4. If the personal representative claims to be the parent, guardian or acting in loco parentis of an unemancipated minor, DMH workforce members must:
       
      1. Request to see a picture ID; or
         
      2. Ask questions to reasonably determine the identity of the person as a parent, guardian or acting in loco parentis, such as full name of the minor, the minor’s address and Social Security Number.
         
    5. If the person claims to be the personal representative of an emancipated minor or an adult, DMH workforce members must:
       
      1. Request to see a picture ID; or
         
      2. Request to see a Power of Attorney or other legal document (such as a court order), if applicable, granting the person legal authority to make decisions on behalf of the individual.
         
  2. PUBLIC OFFICIAL REQUESTS FOR PROTECTED HEALTH INFORMATION
     
    1. The DMH local clinic/program manager must be responsible for answering requests for PHI from public officials.
       
    2. Identity: DMH workforce members must verify the identity of the public official or person acting on behalf of the public official, through one of the following methods:
       
      1. If the request for PHI is made in person, DMH workforce members must ask to see an agency identification badge, other official credentials or other proof of government status.
         
      2. If the request for PHI is made in writing, the identity of the public official is verified if the request is made on appropriate government letterhead.
         
      3. If the request for PHI is made by a person acting on behalf of a public official, verification of identity can be made through one of the following methods:
         
        1. A written statement on appropriate government letterhead stating that the person is acting under the government’s authority; or
           
        2. Evidence or documentation, such as a contract for services, memorandum of understanding, or purchase order that establishes that the person is acting on behalf of a public official.
           
      4. Authority: DMH workforce members must verify the authority of public officials using one of the following methods:
         
        1. Obtain a written statement of the legal authority under which the information is requested.
           
        2. If a written statement is not practical under the circumstances, obtain an oral statement of the legal authority under which the information is requested, which statement must be documented in the individual’s file; or
           
        3. A request made pursuant to a legal process, warrant, subpoena, order or other legal process issued by a grand jury or an administrative tribunal is presumed to constitute legal authority.
           
  3. EXCEPTIONS TO VERIFICATION REQUIREMENTS
     
    1. The following circumstances do not require verification of identity or authority. (See Policy on Use and Disclosure Requiring an Opportunity to Agree or to Object and Policy on Use and Disclosure for which Authorization and the Opportunity to Agree or Object is Not Required):
       
      1. Emergency circumstances;
         
      2. Use and disclosure to those involved in an individual’s care or payment for that care;
         
      3. Use and disclosure with the individual present;
         
      4. Use and disclosure for disaster relief purposes; and
         
      5. Use and disclosure to avert a serious threat to health and safety.
         
  4. DOCUMENTATION RETENTION

    All documents required to be created or completed by this policy must be maintained in the client’s designated record set for at least seven (7) years.