LOS ANGELES COUNTY
DEPARTMENT OF MENTAL HEALTH
  Policy 500.02 Uses and Disclosures of Protected Health Information Not Requiring an Authorization
 
Policy Category:   Administrative
Distribution Level:  Directly Operated
Responsible Party:  Compliance Privacy and Audit Services
 
Approved by Maurnie V. Thomas, Privacy Officer, Jul 07, 2023
 
I.  PURPOSE
 
To specify exceptions when Los Angeles County Department of Mental Health (DMH) is permitted to use and disclose protected health information (PHI) without an authorization from the client upon notifying and discussing the use and disclosure with the client, in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. 

To specify when DMH may use and disclose PHI without an authorization from the client or providing the client with the opportunity for the client to agree or object to the use or disclosure, in accordance with the HIPAA Privacy Rule. 

 
II.  DEFINITIONS
 
Authorization: A document signed by the client or client's legal representative to give DMH permission to use PHI for specified purposes other than treatment, payment, or health care operations or to disclose PHI to a third party.

Covered Entity: A health plan, a health care clearinghouse, or a health care provider, who electronically transmit any health information in connection with transactions for which HHS has adopted standards.

Correctional Institution: Any penal or correctional facility, jail, reformatory, detention center, work farm, halfway house, or residential community program center operated by, or under contract to, the United States, a state, a territory, a political subdivision of a state or territory, or an Indian tribe, for the confinement or rehabilitation of persons charged with or convicted of a criminal offense or other persons held in lawful custody. Other persons held in lawful custody include juvenile offenders adjudicated delinquent, aliens detained awaiting deportation, persons committed to mental institutions through the criminal justice system, witnesses, or others awaiting charges or trial.

Disclosure: With respect to PHI, the release, transfer, provision of access to, or divulging in any other manner of PHI outside of DMH.

Health Care Operations: Any of the following activities of a covered entity that relate to its covered functions:
  • Conducting quality assessment and improvement activities;
  • Reviewing the competence or qualifications of health care professionals;
  • Underwriting (except as prohibited when involving genetic information), enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance of health benefits;
  • Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs;
  • Business planning and development; and
  • Business management and general administrative activities of the covered entity.
Health Oversight Agency: An agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, or an Indian tribe, or a person or entity with legal authority to oversee the health care system or government programs in which health information is necessary and relevant.

Incapacity: A client's current mental state which client is not able to understand and make choices or decisions for self even after the necessary information, advice, and support have been given.

Inmate: A person incarcerated in or otherwise confined to a correctional institution.

Law Enforcement Official: An officer or employee of any agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, an Indian tribe, who is empowered by law to (1) investigate or conduct an official inquiry into a potential violation of law; or (2) prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

Personal Representative: A person authorized (under State or other applicable law, e.g., tribal or military law) to act on behalf of the client in making health care related decisions.  A personal representative includes:
  • A person with health care power of attorney or court appointed legal guardian or Lanterman-Petris-Short (LPS) conservator of an adult or emancipated minor.
  • A parent or legal guardian of an unemancipated minor.
  • An executor or administrator, next of kin, or other family member (if relevant law provides authority) of a deceased client or deceased client's estate.
Protected Health Information (PHI): Individually identifiable health information held or transmitted by DMH or its business associate(s), in any form or medium, whether electronic, paper, or oral. This information relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is reasonable basis to believe the information can be used to identify the individual.

Treatment: The provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a client; or the referral of a client for health care from one health care provider to another.

Use: With respect to PHI, the sharing, employment, application, utilization, examination, or analysis of such information within DMH.

 
III.  POLICY
 
DMH is permitted or required to use or disclose PHI to clients (or personal representative) as described in Code of Federal Regulations.

DMH may use or disclose PHI without the authorization providing that the client (or personal representative) is informed in advance and has the opportunity to agree, prohibit, or restrict the use or disclosure. 

DMH may use or disclose PHI without the authorization or opportunity to agree or object from the client (or personal representative). 

DMH shall verify the identity and authority of the requestor in accordance with the DMH Policy 500.06.


DMH shall not condition the provision of treatment, payment, enrollment in services or eligibility for benefits to an individual on the provision of an authorization. 
 
IV.  PROCEDURES
 
V.  AUTHORITIES

HIPAA, 45 CFR 164.502—Uses and disclosures of protected health information: General rules
HIPAA, 45 CFR 164.508 - Uses and disclosures for which an authorization is required.

HIPAA, 45 CFR 164.510—Uses and disclosures requiring an opportunity for the individual to agree or to object
HIPAA, 45 CFR 164.512—Uses and disclosures for which an authorization or opportunity to agree or object is not required
California Penal Code Sections 11166
California Welfare and Institutions Code Sections 15630-15632
National Security Act of 1947 (United States Code Title 50 Sections 401, et seq.)
United States Code Title 18 Sections 871 and 879
California Civil Code Section 56.1007
 

VI.  ATTACHMENT
 
No Attachments are associated with this policy.