I.          PURPOSE

This policy is designed to inform Creighton employees, faculty, residents, students and agents (collectively referred to herein as "health care providers") within any of the Health Sciences Schools (Medicine, Nursing, Dentistry, and Pharmacy and Allied Health) of their obligation to maintain the confidentiality of individually identifiable patient medical, dental, nursing, pharmacy, physical therapy and occupational therapy records or health information which is obtained in the course of treatment (hereinafter referred to as "protected health information" or “PHI”) and the circumstances when such information can be released.  This policy does not address mandatory reporting requirements.

II.        POLICY

Confidentiality of health information is the right of each patient seeking health care through Creighton or its partners in health care.  All PHI (both written and verbal) within the Creighton Health Sciences Schools, and locations where services are provided by Creighton employees, faculty, residents, students and agents is strictly confidential.  Disclosure of confidential PHI to any unauthorized person is prohibited.

III.       SCOPE

This policy applies to all Creighton employees, faculty, residents, students and agents who have access to, or knowledge of, PHI.

IV.       PROCEDURES

A.                 Confidentiality of Patient Information and Patient Records

1.         General Requirements.  Maintaining the confidentiality of protected health information and patient records is essential.  Generally, access to patient health records is limited to the patient, the patient's health care provider, authorized representatives of the patient, third party payors and other health care providers with a legitimate treatment, payment or health care operational in the health record.  Protected health information should not be disclosed or released without appropriate authority as outlined in this policy (Section B & C - Release of Confidential Patient Information).

Creighton employees, faculty, residents, students and agents shall only access PHI when there is a legitimate need for the information.  No one shall allow unauthorized individuals access to PHI.

2.         Physician-Patient Privilege.  Under Nebraska law, confidential communications between the patient and physician (and other involved in treatment, including health care providers under the physician's supervision and the patient's family) regarding the patient's physical, mental and/or emotional condition are protected from unauthorized disclosure.  The patient, the patient's guardian or conservator, or the personal representative of a deceased patient may claim this privilege.  The physician may also claim the privilege on the patient’s behalf.

The physician-patient privilege does not apply to communications:

a.                   Relating to proceedings to hospitalize the patient if the physician deems it necessary;

b.                  Concerning the condition of the patient in a legal proceeding (such as a lawsuit) where the patient has relied on that condition as an element of a claim for relief;

c.                   Regarding injuries to children, incompetents, or disabled persons, which are required for adjudication in a court proceeding;

d.         Concerning an attempt to obtain a controlled substance; and

e.                   Concerning child abuse or a wound caused by violence used as evidence in a judicial proceeding.

B.        Release of Patient Records

1.                  Generally.  The patient's record contains sensitive and confidential information and should only be released or disclosed in limited circumstances.  PHI should only be released or disclosed to:

a.       Individuals involved in the patient's care, for treatment purposes;

b.      Providers with a treatment relationship with the patient, for purposes of treatment, payment, or health care operations;

c.       Third party payors, for purposes of payment and health care operations related to quality assessment and improvement, case management, evaluating plan performance, training, accreditation or licensure, or fraud and abuse compliance,

d.      Where required by law;

e.       As authorized in writing by the patient or his/her legal representative.  All written authorizations to release patient information should be maintained in the patient's medical record.

2.         Release of Patient Record or Health Information to a Third Party. The patient controls the release of his/her patient record or health information, unless otherwise authorized by law.  Except as otherwise provided by law or Creighton policy, a patient's health record or health information shall only be disclosed or released to a third party to the extent allowed by a valid written authorization. 

a.         A written authorization is required from:

            1)         A competent adult or emancipated minor to release his/her patient records.

2)         A minor for treatment consented to by the minor as allowed by state law (i.e., treatment for sexually transmitted diseases, etc.).

3)         A parent or guardian to release records of an unemancipated minor (under the age of 19 in Nebraska, and under the age of 18 in Iowa), except those records pertaining to treatment consented to by the minor as allowed by state law.

4)         A legal guardian or designated power of attorney to release an incompetent adult's patient records.

5)         The personal representative of a deceased patient to release the deceased patient's patient records.

b.         The written authorization must be either on the Creighton University Form, “Authorization for Release of Health Information,” which is attached to this policy as Attachment “A,” the Nebraska Model Authorization Form, which is attached to this policy as Attachment “B,” or any other form approved by the University Privacy Officer.

3.         Release Pursuant to a Valid Subpoena:  A subpoena is a legal document issued by a state or federal court in a civil or criminal matter. If you are served with a subpoena for records or testimony regarding a patient, contact either the General Counsel's office (280-5589) or the University Privacy Officer (280-3469) immediately.

4.         Court Orders, Search Warrants, Federal Grand Jury Subpoenas. If you are served with a court order, search warrant or federal grand jury subpoena for records or testimony regarding a patient, contact either the General Counsel's office (280-5589) or the University Privacy Officer (280-3469) immediately.

5.         Requests of Law Enforcement. Contact the General Counsel’s office or the University Privacy Officer if you receive a request from a law enforcement official, a correctional institution, the U.S. Department of State or Secret Service regarding a patient. 

6.         Release to Parents of an Unemancipated Minor.  Each parent has the right to full and equal access to the minor's health records, except: (a) Records relating to treatment consented to by the minor as allowed by law; or (b) Where a court order has been issued specifically restricting a parent(s) right to the minor's health care information.  Records related to treatment for which the minor provided consent as authorized by statute shall not be released to the minor's parents without the minor's written authorization.  Examples of treatment for which a minor may provide consent: drug and alcohol abuse evaluation, treatment and counseling; evaluation and treatment for sexually transmitted diseases.

            7.         Drug and Alcohol Abuse Records.  Drug and alcohol abuse information and records maintained in connection with, or received from a federally assisted drug or alcohol abuse program shall only be disclosed as provided by federal law.  42 USC §290dd-3 and 290ee-3 and 42 CFR 2.1-2.67.

8.         Mental Health Records.  Mental health medical records (defined by state statute as "medical records or parts thereof created by or under the direction or supervision of a licensed psychiatrist, a licensed psychologist, or a mental health practitioner licensed or certified pursuant to sections 71-1,295 to 71-1,338") may be withheld from the patient if any treating physician, psychologist, or mental health practitioner determines, in his/her professional opinion, that release of the mental health records would not be in the best interest of the patient, UNLESS the release is required by court order.  Specific policies may be developed to address the special protection afforded to mental health records (i.e., see written policy of the Department of Psychiatry, School of Medicine).

            9.         Release to Patient. Creighton owns the medical record.  Only copies of requested medical records should be released, except as required by law or court order.  Only copies of X-rays or other non-paper media should be released whenever feasible.  If any original records are released, there should be a tracking system to prevent loss. The following procedures shall be followed upon receipt of a patient's valid written request for copies of, or access to, his/her medical records:

a.         Request for Copies:  Provide the patient with copies of his/her medical record within thirty (30) days following receipt of the request.

a.                   Request to Examine:  Within ten (10) days of receipt of the written request, do one of the following          

1)         Allow the patient access to the records during regular business hours for purposes of examining them;

2)         Notify the patient that the records cannot be found or do not exist;

3)         If another provider maintains the records, inform the patient of the name and address of the provider maintaining such records, if known; or

4)         Give the patient written notice of the reason for any delay in providing access and when the patient will be able to examine the records.  If this last action is taken, you must let the patient examine the records within twenty-one (21) days from the date the written request is received.

See Section 8 above regarding release of mental health medical records requested by the patient.

10.       Copy Charges:  Copy charges for medical records requested by the patient,or under a subpoena by a patient or his/her authorized representative shall not exceed the following:

                        1)         $.50 per page

                        2)         Postage, if applicable; and

                        3)         The reasonable costs, including labor, of copying nontraditional records (x-rays, etc.)

            Unless otherwise provided by law, you may charge the above fees to a state or federal agency that requests medical records in relation to a patient's application for benefits or assistance or an appeal relating to denial of such benefits or assistance under: Nebraska Aid to Dependent Children, Nebraska Medicaid Program, or Titles II, XVI, or XVIII of the federal Social Security Act.

            No charges shall be made to patients seeking copies of medical records in support of an application for disability or other benefits or assistance or an appeal relating to the denial of benefits or assistance under: Nebraska Aid to Dependent Children, Nebraska Medicaid Program, or Titles II, XVI, or XVIII of the federal Social Security Act.

V.                             DEFINITIONS

“Health care operations” means all those activities listed in the definition of this term found in 45 C.F.R. 164.501. It includes activities related to:

a.       quality assessment and improvement activities;

b.      reviewing the competence or qualifications of heath care providers;

c.       evaluating provider and health plan performance;

d.      underwriting, premium rating and other activities related to health insurance;

e.       activities related to fraud and abuse detection and compliance programs;

f.        business planning and development;

g.       customer service and complaint investigation.

VI.                          Enforcement and Discipline

Disciplinary action for breaches of confidentiality shall be taken in accordance with the University's progressive disciplinary policy for Creighton employees.  Disciplinary action for breaches of confidentiality by faculty, students or residents shall be determined at the Department level.   Disciplinary action will be based upon the severity and/or frequency of the violation.

VII.     ADMINISTRATION AND INTERPRETATIONS

Questions regarding this policy may be addressed to General Counsel, the University Privacy Officer, the Health Sciences Vice President, Medical Dean, and/or their staff.

VIII.    AMENDMENTS OR TERMNATION OF THIS POLICY

This policy may be amended or terminated at any time.

IX.       REFERENCES