Home

  • Home
    • » e-Newsletters

Rely on minimum necessary when confronted with acquaintances' PHI

HIPAA Training Advisor, March 8, 2007

Although the privacy rule has made employees more cognizant of how to behave professionally in the workplace around their colleagues, patients, and other individuals, it poses a challenge for those hospital employees who see someone seeking treatment whom they know personally (e.g., relatives, friends, neighbors, and acquaintances).

Adding to the confusion, there are no exact stipulations in the privacy rule or in the minimum necessary clause that explicitly state how health professionals should treat a patient that is also an acquaintance, says William Roach, an attorney at McDermott Will & Emery LLP, in Chicago.

When dealing with this issue, refresh your memory about the basic privacy requirements of HIPAA, he says. For example, if you know that a relative is seeking treatment at your facility, do not access his or her PHI unless it is in the course of treatment or in other authorized situations. If you have gained authorized access to an acquaintance's PHI, use the minimum necessary rule to determine how to use or disclose this information-the same as you would for any other patient, Roach adds.

Turn to best judgment, policies
Resort to your best judgment if confronted with a patient that you are acquainted with in some way. Adhere to HIPAA standards and guidelines in addition to any rules created and defined by your organization.

"In dealing with patients they know, employees should follow their institution's HIPAA policies and should treat those patients no differently than they would any other patient with respect to use or disclosure of PHI," Roach advises. "The threshold question should be whether the employee may properly use or disclose any of the patient's information."

For example, a pediatrics nurse will likely have no need to access the PHI of an adult patient and friend in the hospital for open heart surgery. If the nurse disclosed to the patient during a visit that he or she had knowledge that could only have been obtained by reading the patient's chart, the patient would have a reasonable basis for a complaint to the hospital. The situation could become even more sensitive in the cases of HIV and other sexually transmitted diseases, mental illness, and alcoholism.

However, if the nurse is in the cardiac rehab division and was a member of the patient's treatment team, the employee would have a need to know what information is in the chart and could have access to it without patient authorization because the use is for treatment.

"Once an employee has determined under the employer's policies that he or she may use or disclose the patient's PHI, the employee must determine how much of that PHI may be used or disclosed," Roach says. Look to organizational policies to determine what the minimum PHI necessary is for the circumstances. If your organization has no explicit or targeted guidelines about how to respond to patients with whom employees are acquainted, encourage your compliance officials to develop them.      

"If employee judgment is not always sound, the covered entity should consider additional employee training concerning the minimum necessary rule or a review of its policies and procedures," Roach says.

Know the minimum necessary rule  
However, keep things flexible. "While such guidelines are certainly helpful, they should be flexible so as to accommodate all situations. If people are constantly in violation of organizational guidelines, then they are too rigid," Roach says.

"As long as the guidelines around the minimum necessary rule remain consistent within an organization's mission, employers should continue to value and support employee decisions and good judgment," he adds.           

In all cases, treat patients with professional sensitivity and consideration, and give them the benefit of your professional judgment. When using or disclosing PHI, or when requesting PHI from a source outside of your organization, you must make reasonable efforts to limit the information to the minimum amount necessary.    

"It's not a crystal clear rule-the guidance is enough to encourage people to exercise good judgment," Roach says. The rule is purposely loose in order to allow professionals decision-making authority and to prevent any problems that might emerge with more rigid standards, he adds.   

Because the minimum necessary guidelines are loose, employee judgment is paramount in determining how to work with PHI. More rigid principles may compromise the integrity of the patient, the employee, or both. However, do not let your relationship with a patient get in the way of your judgment. Consider the minimum necessary rule as the overarching principle over all other workplace directives, Roach suggests. It should guide you in the decision-making process.

Understand how minimum necessary applies
The minimum necessary rule applies differently to routine and non-routine requests for disclosures. Although it applies to both, your organization must adopt policies covering routine requests (e.g., subpoenas), which give specific guidance as to how much PHI is to be disclosed. For non-routine requests, covered entities must develop criteria for determining in each instance how much PHI should be disclosed.      

For routine requests, then, employees should simply apply the policy. For non-routine requests, employees must review the criteria and exercise reasonable judgment to determine how much PHI is appropriate for responding to each request. Typically, organizations rely on their employees' judgment in interpreting such policies and determining the minimum amount of necessary information.   

But although the rule requires all organizations to establish policies, it permits them to create their own policies and procedures to fit their particular size and complexity. "The minimum necessary rule is quite flexible and allows covered entities to tailor their polices and criteria to their own operations. It also gives covered entities the discretion to rely on the determination of others in several circumstances," Roach says.   

"The minimum necessary rule is problematic because the determination of what constitutes 'minimum necessary,' is a judgment call. The best judgments often rely on carefully prepared policies," he adds.

Fortunately, you do not have to make these judgments in all situations. The minimum necessary rule does not apply in the following situations:

  • Treatment. Releasing PHI from one clinician to another is acceptable as long as the information is used for the patient's treatment.
  • Release to the patient. The minimum necessary rule also does not apply when releasing information to the patient because the patient has the right to receive his or her own PHI, with some exceptions (e.g., psychotherapy notes).
  • Patient authorization. The minimum necessary rule also does not apply if a patient authorizes disclosure of information to certain parties.
  • Data reporting. Lastly, the rule does not apply to organizations reporting data for compliance purposes.

Most Popular