Corporate Compliance

Q&A: Census takers want PHI

Compliance Monitor, June 9, 2010

Q: I am the records manager at a behavioral health facility, and I have received calls from census workers requesting PHI about facility patients beginning April 1, 2010. Must we provide this information?

A: You are only required to provide the information if patients in your facility specifically authorize the release of such information to census workers. Most states have enacted laws that specially protect mental health information; 42 CFR Part 2 also provides special protection for any alcohol- and chemical dependency–related information.

HIPAA does not specifically allow covered entities to disclose PHI to census workers. Such action is neither a listed exception nor is considered disclosure for treatment, payment, or healthcare operations. This is the first U.S. census since the HIPAA Privacy Rule became effective; much confusion has ensued.

Providing PHI to census workers would not be considered disclosure for public health purposes, release for healthcare oversight, or release for judicial and administrative procedures, for example. Therefore, HIPAA does not appear to allow any facility to share any PHI with census workers absent specific patient authorization.

Chris Apgar, CISSP answered this question in the June 2010 issue of the HCPro newsletter Briefings on HIPAA. For more information about this newsletter visit the HCMarketplace.

Most Popular