Orange County NC Website
Browse       Search
State Medical Transport must generally provide all PCRs, all billing records, and any <br /> other information maintained about the patient. The HIPAA Compliance Officer shall <br /> also contact the issuer of the request whenever it is unclear what PHI North State <br /> Medical Transport is required to disclose. If necessary, the HIPAA Compliance Officer <br /> shall ask that the requester re-issue a more specific request. <br /> 3. The HIPAA Compliance Officer shall retain a copy of the court-ordered request and <br /> document the name of the requesting party, the date of the request, the date of <br /> disclosure, and the PHI that was disclosed. <br /> Responding to Administrative Requests from Government Agencies <br /> 1. If the HIPAA Compliance Officer determines that a request for PHI qualifies as an <br /> administrative request (including an administrative subpoena or summons, a civil or an <br /> authorized investigative demand, or similar process) issued by a federal, state, or local <br /> government agency,the HIPAA Compliance Officer should first determine whether the <br /> agency has the authority to make the request and to receive the PHI requested. The <br /> HIPAA Compliance Officer should look to any statutory or regulatory authority cited in <br /> the request and consult with legal counsel when making this determination. If the <br /> HIPAA Compliance Officer determines that the agency does not have the legal authority <br /> to request and receive the PHI requested, the HIPAA Compliance Officer shall send the <br /> requestor a letter stating that North State Medical Transport will not disclose any PHI <br /> until the agency provides North State Medical Transport with a statement citing <br /> appropriate legal authority to request and receive the PHI requested. <br /> 2. If the HIPAA Compliance Officer determines that the agency is authorized by law to <br /> make the request, the HIPAA Compliance Officer must then verify that: <br /> a. The PHI sought by the request is relevant and material to a legitimate law <br /> enforcement inquiry; <br /> b. The request is specific and limited in scope to the extent reasonable and practicable <br /> in light of the purpose for which the PHI is sought; and <br /> c. De-identified information could not reasonably be used. <br /> The HIPAA Compliance Officer should look to the administrative request to determine <br /> whether these conditions are clearly met. If it is not clear from the administrative <br /> request that all three of the above-listed conditions are met, then the HIPAA <br /> Compliance Officer shall contact the administrative agency who issued the request and <br /> inform the agency that PHI will not be released until North State Medical Transport <br /> receives written assurances from the requestor that the conditions are met. <br />