2016-698 Emergency Svc - North State Medical Transport - Application for Services Franchise by Ordinance

Browse Search

Policy 20: HIPAA Compliance Officer Action Plan for Administrative Requests for PHI from Government Agencies North State Medical Transport HIPAA Compliance Officer Action Plan: Administrative Requests for PHI from Government Agencies Step 1: Does the federal,state,or local government agency have the authority to YES NO make the administrative request(an administrative request can include an administrative subpoena,summons,civil or other authorized investigative demand or similar process)? Go to Step 2 The HIPAA Compliance Officer should deny the request in The HIPAA Compliance Officer should look to any statutory or regulatory authority cited in writing stating that proper legal authority,demonstrating that the request and consult with legal counsel when making this determination. the agency has the right to request and receive the PHI, must be provided to North State Medical Transport by the administrative agency before the request will be considered. Step 2: Is it clear from the request that all 3 conditions below are satisfied? YES NO 1. The PHI sought by the request is relevant and material to a legitimate law Go to Step 3 The HIPAA Compliance Officer should send the requestor a enforcement inquiry; letter stating that North State Medical Transport will not 2. The request is specific and limited in scope to the extent reasonable practicable in disclose any PHI until the administrative agency certifies in light of the purpose for which the PHI is sought;and writing that the three conditions have been met. 3. De-identified information could not reasonably be used? Step 3: The HIPAA Compliance Officer shall ONLY disclose the PHI that has been requested in the administrative request. The HIPAA Compliance Officer shall also contact the issuer of the request whenever it is unclear what PHI North State Medical Transport is required to disclose. If necessary,the HIPAA Compliance Officer shall ask the requesting agency to re-issue a more specific request. The HIPAA Compliance Officer shall retain a copy of the administrative request as well as any written assurances in the patient file. The HIPAA Compliance Officer shall also track the disclosure in an accounting log and document:the name of requesting agency;the date of the request;the date of disclosure and the PHI that was disclosed.