|
judicial
and administrative proceedings (HIPAA)
HIPAA's Privacy
Rule permits covered entites
to disclose protected
health information (PHI) for judicial and administrative
proceedings:
- in response
to an order of a court or administrative tribunal, provided
that the covered entity discloses only the PHI expressly
authorized by such order; or
- in response
to a subpoena, discovery request, or other lawful process,
that is not accompanied by an order of a court or administrative
tribunal.
The latter is permitted
if the covered entity receives satisfactory assurance from
the party seeking the information that either:
- reasonable efforts
have been made to ensure that the individual who is the
subject of the PHI has been given notice of the request;
or
- reasonable efforts
have been made to secure a qualified protective order that
meets the requirements listed below.
Such assurances require a written statement and accompanying
documentation demonstrating a good faith effort to provide
notice, including:
- within the notice to the individual, sufficient
information about the litigation or proceeding in which
the PHI is requested to permit the individual to raise an
objection to the court or administrative tribunal;
- assurance that
the time for the individual to raise objections to the court
or administrative tribunal has elapsed, and either no objections
were filed or all objections filed have been resolved and
the disclosures sought are consistent with the resolution.
Alternatively,
satisfactory assurances may be met by a written statement
and accompanying documentation that:
- the parties
to the dispute giving rise to the request for information
have agreed to a qualified protective order and have presented
it to the court or administrative tribunal with jurisdiction
over the dispute; or
- the party seeking
the PHI has requested a qualified protective order from
such court or administrative tribunal.
The Privacy Rule
defines a qualified protective order with respect to PHI as
an order of a court or of an administrative tribunal or a
stipulation by the parties to the litigation or administrative
proceeding that:
- prohibits the
parties from using or disclosing the PHI for any purpose
other than the litigation or proceeding for which such information
was requested; and
- requires the
return to the covered entity or destruction of the PHI (including
all copies made) at the end of the litigation or proceeding.
Beyond all this,
a covered entity may disclose PHI in response to a lawful
process without receiving satisfactory assurances of the kind
described, if the covered entity itself makes reasonable efforts
to provide notice to the individual sufficient to meet the
notice requirements listed.
See also:
Last modified:
14-May-2005
[RC]
|
