|
Maintaining privacy of Protected Health Information (PHI) is an important part of providing quality health care to TRICARE beneficiaries. Understanding the rules that govern the release of PHI is essential in maintaining the security and confidentiality of PHI and will reduce the risk of unauthorized disclosure.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) permits the release of PHI without an authorization for purposes of treatment, payment and health care operations. However, the HIPAA Privacy Rule requires providers to reasonably limit the amount of information disclosed for payment and health care operations to the minimum necessary.
PHI is any individually identifiable health information that relates to a patient’s past, present or future physical or mental health and related health care services. PHI may include demographics, documentation of symptoms, examination and test results, diagnoses and treatments.
Do I need a patient’s written authorization to send a copy of the patient’s medical record to a specialist or other health care provider who will treat the patient?
No. Providers may disclose PHI to another health care provider for treatment purposes. However, treatment information may not be disclosed in cases of substance abuse, mental health treatment or other specifically protected health conditions.
If a patient is a minor or is not competent to make health care decisions, may I release information to the parent or guardian?
Depending upon state laws, providers may or may not release a minor’s information to parents or guardians without a minor’s consent. If the patient is unconscious or incompetent, whether a minor or not, the provider may use their professional discretion; or in the case of minors, the guardian or other person authorized to act on the patient’s behalf may give the consent.
TRICARE offers training in HIPAA compliance. For more information about PHI and other HIPAA issues, visit TRICARE's Privacy Web site.
|