With regard to individually identifiable health information, use means the sharing, examination, utilization, employment, or analysis of the information within Department of Social Services (DSS). Disclosure means the release, transfer, provision of access to, or divulging information outside of DSS.
An individual’s medical records such as hospital and doctor reports and medical claims are confidential. Release of these medical records requires a signed authorization from the participant or the participant’s personal representative in order for the Family Support Division (FSD) to receive these records. Staff use a form to get the authorization for the release of protected information. In some instances, the participant may give the records to staff. How staff use or disclose this information determines whether further authorization from the individual is needed.
In general, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) covers health plans, health care clearinghouses, and health care providers. Health plans include the MO HealthNet (MHN) program. For the most part, HIPAA allows covered entities such as the DSS, including FSD, to use or disclose Protected Health Information (PHI) for purposes of treatment, payment or health care operation without requiring the participant’s authorization. Using PHI to determine MHN eligibility falls within treatment, payment or health care operations.
- MHN Eligibility Purposes: No further authorization from the participant is required if staff use the information to establish MHN eligibility. Such purposes include determining disability, pregnancy, blindness, need for emergency care (MHN for illegal aliens), medical insurance premiums, incurred medical expenses, and uninsured status for MHN under the Children’s Health Initiative or the Breast or Cervical Cancer Treatment program.
Releasing the minimum necessary PHI to a MHN provider to allow the provider to charge for provided services (see first bullet under 0130.005.10.05 Minimum Necessary) requires no further authorization from the participant.
- Purposes Other than the MHN Program: If staff use the PHI to determine eligibility for a DSS program, no further authorization from the participant is required. Examples include but are not limited to:
- obtaining medical reports to document abuse to establish good cause for not cooperating in child support collections for a Temporary Assistance participant
- using medical records to verify a person’s disability to exempt the individual from the Supplemental Nutrition Assistance Program (SNAP) work registration requirement
- utilizing medical records to verify a child’s special needs for Child Care
- using physical or mental health records to determine a person’s disability to exempt him or her from the job requirements of the Temporary Assistance program
If staff need to disclose PHI for a non-MHN purpose, a DSS Authorization for Disclosure of Consumer Medical/Health Information (HIPAA) form may be needed.
- Authorization is not required: No authorization is required to disclose information when all of the following are met:
- staff is referring a participant to a government program or staff is coordinating with the government program; AND
- the government program is providing public benefits; AND
- the participant’s referral to or participation in that government program is necessary in order to determine eligibility for the FSD program.
An example is when staff refer a Temporary Assistance participant to Missouri Work Assistance or share information with Disability Determinations. Although no authorization is required, such disclosures are subject to certain tracking or reporting requirements as identified in 0130.005.10.30 Accounting for Disclosures of Protected Health Information.
- Authorization Required: If no exception is met above, an authorization is required. The following is an example of when the form is required:
Staff get PHI to determine Permanent and Total Disability and an exemption from the Temporary Assistance job requirements. The participant has severe financial, medical, and housing problems. Staff call a private charitable organization and advises the organization of the participant’s financial problems to include the immediate need for medication to treat diabetes. Disclosure of the medical information (diabetes information) to the organization violates HIPAA unless the client completed the DSS Authorization for Disclosure of Consumer Medical/Health Information (HIPAA) form. In this example, staff should have obtained the participant’s authorization or withheld the PHI.
In this example, an option to avoid disclosure issues would be to address a letter to the participant. Let the letter confirm that the participant needs assistance.
- Other disclosures of PHI which do not require an authorization are:
- To the individual
- To a public health authority (for example, sharing information with the Missouri Department of Health and Senior Services who is conducting a public health surveillance, investigation or intervention)*
- To report child abuse or neglect*
- To the United States Food and Drug Administration (FDA) for purposes concerning quality or effectiveness of such FDA regulated products or activity*
- To a health oversight agency that is authorized by law to conduct audits, investigations, inspections and other activities for oversight of health care systems, certain government programs, etc. (e.g. the United States Department of Health and Human Services conducts periodic reviews and audits of the Medicaid program)*
- To respond to court orders or subpoenas and discovery requests. Staff should immediately scan a copy of such requests to MHN Program and Policy at COLE.MHNPOLICY@dss.mo.gov. Central Office will consult with the DSS Privacy Officer or legal counsel*
- To law enforcement officials as required by law or pursuant to a court order, a court-ordered warrant, or a subpoena or summons issued by a judicial officer; a grand jury subpoena; or an administrative request, such as an administrative summons or a civil investigative demand; for purposes of identifying or locating a suspect, fugitive, material witness, or missing person; or regarding a crime victim. Unless there is court order or directive, staff cannot disclose the client’s address simply because the person is a fugitive felon. If it is a SNAP or Temporary Assistance case, consult the appropriate manual to see under what circumstances an address can be released on a fugitive felon.*
- To avert a serious threat to health or safety e.g., staff contacts the local police department to request assistance to prevent or lessen serious or imminent threats*
- For national security purposes
- As required by law such as in legal proceedings in which the participant is represented by an attorney or legal aid*
- To family and friends involved in the person’s healthcare (refer to 0130.005.10.40 Who May Exercise Privacy Rights and Personal Representatives)
The above releases marked with an asterisk (*) are subject to the tracking requirements found in 0130.005.10.30 Accounting for Disclosures of Protected Health Information.
Staff must also obtain an authorization for any use or disclosure of psychotherapy notes except for program operations such as MHN determinations or when used by FSD in defending itself in litigation or other legal proceedings brought by the participant.