With regard to individually identifiable health information, use means the sharing, examination, utilization, employment, or analysis of the information within DSS. Disclosure means the release, transfer, provision of access to, or divulging information outside of DSS.
An individual’s medical records such as hospital and doctor reports and medical claims are confidential. Release of these medical records requires a signed authorization from the claimant or the claimant’s personal representative in order for FSD to receive these records. Staff uses a form such as the IM-60 to get the authorization for the release of protected information. In some instances, the claimant may give the records to staff. How staff uses or discloses this information determines whether further authorization from the client is needed.
In general, HIPAA covers health plans, health care clearinghouses, and health care providers. Health plans include the Medicaid program. For the most part, HIPAA allows covered entities such as the Department of Social Services, including FSD, to use or disclose PHI for purposes of treatment, payment or health care operation without requiring the client’s authorization. Using PHI to determine Medicaid eligibility falls within treatment, payment or health care operations.
- Medicaid Eligibility Purposes: No further authorization from the client is required if staff uses the information to establish Medicaid eligibility. Such purposes include determining disability, pregnancy, blindness, need for emergency care (Medicaid for illegal aliens), medical insurance premiums, incurred medical expenses, and uninsured status for the MC+ under the Children’s Health Initiative or the Breast Cervical Cancer Treatment Medical Assistance Program.
Releasing the minimum necessary PHI to a Medicaid provider to allow the provider to charge for provided services (see first bullet under 0130.005.10.05 Minimum Necessary above) requires no further authorization from the client.
- Purposes Other than the Medicaid Program: If staff uses the PHI to determine eligibility for a DSS program, no further authorization from the client is required. Examples include but are not limited to:
- obtaining medical reports to document abuse to establish good cause for not cooperating in child support collections for a Temporary Assistance claimant;
- using medical records to verify a person’s disability to exempt the individual from the Food Stamp work registration requirement;
- utilizing medical records to verify a child’s special needs for Child Care;
- using physical or mental health records to determine a person’s disability to exempt him or her from the job requirements of the Temporary Assistance program.
If staff needs to disclose PHI for a non-Medicaid purpose, a DSS Authorization for Disclosure of Health Information form may be needed.
- Authorization is not required: No authorization is required to disclose information when all of the following are met:
- staff is referring a client to a government program or staff is coordinating with the government program; AND
- the government program is providing public benefits; AND
- the client’s referral to or participation in that government program is necessary in order to determine eligibility for the FSD program.
An example is when staff refers a Temporary Assistance claimant to the state Workforce Development or shares information with Disability Determinations. Although no authorization is required, such disclosures are subject to certain tracking or reporting requirements as identified in 0130.005.10.30 Accounting for Disclosures of Protected Health Information.
- Authorization Required: If no exception is met above, an authorization is required. The following is an example when the form is required:
Staff gets PHI to determine Permanent and Total Disability and an exemption from the Temporary Assistance job requirements. The client has severe financial, medical, and housing problems. Staff calls a private charitable organization and advises the organization of the client’s financial problems to include the immediate need for medication to treat diabetes. Disclosure of the medical information (diabetes information) to the organization violates HIPAA unless the client completed the DSS Authorization for Disclosure of Health Information form. In this example, staff should have obtained the client’s authorization or withheld the PHI.
In this example, an option to avoid disclosure issues would be to address a letter to the client and give it to him and her. Let the letter confirm that the client needs assistance.
- Other disclosures of PHI which do not require an authorization are:
- To the individual;
- To a public health authority (for example, sharing information with the Missouri Department of Health and Senior Services who is conducting a public health surveillance, investigation or intervention);*
- To report child abuse or neglect;*
- To the United States Food and Drug Administration for purposes concerning quality or effectiveness of such FDA regulated products or activity;*
- To a health oversight agency that is authorized by law to conduct audits, investigations, inspections and other activities for oversight of health care systems, certain government programs, etc., (for example, the United States Department of Heath and Human Services conducts periodic reviews and audits of the Medicaid program);*
- To respond to court orders or subpoenas and discovery requests. Staff should immediately fax a copy of such requests to IM Program and Policy. Central Office will consult with the DSS Privacy Officer or legal counsel;*
- To law enforcement officials as required by law or pursuant to a court order, a court-ordered warrant, or a subpoena or summons issued by a judicial officer; a grand jury subpoena; or an administrative request, such as an administrative summons or a civil investigative demand; for purposes of identifying or locating a suspect, fugitive, material witness, or missing person; or regarding a crime victim. Unless there is court order or directive, staff cannot disclose the client’s address simply because the person is a fugitive felon. If it is a Food Stamp or Temporary Assistance case, consult the appropriate manual to see under what circumstances an address can be released on a fugitive felon;*
- To avert a serious threat to health or safety e.g., staff contacts the local police department to request assistance to prevent or lessen serious or imminent threats;*
- For national security purposes;
- As required by law such as in legal proceedings in which the client is represented by an attorney or legal aid;*
- To family and friends involved in the person’s healthcare (refer to 0130.005.10.40 Who May Exercise Privacy Rights and Personal Representatives).
The above releases marked with an asterisk (*) are subject to the tracking requirements found in 0130.005.10.30 Accounting for Disclosures of Protected Health Information.
Staff must also obtain an authorization for any use or disclosure of psychotherapy notes except for program operations such as Medicaid determinations or when used by FSD in defending itself in litigation or other legal proceedings brought by the client.