Under the leadership of Medical Records Manager, Salma Malimar, the medical records department has created an update Release of Information (ROI) form. This new document provides more clear instructions to patients, an expiration date, and updated language for the method of release, and consent to e-mail transmission of PHI. Since the correct completion of an ROI is critical to justify the release of information, it is still recommended that all main clinic ROIs be signed in consultation with medical records personnel at the time of their visit.

Recall that an ROI is not necessary when it involves treatment, payment, or health care operations. This includes:

• Consultation between providers regarding a patient and referral of a patient by one provider to another.
• Communication with a health plan to determine or fulfill responsibility for coverage and provision of benefits, or to obtain payment or reimbursement for health care delivered to an individual.
• Providing information pertaining to quality assessment and improvement activities, case management, care coordination, credentialing, accreditation, audits, and compliance programs.

The HIPAA Privacy Rule at 45 CFR 164.510(b) specifically permits covered entities to share information that is directly relevant to the involvement of a spouse, family members, friends, or other persons identified by a patient, in the patient’s care or payment for health care. If the patient is present, or is otherwise available prior to the disclosure, and has the capacity to make health care decisions, the covered entity may discuss this information with the family and these other persons if the patient agrees or, when given the opportunity, does not object. The covered entity may also share relevant information with the family and these other persons if it can reasonably infer, based on professional judgment, that the patient does not object. Under these circumstances, for example:

• A doctor may give information about a patient’s visual limitations to a family member driving the patient home from their appointment.
• A staff member may discuss a patient’s payment options with her adult daughter.
• A doctor may instruct a patient’s roommate about proper medicine dosage when she comes to pick up her friend from a medical eye appointment.
• A doctor may discuss a patient’s treatment with the patient in the presence of a friend when the patient brings the friend to an appointment and asks if the friend can come into the exam room.

In order for the medical records department to properly identify documents pertaining to testing information performed on a patient prior to scanning into the EHR, it must include the:

• Patient’s name
• Patient’s date of birth
• Date of service on which testing was completed
• Designation of which eye was tested, if applicable. For example, an Amsler grid finding.

In order for all personnel within a covered entity to be fully informed about their HIPAA responsibilities, it is important they are aware of the location of all current HIPAA privacy and security policies. College of Optometry faculty and staff can access the policies at: I:\CLINIC\HIPAA and students can access the policies at: S:\CLINIC\HIPAA. Additionally, all clinic faculty, staff, and interns have access in the Clinic Resources folder on the clinic desktop

We have always highlighted our HIPAA Privacy Officer, now Matt Jewett and Alex Vu, our HIPAA Security Officer, as your onsite resources to report any concerns relative to a potential breach of HIPAA compliance. The university also has a resource allowing anonymous and confidential reporting of any unethical or inappropriate activities or behavior in violation of OSU policies, including those that may relate to HIPAA. Call 1-866-294-9350 or click https://secure.ethicspoint.com/domain/media/en/gui/7689/index.html to access the anonymous system.