Effective March 15, 2022
1. PROTECTED HEALTH INFORMATION
This Privacy Rule protects all “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. This Privacy Rule calls this information “protected health information (PHI).” MBI Urgent Care is required by law to maintain the privacy of PHI.
“Individually identifiable health information” is information, including demographic data, that relates to: (1) the individual’s past, present or future physical or mental health or condition; (2) the provision of health care to the individual; or (3) the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual. Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number). This Privacy Rule excludes from PHI employment records that MBI Urgent Care maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g.
2. DE-IDENTIFIED HEALTH INFORMATION
There are no restrictions on the use or disclosure of de-identified health information. De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: (1) a formal determination by a qualified statistician; or (2) the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.
3. BASIC PRINCIPLE
A major purpose of the Privacy Rule is to define and limit the circumstances in which MBI Urgent Care may use or disclose an individual’s PHI. MBI Urgent Care may not use or disclose PHI, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing.
4. REQUIRED DISCLOSURES
MBI Urgent Care must disclose PHI in only two situations: (a) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their PHI; and (b) to the federal Department of Health and Human Services (“HHS”) when it is undertaking a compliance investigation or review or enforcement action.
5. PERMITTED USE & DISCLOSURES
MBI Urgent Care is permitted, but not required, to use and disclose PHI, without an individual’s authorization, for the following purposes or situations: (1) To the individual (unless required for access or accounting of disclosures); (2) for treatment, payment, and health care operations; (3) incident to an otherwise permitted use and disclosure; (4) for the public interest and benefit; and (5) as a limited data set for the purposes of research, public health or health care operations. MBI Urgent Care may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.
MBI Urgent Care must obtain the individual’s written authorization for any use or disclosure of PHI that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule. MBI Urgent Care may not condition treatment, payment, enrollment, or benefits eligibility on an individual granting an authorization, except in limited circumstances. An authorization must be written in specific terms. Examples of disclosures that would require an individual’s authorization include: (1) disclosures to a life insurer for coverage purposes; (2) disclosures to an employer of the results of a pre-employment physical or lab test; or (3) disclosures to a pharmaceutical firm for their own marketing purposes. All authorizations must be in plain language and contain specific information regarding the information to be disclosed or used, the person(s) disclosing and receiving the information, expiration, right to revoke in writing, and other data.
7. PSYCHOTHERAPY NOTES
MBI Urgent Care must obtain an individual’s authorization to use or disclose psychotherapy notes with the following exceptions: (1) MBI Urgent Care may use the notes for treatment; (2) MBI Urgent Care may use or disclose, without an individual’s authorization, the psychotherapy notes, for its own training, and to defend itself in legal proceedings brought by the individual, for HHS to investigate or determine MBI Urgent Care's compliance with this Privacy Rule, to avert a serious and imminent threat to public health or safety, to a health oversight agency for lawful oversight of the originator of the psychotherapy notes, for the lawful activities of a coroner or medical examiner or as required by law.
If you have questions about MBI Urgent Care's Privacy Rule, please contact: firstname.lastname@example.org