**PATIENT PRIVACY POLICY OVERVIEW**

The Privacy Act (45CFR5b) regulations affect the routine manners in
which we maintain and control private information of our patients. We
must protect the privacy of individuals to the fullest extent possible
while permitting the exchange of records to efficiently carry out the
objectives of the mission of the Laboratory of Pathology (LP) compatible
with the purpose for which the records are collected and maintained.
This policy applies to employees, contractors, and volunteers who work
with private information in LP; but may also be shared with healthcare
providers and their patients to assist them in understanding why
information is collected and how it is used.

**EXAMPLES OF PROTECTIONS/CONTROLS FOR DISCLOSING\
PRIVATE INFORMATION ON LP PATIENTS**

+----------------------+-----------------------------------------------+
| **Disclosure         | **Protections / Controls**                    |
| Method**             |                                               |
+----------------------+-----------------------------------------------+
| Collection of        | -   [Privacy Act Notification                 |
| personal information |     Statement](http:/                         |
|                      | /oma.od.nih.gov/ms/privacy/pa-files/0099.htm) |
|                      |                                               |
|                      | -   Requestor of diagnostic tests obtains     |
|                      |     patient consent.                          |
+----------------------+-----------------------------------------------+
| Verbal (e.g., face   | -   Do not disclose private information in    |
| to face)             |     public places (e.g., corridors, elevator, |
|                      |     cafeteria, etc).                          |
|                      |                                               |
|                      | -   A pathologist may use professional        |
|                      |     judgment based on his/her relationship    |
|                      |     with the physician (or patient) when      |
|                      |     releasing information about the patient.  |
|                      |                                               |
|                      | -   A pathologist may choose to request       |
|                      |     written consent from the patient before   |
|                      |     releasing information. See Appendix A &   |
|                      |     B, for forms.                             |
+----------------------+-----------------------------------------------+
| Telephone            | -   Do not disclose private information on    |
|                      |     voice mail or answering machines.         |
|                      |                                               |
|                      | -   Do not disclose information outside the   |
|                      |     department, without consent, if it is not |
|                      |     compatible with the purpose for which the |
|                      |     record was collected.                     |
|                      |                                               |
|                      | -   A pathologist may grant                   |
|                      |     notification/access based on professional |
|                      |     judgment and personal relationship with   |
|                      |     the patient (or patient's physician) when |
|                      |     the identity of the patient can be        |
|                      |     confirmed with particulars that parallel  |
|                      |     the record to which access is being       |
|                      |     sought (e.g., DOB, Case #, SSN, etc),     |
|                      |     when the disclosure of such records is    |
|                      |     for the benefit of the patient. Document  |
|                      |     these actions in patient's chart with a   |
|                      |     written note, or a copy of the FAX        |
|                      |     communication, or use the "Internal       |
|                      |     Authorization for the Release of Medical  |
|                      |     Information/Materials" (Appendix C).      |
|                      |                                               |
|                      | -   See verbal protections (above) for        |
|                      |     related information.                      |
+----------------------+-----------------------------------------------+
| FAX                  | -   Use Secured FAX machines and coversheet   |
|                      |     with confidentiality statement.           |
|                      |                                               |
|                      | -   Confirm fax number is correct.            |
|                      |                                               |
|                      | -   Use CC Fax Coversheet (see Appendix D) to |
|                      |     send facsimiles outside NIH.              |
|                      |                                               |
|                      | -   Send copy of coversheet to Medical        |
|                      |     Records.                                  |
|                      |                                               |
|                      | -   See telephone protections (above) for     |
|                      |     related information.                      |
+----------------------+-----------------------------------------------+
| E-Mail/Intranet      | -   Use encryption and/or password            |
|                      |     protection.                               |
|                      |                                               |
|                      | -   When using password protection, disclose  |
|                      |     password over the phone (not via E-mail). |
+----------------------+-----------------------------------------------+
| Mail/Courier         | -   Do not write private information on the   |
|                      |     outside of a package or envelope.         |
|                      |                                               |
|                      | -   Follow policies in LP Safety Manual for   |
|                      |     shipping diagnostic materials.            |
|                      |                                               |
|                      | -   Mail service and courier contractors must |
|                      |     comply with privacy regulations.          |
+----------------------+-----------------------------------------------+
| LIS/MIS              | -   All users sign confidentiality agreement. |
|                      |                                               |
|                      | -   Future changes will be implemented with   |
|                      |     CRIS activation (replaces MIS) to address |
|                      |     new HIPPA regulations.                    |
+----------------------+-----------------------------------------------+
| Record Sharing and   | -   As directed by pathologist, physician or  |
| Storage              |     the patient, the patient's records        |
|                      |     (reports, slides, blocks, etc) may be     |
|                      |     provided to other healthcare providers,   |
|                      |     for the benefit of the patient; however,  |
|                      |     all actions must be documented per office |
|                      |     procedures.                               |
|                      |                                               |
|                      | -   All records must be locked in cabinets or |
|                      |     locked in a room.                         |
|                      |                                               |
|                      | -   Retain documentation of release of        |
|                      |     records for 5 years or for the life of    |
|                      |     record, whichever is longer.              |
|                      |                                               |
|                      | -   When destroying records containing        |
|                      |     private information, use the secure       |
|                      |     paper-shredding program.                  |
|                      |                                               |
|                      | -   Off site record storage facilities (e.g., |
|                      |     EPL) must comply with privacy             |
|                      |     regulations.                              |
+----------------------+-----------------------------------------------+
| Court Litigation     | -   Release information on NIH patients only  |
|                      |     through the Medical Records Department.   |
|                      |                                               |
|                      | -   Release information on non-NIH patients   |
|                      |     (submitted cases) only after verifying    |
|                      |     that proper patient authorization is      |
|                      |     included.                                 |
+----------------------+-----------------------------------------------+
| Research Requests    | -   Refer to LP Policy: Request for Human     |
|                      |     Biological Materials.                     |
|                      |                                               |
|                      | -   This applies to materials, records, and   |
|                      |     information.                              |
+----------------------+-----------------------------------------------+
| Mission & Management | -   It is okay to discuss private information |
|                      |     to carry out the objectives of the        |
|                      |     mission of LP (e.g., for diagnosis,       |
|                      |     research, training, discussions between   |
|                      |     healthcare providers, etc), which is      |
|                      |     compatible with the purpose for which the |
|                      |     record was collected.                     |
|                      |                                               |
|                      | ```{=html}                                    |
|                      | <!-- -->                                      |
|                      | ```                                           |
|                      | -   Information may be used for the           |
|                      |     management of the LP practice (e.g.,      |
|                      |     monitor service, handle complaints, plan  |
|                      |     or evaluate accreditation activities,     |
|                      |     quality improvement, or for training      |
|                      |     purposes, etc).                           |
|                      |                                               |
|                      | ```{=html}                                    |
|                      | <!-- -->                                      |
|                      | ```                                           |
|                      | -   Information may also be disclosed to      |
|                      |     medical experts for medico-legal          |
|                      |     opinions, for example, in reporting       |
|                      |     adverse incidents. Information may also   |
|                      |     be disclosed to a lawyer for anticipated  |
|                      |     or existing legal proceedings.            |
+----------------------+-----------------------------------------------+
| Patient Contact      | -   A patient should obtain lab results       |
|                      |     through his/her own healthcare provider   |
|                      |     so that they can explain the results in   |
|                      |     the context of their health care;         |
|                      |     however, a patient may access the         |
|                      |     information through the LP.               |
|                      |                                               |
|                      | -   A patient may discuss how LP handles      |
|                      |     information about them, but they should   |
|                      |     speak to their healthcare provider first. |
|                      |                                               |
|                      | -   Review rules regarding parents and        |
|                      |     guardians if they contact you.            |
|                      |                                               |
|                      | -   Refer NIH patients to Medical Records or  |
|                      |     provide appropriate request form          |
|                      |     (Appendix A & B).                         |
+----------------------+-----------------------------------------------+

**DEFINITIONS**

The following definitions are used in this policy:

-   Access means the availability of a record to a subject individual.

-   Disclosure means the availability or release of a record to anyone
    other than the subject individual.

-   Encryption means using one of the technological means to provide
    security for data on information and communication systems.
    Encryption techniques can be used to protect the confidentiality of
    data, to verify its integrity, or even to check the identity of the
    person or device that sent it. The e-mailing of encrypted Privacy
    Act covered data is recommended; however, password protecting a
    document is also acceptable. Call the receiver and let them know
    what the password is (do not include it in the e-mail). This would
    sufficiently secure the document for transmission. If the document
    is only available in hard copy, determine if the personal
    information in it can be redacted in such a way as to hide the
    subject. Otherwise, snail mail (including courier) is the method to
    use. Sending encrypted faxes may be done in the future, but this
    technology is not yet supported at the NIH, Center for Information
    Technology. See "Secure Fax," for more information on sending
    patient information via facsimile.

-   Individual means a living person, and does not mean a business.

-   Maintain means to maintain, collect, use, or disseminate when used
    in connection with the term "record"; and, to have control over or
    responsibility for a system of records when used in connection with
    the term "system of records."

-   Notification means communication to an individual whether he is a
    subject individual.

-   Record means any item, collection, or grouping of information about
    an individual that is maintained, including but not limited to
    slides, blocks, reports, images, documentation, or medical history,
    that contains a patient's name, or an identifying number, symbol, or
    other identifying particular assigned to the individual. When used
    in this part, record means only a record, which is in a system of
    records. For practical purposes any information collected from a
    patient should be treated as confidential and sensitive regardless
    of how it is collected and stored.

-   Responsible Department official means that officer who is listed in
    a notice of a system of records as the system manager for a given
    system of records or another individual listed in the notice of a
    system of records to whom requests may be made, or the designee of
    either such officer or individual.

    -   The system manager listed in the notice of system records is:
        Director, Medical Record Department, Clinical Center (CC),
        Building 10, Room 1N208, 10 Center Drive, Bethesda, MD
        20892-1192.

    -   The NCI Privacy Act Coordinator (vacant positions) may be
        contacted at (301) 496-2999.

    -   Each Clinical Chief or designated supervisor is responsible for
        assuring that employees are informed of their responsibilities
        and periodically reminding them of the requirements of the
        Privacy Act.

    -   The system manager, Kevin Nellis, Clinical Laboratory Manager,
        may be contacted at (301) 594-9532. As the system manager, he is
        responsible for updating the Privacy Act policy and assisting
        the chiefs/supervisors with employee training. He also trains
        the residents and fellows.

    -   The Laboratory Information Systems Administrator, Earle Barnes,
        may be contacted at (301) 496-0551. He is responsible for the
        electronic system of records.

    -   The Archivist, Jesse White, may be contacted at (301) 435-8938.
        He is responsible for maintaining the LP archives and assisting
        each section with release of materials.

    -   The Head of the Medico Legal Section of the Clinical Center
        Medical Records Department, Marty Clement, may be contacted
        at (301) 496-3331.

-   Routine use means the disclosure of a record outside the Department,
    without the consent of the subject individual, for a purpose, which
    is compatible with the purpose for which the record was collected.

Secure Fax Machine means that the equipment is placed in a secure
location to prevent unauthorized access to the information. The LP may
disclose protected health information to another health care provider
for treatment purposes. This can be done by fax or by other means.
Covered entities must have in place reasonable and appropriate
administrative, technical, and physical safeguards to protect the
privacy of protected health information that is disclosed using a fax
machine. Examples of measures that could be reasonable and appropriate
in such a situation include the sender confirming that the fax number to
be used is in fact the correct one for the other physician's office, and
placing the fax machine in a secure location to prevent unauthorized
access to the information. These safeguards protect against any
anticipated threats or hazards to their security or integrity, which
could result in substantial harm, embarrassment, inconvenience, or
unfairness to any individual on whom information is maintained. Use
Secured FAX machines and coversheet with confidentiality statement and
confirm fax number is correct. Use CC Fax Coversheet (see Appendix D) to
send facsimiles outside NIH. Send copy of coversheet to Medical Records.

-   Statistical record means a record maintained for statistical
    research or reporting purposes only and not maintained to make
    determinations about a particular subject individual.

-   System of records means any group of records under the control of
    the Department from which a record is retrieved by personal
    identifier such as the name of the individual, number, symbol or
    other unique retriever assigned to the individual. Single records or
    groups of records, which are not retrieved by a personal identifier,
    are not part of a system of records.

The Privacy Act does not apply to:

-   De-identified (anonymous) information or statistical data sets,
    which do not allow individuals to be identified.

-   Subject's individual records that are not retrieved by that
    individual's name or other personal identifier.

This LP Clinical Services Patient Privacy Policy does not apply to:

-   Court litigation or formal administrative proceedings. The
    availability of such information is governed by applicable
    constitutional principles, rules of discovery, etc. The LP may be
    subpoenaed to provide pathology reports; however, should only
    release information through MRD for NIH patients. For non-NIH
    patients, verify that proper patient authorization is included.

```{=html}
<!-- -->
```
-   Information made available to the general public under the Freedom
    of Information Act. Request made under the FOIA should be referred
    to the NCI Privacy Act Coordinator at (301) 496-2999.

```{=html}
<!-- -->
```
-   HIPPA Security and Privacy Rules. Although HIPPA does not apply to
    Federal entities, the NIH is expected to establish controls that
    parallel the HIPPA regulations, when the new Clinical Research
    Information System (CRIS) replaces the current Medical Information
    System (MIS). Some of the HIPPA standards may affect this policy;
    therefore, this policy may be revised as CRIS strategies are
    implemented. The HIPPA Privacy Rule does not require that all risk
    of protected health information disclosure be eliminated. Covered
    entities must review their own practices and determine what steps
    are reasonable to safeguard their patient information. In
    determining what is reasonable, covered entities should assess
    potential risks to patient privacy, as well as consider such issues
    as the potential effects on patient care, and any administrative or
    financial burden to be incurred from implementing particular
    safeguards. Covered entities also may take into consideration the
    steps that other prudent health care and health information
    professionals are taking to protect patient privacy.

-   Research requests. Requests for human biological materials for
    research are made formally through the Tissue Resource Committee.
    The "Request for Human Biological Materials," an internal LP
    procedure, and the Clinical Center Medical Administrative Series
    M01-1 regulate such requests. The TRC procedures are available by
    contacting the Clinical Laboratory Manager at 594-9532. Web
    resources addressing research requests are provided at
    <http://home.ccr.cancer.gov/lop/Clinical/labres/hbm.asp>

Situations, in which an employee of NIH or a non-NIH health care
provider has a need for a patient's record to perform his/her duties for
the benefit of the patient.

**INFORMATION LIFE CYCLE**

The information life cycle describes how information is collected, used,
and disseminated in the LP and is generally the same throughout the
pathology industry, with the exception that we do not bill for services.

A Privacy Act Notification Statement, pertaining to the collection of
personal information is available online. The notice for Clinical
Research: Patient Medical Records, HHS/NIH/CC is found at:
<http://oma.od.nih.gov/ms/privacy/pa-files/0099.htm> The Privacy Act
only applies to federal records. Therefore, if we don\'t collect the
information from the individual (either directly or through contract
acting on our behalf), there is no need for us to provide the individual
with a privacy act notice. Any such notification would be the
responsibility of the collecting organization in accordance with the
laws or rules that apply to them. However, once we have the record, we
must maintain it in accordance with the laws or rules that apply to
them. However, once we have this record, we must maintain it in
accordance with our published system notice.

Usually a requestor, such as a physician, dental practitioner, or nurse
practitioner makes an order (request) for pathology testing. In some
rare cases, a patient may self refer. The medical request contains the
patient's identifying information and medical history. In some cases,
the medical history may include information about relatives, especially
when genetic information (or testing) is associated with the case. The
requestor needs to obtain a patient's consent to collect information and
specimens necessary for associated functions and activities (e.g.,
linking pathology reports to patients and their health care providers,
ensure proper testing, make a diagnosis and interpret results, fulfill
regulatory requirements, assure quality improvement, etc). Much of the
testing we do is for patients seeking eligibility to enroll in clinical
trials, or for those already enrolled. Research is conducted in clinical
trials according to IRB approved protocols that address privacy and
consent considerations.

When laws and practicality exists, a patient, in some extremely rare
cases, may request the option of either not identifying themselves or
registering under a pseudo-name. Testing a patient in this manner can be
dangerous and an individual doing this should be aware of the potential
consequences that may lead to adverse medical outcomes. In these
situations, diagnosis and advice may be impaired; results may get
mismatched; there may be a consequence of limited liability; health
practices may breakdown, and insurance claims may not be made. For these
same reasons, LP preserves and maintains patient information when
material is forwarded to other pathologists for consultation or
reference lab testing.

There is usually no direct contact between LP and the patient. The LP
may only receive a sample and a request. LP assumes the patient has
consented to the collection and use of personal information whenever a
patient consents to the collection of a specimen. The collection can
occur in many places such as a clinic at NIH, an operating room in the
Clinical Center, or a remote location outside of NIH. At the time of
collection, all specimens are labeled with proper patient
identification. Specimens are then transported to the laboratory by
trained couriers or laboratory personnel. Some patient materials are
shipped by an express mail service or by courier in accordance with
federal shipping regulations.

When a test is requested on a patient at NIH, a specimen order is
usually placed in the Medical Information System (MIS) by the requestor.
When the specimen is received in LP, information is electronically
transferred to the MIS to the Laboratory Information System (LIS). If a
specimen is submitted from outside the NIH, laboratory personnel will
enter the information in the LIS. Some requests may be sent via secured
fax, phoned oral communication, or sent as encrypted (or password
protected) electronic messages to the laboratory. NIH (including LP) is
required to follow regulatory standards regarding the security and
confidentiality requirements for these transmissions. For more
information see:

-   [NIH records
    policies](http://oma.od.nih.gov/ms/records/policy.html#p)

-   [CC Medical Administrative Series M98- 1, Facsimile Transmission of
    Individually-Identifiable, Confidential Medical Record Information
    Maintained Under the Privacy
    act](http://internal.cc.nih.gov/policies/PDF/M98-1.pdf)

-   CC Medical Facsimile Cover Sheet. See Appendix D or
    <http://www.cc.nih.gov/MRD/html_pages/NIH-2781_(2=01).pdf>

Specimens are assigned unique identifiers when they are entered into the
LIS or a specimen logbook when the specimen is prepared for testing. The
LP is divided into multiple Sections, any of which may work on the
patient's sample to provide the final test result(s). In some cases, a
specimen may be referred to a laboratory outside of LP for further
testing. In some cases, the specimen may be shared with another
pathologist within the LP or outside of NIH to help render a diagnosis.

In general, information is used within LP for producing results and
advice and delivering these to the specified health care provider. In
some cases, information may be disclosed to another provider for the
purpose of getting a second opinion or when a specimen is referred to a
more appropriate laboratory. Discussions and consultations can take
place between LP and the requester or other physicians providing care to
the patient. Employees will not disclose private information in public
spaces (e.g., corridor, elevator, cafeteria, etc). Private information
is not disclosed on voice mail or answering machines. Examples of
appropriate delivery of private information includes:

-   When a requestor calls for results.

-   When results are unusual or unexpected and require urgent action or
    physician notification.

-   When a patient seeks a differing opinion, a secondary physician may
    discuss the patient's case with a pathologist in LP. In situations
    such as this, the pathologist uses professional judgment based on
    his or her relationship with the physician (or patient) when
    releasing information about the patient. A pathologist may choose to
    request written consent from the patient before releasing the
    information.

A patient should obtain lab results through his/her own healthcare
provider so that they can explain the results in the context of their
health care; however, a patient may access the information through the
LP. A patient may discuss how LP handles information about them, but
they should speak to their healthcare provider first.

Information may be used for the management of the LP practice. For
example, to monitor service, to handle complaints, to plan or evaluate
accreditation activities such as quality improvement, or for training
purposes, etc. Information may also be disclosed to medical experts for
medico-legal opinions, for example, in reporting adverse incidents.
Information may also be disclosed to a lawyer for anticipated or
existing legal proceedings.

Pathology reports are sent to the requestor and kept on file in LP. If
the patient was seen at NIH or has an NIH medical record number, the
report will also go to the Clinical Center Medical Record of the
patient. Copies of the reports may be directed to others as directed by
the requestor or the patient. Most reports are printed and delivered via
mail or courier; however, some results may be communicated orally over
the phone or sent via secure fax, or sent as encrypted (or password
protected) Email messages. The LP and the NIH follow regulatory
standards regarding the security and confidentiality requirements for
these transmissions. For more information see:

-   [NIH records
    policies](http://oma.od.nih.gov/ms/records/policy.html#p)

-   [CC Medical Administrative Series M98- 1, Facsimile Transmission of
    Individually-Identifiable, Confidential Medical Record Information
    Maintained Under the Privacy
    act](http://www2.cc.nih.gov/policies/PDF/M98-1.pdf)

-   CC Medical Facsimile Cover Sheet. See Appendix D or
    <http://www.cc.nih.gov/MRD/html_pages/NIH-2781_(2=01).pdf>

As directed by a pathologist, a patient's physician or the patient, the
patient's records (reports, slides, blocks, etc) may be provided to
other healthcare providers, for the benefit of the patient; however, all
actions must be documented per office procedures, in such a way that
records can be tracked. All records must be locked in cabinets or stored
rooms that are locked when employees are not present. Documentation of
any release of records is retained for 5 years or for the life of
record, whichever is longer. When records are destroyed a secure
paper-shredding program is used. Off site record storage facilities
(e.g., EPL) comply with privacy regulations.

When records are sent via mail or courier, private information is not
written on the outside of a package or envelope. The LP Safety Manual
contains policies for shipping diagnostic materials. Mail service and
courier contractors must comply with privacy regulations.

The U.S. Federal government funds the LP services. There are occasional
circumstances when specimens are sent to a more appropriate reference
laboratory, in which the Clinical Center will be billed for services.
Under certain rare circumstances, the Clinical Center may disclose
information if they must send bills to a patient or their insurance
companies for debt recovery.

The LP is subject to many other regulations and accreditation standards
other than the Privacy Act. The LP is accredited by the College of
American Pathologists (CAP), the Joint Commission on Accreditation of
Healthcare Organizations (JCAHO), and the Accreditation Counsel of
Graduate Medical Education (ACGME); and, certified by the Clinical
Laboratory Improvement Amendments (CLIA). Because the LP is highly
regulated, it is subjected to ongoing agency inspections that
demonstrate that physical record and electronic information systems are
reliable and secure. The LP restricts access of systems and all users
are required to sign a confidentiality agreement. Most information is
permanently retained in secure locations but may be discarded after the
retention period stipulated by government regulations and accreditation
standards.

**NOTIFICATION OF, OR ACCESS TO RECORDS; & DISCLOSURE OF RECORDS**

An individual living patient (or legal representative) making a request
for notification of communication to another or access to record(s) may
contact either the Medical Records Department (MRD) or the specific
section of LP to specify which system of records he/she wants searched
and the records to which he/she wishes to have access. MRD uses the
request form in Appendix A to carry out this request. The Chief of each
LP Section may use his/her professional judgment to grant notification
or access via the following mechanisms:

-   Refer NIH patient requests to MRD using form NIH-527 (Appendix A).
    Do not refer non-NIH patients (e.g., submitted cases without Medical
    Record Number).

-   Use the LP form, "Authorization for the Release of Medical
    Information/Materials" (Appendix B). This form is recommended when
    identity verification or written documentation is warranted for
    (non-NIH) submitted case material.

-   The LP form, "Authorization for the Release of Medical
    Information/Materials" (Appendix B), may also be used at the
    discretion of the Chief, when a patient or legal representative
    makes the request in person. A patient or legal representative who
    makes the request in person shall provide at least one piece of
    tangible identification such as a driver's license, passport, alien
    or voter registration card, or union card to verify his/her
    identity, if the form is not used. If the form is not used, be sure
    to document the request in the patient's record.

-   The Privacy Act requires a written request when an individual is
    requesting notification or access to sensitive records such as
    medical records; however, due to the routine nature of the pathology
    industry (requestor obtains a patient's consent to collect
    information and specimens), and implied consent when specimens are
    collected, a Section Chief or designated pathologist, may grant
    notification/access based on professional judgment and personal
    relationship with the patient (or patient's physician) when the
    identity of the patient can be confirmed with particulars that
    parallel the record to which access is being sought (e.g., DOB, Case
    #, SSN, etc), when the disclosure of such records is for the benefit
    of the patient. Document these actions in patient's chart with a
    written note, or a copy of the FAX communication, or use the
    "Internal Authorization for the Release of Medical
    Information/Materials" (Appendix C).

-   The CC Medical Facsimile Cover Sheet (Appendix D) may also be used
    to document release of information.

-   The pathologist who signed out the case should review the material
    that is released, whenever slides or blocks are released. If the
    pathologist is not available, refer the request to the alternate
    pathologist covering for the absent pathologist or to the Section
    Chief. Document the release of the material according to the
    procedures of the appropriate section.

If the responsible Section determines that there will be a delay in
responding to a request for any reason, they must inform the individual
and indicate when notification or access will be granted. Routine
expected turn around times are indicated below:

-   Reports only (0-2 business days)

-   Slides and/or blocks (1- 5 business days)

-   Archived material (2 -- 7 business days)

An accounting of all disclosures must be maintained for a period of five
years, or for the life of the record, whichever is longer. Accounting is
not required for situations, in which an employee of LP has a need for a
patient's record to perform his/her duties. If a patient requests an
accounting of disclosures, please contact the NCI Privacy Act
Coordinator to assist with this process.

**PROCEDURE FOR CORRECTION OR AMENDMENT OF RECORDS; AND APPEALS OF
REFUSALS TO CORRECT OR AMEND RECORDS**

Any patient (or legal representative) has the right to request his/her
record be corrected or amended to correct factual information (not
opinions). If this unlikely situation arises, the Section Chief or
designated attending pathologist may make the change based on his/her
professional judgment. The Section Chief may work with the NCI Privacy
Act coordinator to carry out this request, but must respond in writing
to the requestor within a 10-day period. If the patient appeals the
decision, the Section Chief should consult the NCI Privacy Act
coordinator.

**PARENTS AND GUARDIANS**

A parent or guardian of any minor (under 18 years old) or the legal
guardian or any individual who has been declared incompetent due to
physical or mental incapacity or age by a court of competent
jurisdiction is authorized to act on behalf of an individual or subject
individual; however, the parent or guardian cannot be given direct
access to the records. For example, send the materials directly to the
designated physician or pathologist.

Guidelines for proof of legal guardianship:

-   If patient is age 18 years or older and not deceased

    -   Completed Durable Power of Attorney

    -   Patient's medical condition (i.e., Alzheimer's disease, mental
        or physical handicap)

-   If patient is age 18 years or older and deceased

    -   Requestor must be next-of-kin

    -   Examples of proof of death

        -   Death certificate

        -   Obituary notice from paper

        -   Funeral service handout

        -   Executor of the estate document

-   If the patient is a minor

    -   Refer to Medicolegal section of MRD for NIH patients

For non-NIH patients, use the LP form, "Authorization for the Release of
Medical Information/Materials" (Appendix B).

**FEES**

Fees are not charged for release of information from LP; however,
Medical Records, Radiology, and Nuclear Medicine may charge fees to
insurance companies and attorneys, for release of information, if they
are involved in the individual's request.

**STANDARDS OF CONDUCT AND PENALTIES**

-   All employees are required to be aware of their responsibilities
    under the Privacy Act, shall maintain records as accurately as
    practical and only disclose information to those who have a need to
    know in the course of his/her official duties.

-   Employees may be personally subject to disciplinary action, criminal
    liability, or criminal prosecution for knowing and willful
    violations of the Privacy Act, regulations, or NIH policies.

-   LP may be subjected to civil liability for inappropriate actions or
    failure to comply with the Privacy Act.

**OTHER PRIVACY INFORMATION**

For other matters pertaining to privacy information, please refer to the
appropriate information and NCI policies:

-   [NCI web site privacy policy](http://cancer.gov/policies/page3)

-   [Records management
    policies](http://oma.od.nih.gov/ms/records/policy.html#p)

-   [NIH policies](http://www1.od.nih.gov/oma/manualchapters/)

-   [NIH Privacy Act web page](http://oma.od.nih.gov/ms/privacy/)

System Listing for Clinical Research: Patient Medical Records,
HHS/NIH/CC. <http://oma.od.nih.gov/ms/privacy/pa-files/0099.htm> &
<http://oma.od.nih.gov/ms/privacy/>

**REFERENCES**

[Australian Association of Pathology Practices, Inc., "Privacy Policy in
Community Pathology," January 2002, pp.
1-35](http://www.aapp.asn.au/library/Privacy Policy in Community Pathology v1.2.pdf).

[Clinical Center Medical Administrative Series M98- 1, Facsimile
Transmission of Individually-Identifiable, Confidential Medical Record
Information Maintained Under the Privacy
act.](http://internal.cc.nih.gov/policies/PDF/M98-1.pdf)

Tom Carrington, Daniel Sheehan, & Valerie Wampler. Consultation
regarding encrypted Email technology. NIH/CIT. December 2002.

Clinical Center Medical Facsimile Cover Sheet. See Appendix D or
<http://www.cc.nih.gov/MRD/html_pages/NIH-2781_(2=01).pdf>

Clinical Center Medical Records Department, Case Workup Procedure
Number: 4, 2002, pp. 1-11.

[Clinical Center Notice for Clinical Research: Patient Medical Records,
HHS/NIH/CC](http://oma.od.nih.gov/ms/privacy/pa-files/0099.htm).
Clinical Chiefs. Consultation at Clinical Chief's Meeting of the
Laboratory of Pathology, Center for Cancer Research, National Institutes
of Health. August 2002.

[Code of Federal Regulations, Title 45, Part 5b --Privacy Act
Regulations](http://www.gpoaccess.gov/cfr/index.html).

Tom Carrington and Daniel Sheehan. Consultation with NIH/CIT. December
2002.

Tricia Coffey and Marty Clement. Consultation about CC Medical Record
Department policy. July 2002.

Erin Dominick. Consultation about CC billing practices. September 2002.

Noelle Frangipane. Consultation with Privacy Act Coordinator for NCI.
August 2002.

[NCI web site privacy policy](http://cancer.gov/policies/page3)

[NIH policies](http://www1.od.nih.gov/oma/manualchapters/)

[NIH Privacy Act web page](http://oma.od.nih.gov/ms/privacy/)

[NIH records policies](http://oma.od.nih.gov/ms/records/policy.html#p)

[Office for Civil Rigths --HIPPA Medical Privacy -- National Standards
to protect the Privacy of Personal Health Information; OCR Guidance
Explaining Significant Aspects of The Privacy Rule. December 4,
2002.](http://www.hhs.gov/ocr/hipaa/privacy.html)

[Complete guidance
document](http://www.hhs.gov/ocr/hipaa/guidelines/guidanceallsections.pdf)

[Records management
policies](http://oma.od.nih.gov/ms/records/policy.html#p)

Karen Sikes and Timothy Wheeles. Consultation with OM/OA/OMA. December
2002.

[Steven G. Silverberg, "Consultations in Surgical Pathology," *[American
Journal of Surgical Pathology,]{.underline}* Vol. 17, pp.
743-745](http://www.panix.com/~adasp/papers/position/Consultations.htm)

System Listing for Clinical Research: Patient Medical Records,
HHS/NIH/CC. <http://oma.od.nih.gov/ms/privacy/pa-files/0099.htm> &
<http://oma.od.nih.gov/ms/privacy/pa-files/read99systems.htm>

[U.S. Code Title 5, Part I, Chapter 5, Subchapter II, Section 552a.
Records maintained on
individuals](http://www4.law.cornell.edu/uscode/5/552a.html)

  -- ---------------------------------------------------------------------
     

  -- ---------------------------------------------------------------------