Ohio Administrative Code › Title 3364 - University of Toledo › Chapter 3364-15 - HIPAA Organizational Structure; Fraud, Waste and Abuse; Compliance and Confidentiality of Patient Information › Section 3364-15-10 - Confidentiality of patient information

Current through all regulations passed and filed through July 1, 2024
(A)
								Policy
			 statement
The university of Toledo ("UToledo")
				requires that all workforce members with access to protected health information
				(PHI) be committed to ensuring that PHI is protected and kept confidential. PHI
				shall be used and disclosed in accordance with applicable laws and UToledo
				policies.
(B)
								Purpose of policy
The purpose of this policy is to
				outline the appropriate use of PHI consistent with the Health Insurance
				Portability and Accountability Act (HIPAA) privacy rule and all updates
				allowing for the use and disclosure of PHI for treatment, payment, or health
				care operations. PHI includes all health and financial information pertaining
				to a patient and the relatives or household members of the patient (rule
				3364-70-05
				of the Administrative Code, protections of human subjects in research for
				confidentiality of research information.)
(C)
								Scope
This policy applies to all UToledo
				covered components (hybrid) and university of Toledo physicians (ACE) and their
				respective workforce members. Healthcare components are determined by the
				privacy and security committee as outline in rule
				3364-15-01
				of the Administrative Code (HIPAA organizational structure and administrative
				responsibilities). The hybrid list is maintained on UToledo privacy
				website.
(D)
								Definitions
(1)
									"Affiliate": a person or entity that performs certain
			 functions or activities that involve the use or disclosure of protected health
			 information on behalf of, or provides services to, a covered entity. A covered
			 health care provider, health plan, or health care clearinghouse can be a
			 business associate of another covered entity.
(2)
									"Covered entity":
			 a health plan, a healthcare clearinghouse or a healthcare provider who
			 transmits any health information in an electronic form in connection with a
			 transaction. See
			 45
			 C.F.R. 160.103 for the few statutory
			 exemptions. See rule
			 3364-15-01
			 of the Administrative Code.
(3)
									"De-identification": in accordance with the HIPAA privacy
			 rule, requires that the expert determination method be used or the following
			 identifiers of the individual or of relatives, employers, or household members
			 of the individual are removed:
(a)
										Name;
(b)
										Street
			 address;
(c)
										City;
(d)
										County;
(e)
										Precinct;
(f)
										Zip
			 code;
(g)
										Gender;
(h)
										Birth
			 date;
(i)
										Admission date;
(j)
										Discharge
			 date;
(k)
										Date of death;
(l)
										Age;
(m)
										Telephone number;
(n)
										Fax
			 number;
(o)
										E-mail;
(p)
										Social security
			 number;
(q)
										Medical record number;
(r)
										Health plan
			 number;
(s)
										Account number;
(t)
										Certificate/license number;
(u)
										Vehicle ID number
			 and license plate;
(v)
										Device identifier;
(w)
										Web location,
			 Internet Address;
(x)
										Biometric identifier;
(y)
										Photographs;
			 or
(z)
										Any unique ID.
Note: Ages over eighty-nine and all
				elements of date (including year) indicative of such age, except that such ages
				and elements may be aggregated into a single category of age ninety or
				older.
(4)
									"Financial information": for the purpose of this policy
			 includes but is not limited to:
(a)
										Health care claims information (including diagnostic
			 and procedure codes, services rendered, and charges associated with those
			 services);
(b)
										Insurance or other payment information;
(c)
										Payment
			 activity;
(d)
										Coordination of benefits;
(e)
										Claim
			 status;
(f)
										Referral certifications and
			 authorizations;
(g)
										Health claim attachments; and
(h)
										Collection
			 activity documentation.
(5)
									"Health plan":
			 any individual or group that provides or pays the cost of medical care,
			 including public and private health insurance issuers, HMOs, or other managed
			 care organizations, employee benefit plans, the medicare and medicaid programs,
			 military/veterans plans, and other "policy, plan or programs" for which a
			 principal purpose it to provide or pay for health care
			 services.
(6)
									"Healthcare provider": (as defined in section 1861(u)
			 of the Social Security Act,
			 42
			 U.S.C. 1395x(u) ): a
			 provider of medical or health services, as defined in this rule (as defined in
			 section 1861(u) of the Social Security Act,
			 42
			 U.S.C. 1395x(u) ), any other
			 person or organizations who furnishes, bills, or is paid for health care in the
			 normal course of business.
(7)
									"Workforce
			 member": an employee, volunteer, trainee, and other person whose conduct, in
			 the performance of work for a covered entity, is under the direct control of
			 such entity, whether or not they are paid by the covered
			 entity.