The Department may use or disclose protected health information (PHI) as required by law, as follows:

·           to the individual

·           for treatment purposes (for example, shared with a physician or laboratory)

·           for payment purposes (for example, payment to a pharmacy for medication)

·           for health care operations (for example, internal quality efforts as agreed to by the individual)

·           for purposes including, but not limited to, public health activities, health oversight, law enforcement, judicial and administrative proceedings, or

·           for recruitment efforts to secure placement and adoptive resources

The Department shall disclose the following information to an individual:

·           PHI, when granted access in whole or in part, and

·           an accounting of disclosures of PHI made by the Department in the last six (6) years that were not authorized by the individual, and not related to treatment, payment or health care operations.

The Department may disclose to others, as necessary, PHI pertaining to information on Human Immunodeficiency Virus (HIV), substance abuse, and psychotherapy notes as long as

·           there is a Release of Information Form (DCF-2131, Authorization for Release of Information, DCF-2133, Substance Abuse Authorization for Release of Information; or DCF-2134, HIV Authorization for Release of Information) signed by the individual whose PHI is being released, and

·           the disclosure is not subject to a restriction previously agreed upon by the individual and the Department.

The Legal Division in consultation with the Regional Resource Group shall

·           determine whether or not disclosure of PHI is permitted by law

·           ensure that the standard of minimum necessary is applied when handling requests for disclosure

·           process disclosures of de-identified PHI

·           process disclosures of PHI of deceased individuals, and

·           ensure that requests for disclosures are consistent with the Privacy Notice.

Cross-References:

·           Policy 44-7-3.2, Uses and Disclosures of Protected Health Information (PHI): Minimum Necessary

·           Policy 44-7-4, Notice of Privacy Practices for Protected Health Information (PHI)

The designated privacy staff shall

·         forward to the Legal Division all requests for disclosures of PHI to personal representatives, and

·           file copies of restrictions granted in the administrative section of the case record