(Pertaining to Written, Electronic and Verbal Patient Information)

Applies to all CCHS/UMC healthcare “workforce members” including: faculty, residents, fellows, medical students, graduate research assistants, other student leaners, staff, all other health care professionals, volunteers, agency or temporary staff workers, and all others (regardless of whether or they are CCHS trainees or rotating through CCHS from other institutions).

General Introduction

The information below attempts to consider a number of such problems, but in the final reality, it becomes the responsibility of every one of us to be sensitive to the issue of confidentiality and to work to protect the rights of our patients. The terms of this Agreement apply to every person who performs a function or activity involving the use of patient information at University Medical Center, including all care providers, residents, fellows, medical students and other student learners, as well as non-direct care providers to include secretariat, administrative and professional personnel as well as volunteers. Safeguarding this information about patients, which has been obtained by the staff of University Medical Center is a primary obligation of every one of us. All patient information is to be treated as confidential, including the fact that the patient receives (or previously received) services through UMC/CCHS. The privacy and confidentiality of our patients are protected by state laws and regulations, and federal HIPAA regulations. No patient information may be disclosed without the explicit informed consent of the patient and authorization by his/her clinician.

I understand that I will receive periodic reminders of our security safeguards and that I am responsible for reviewing and complying with those reminders on a timely basis. I am aware that it is my responsibility to follow guidance provided to me to protect against malicious software and to report any signs of malicious software activity in my work environment. I am aware that my User ID and Password must not be shared with anyone else; I am also aware that it is a major security violation for me to allow someone else to navigate in, and document in, our electronic health record under my User ID and Password. I am aware that log-in activity is being monitored and I will report any suspicious activity associated with unusual login attempts.

Conditions for Communication Information

  • Disclosures are permitted for ongoing treatment, payment or healthcare operations. University Medical Center may use or disclose its own PHI for treatment, payment or healthcare operations (exception is psychotherapy note). Patient information released to any person or party not pertaining to treatment, payment or healthcare operation will have to have the written authorization of the patient prior to any information being released.
  • Information obtained in clinical or consultant relationship is discussed only for professional purposes and only between persons clearly concerned with that specific care.
  • Only the information required for a legitimate purpose should be requested and provided. Thus, information is shared with others only when it is deemed that such information will be used for purposes of constructive patient assistance which cannot be provided without this information. Every effort should be made at all times to avoid overdue invasion of the patient’s privacy.
  • The patient has the right to decide what information may be disclosed with anyone beyond the immediate professional provider of the service. Thus, the patient has the right to request that specific information be restricted from whatever information is to be disclosed.
  • All information which is disclosed, either written or orally, which the patient has agreed to release should indicate to the receiver that the information is confidential.
  • Patient records and other patient related materials, which may be used in teaching or other consultation, should insure that the identity of that patient or other patients involved is adequately de-identified.
  • Unless there is an appropriate reason for another staff member, rather than the primary professional patient contact, to provide information on a patient, this should not be done. When information is shared by another University Medical Center staff member who is not the primary professional contact, s/he should always do this with the written authorization of the primary professional or of his/her supervisor.
  • These rules of confidentiality continue to apply after treatment has been completed and whether or not the patient’s record is still recorded in the active files.

Family Rights

  • When a child or adolescent is the primary patient, the interest of that minor should always be paramount and take precedence over those interests of others. When the staff is concerned with a family as a unit, the rights of each member of that unit must be safeguarded when joint problems are handled.
  • Minors may independently consent or authorize use of their patient information. Alabama law considers anyone under the age of 19 an un-emancipated minor. Thus, parents may have access to patient information on persons still considered a minor (this includes minors that are also married patients).
  • University Medical Center should always obtain consent of a patient or a legal guardian, as well as when appropriate, the minor patient himself/herself, before information on such a minor can be shared with another agency or another individual.
  • A wife or husband must give consent for information to be shared with each other. It is not automatically assumed that because a husband or wife is receiving treatment at University Medical Center, his or her spouse has a right to such information.

University Medical Center Internal Communications

  • Information about a patient, which is not related to constructive patient assistance, should not be discussed at any time. Information, which is related to constructive patient assistance, should never be discussed in any public place within the Center facilities.
  • Under no circumstances should clinical information or financial information regarding a patient be left in an unsupervised or public location.
  • All information, which is clinically or financially sensitive, should be placed under lock and key when unattended.

Phone Calls

  • Unless a University Medical Center staff member is absolutely certain of the party receiving information, no information of any nature related to a patient should ever be given out on the telephone. In fact, every effort should be made for information to be shared in person or in writing unless situations require otherwise.
  • The primary professional patient contact should be the only person giving out information on the telephone unless he has specifically and appropriately delegated another University Medical Center staff member to act in this capacity.
  • Individuals may request University Medical Center to communicate with them in different locations and in different ways. Forms are available for this purpose. Telephone contacts to leave messages for individuals are permitted by University Medical Center unless otherwise specified.

Emergency Communications

  • Information concerning a patient, which is received in confidence, may be revealed only when there is a clear, and imminent danger to the patient, to any other individual, or to society in general. Unless the immediate conditions warranted, such a decision to release information should always be cleared with one’s supervisor.
  • University Medical Center staff should keep in mind that there are very few situations which would meet the criteria of a “clear imminent danger”.

Special Situations

  • University Medical Center staff should be friendly to personal acquaintances and/or family members who are being seen at the Center, but should not become involved with them or any other member of the University Medical Center staff in discussing their treatment. If such an acquaintance or family member should raise an issue, he/she would be referred to their primary professional contact.
  • Information or opinions, whether this be concerning competence or otherwise, about the University Medical Center staff should not be discussed with patients.
  • Prior to using one-way mirrors, tape recorders, cameras, audio-visual or data processing equipment for assessment, treatment educational and/or evaluation purposes, members of University Medical Center staff should explain the purpose for utilizing such equipment to the patient and obtain his/her written consent/authorization for such use.
  • Patient portal is permitted after patients have signed a patient portal consent.
  • Social networking during work hours should only be used to conduct business. Some employees are asked to engage in social networking as part of their job. Your supervisor should assign this access.