Key Concepts

ePHI stands for Electronic Protected Health Information. It is any individually identifiable health information, including genetic information and demographic information, collected from an individual, whether oral or recorded in any form or medium that is created or received by a covered entity (Yale School of Medicine (excluding the School of  Public Health, the Animal Resources Center, and the basic science departments: Cell Biology, Cellular and Molecular Physiology, Comparative Medicine, History of Medicine, Immunobiology, Microbial Pathogenesis, MolecularBiophysics & Biochemistry, Neurobiology, and Pharmacology), Yale School of Nursing, Yale Health, Department of Psychology Clinics and the Group Health Plan component)

PHI encompasses information that identifies an individual or might reasonably be used to identify an individual and relates to:

• The individual’s past, present or future physical or mental health or condition of an individual; OR
• The provision of health care to the individual; OR
• The past, present or future payment of health care to an individual.

Information is deemed to identify an individual if it includes either the patient’s name or any other information that taken together or used with other information could enable someone to determine an individual’s identity. (For example: date of birth, medical records number, health plan beneficiary numbers, address, zip code, phone number, email address, fax number, IP address, license numbers, full face photographic images or Social Security Number see Policy 5039 for a list of HIPAA Identifiers)

PHI excludes individually identifiable health information in education records covered by the Family Educational Right and Privacy Act (FERPA) (records described in 20 USC 1232g(a)(4)(B)(iv)) and employment records held by a covered entity in its role as employer.  PHI also excludes information related to individuals who have been deceased for more than 50 years. (see also definitions of “health information” and “individually identifiable health information”)

HIPAA imposes the following standards on covered entities for the purpose of standardizing and protecting the use, disclosure and exchange of health information:

1. Privacy standards, developed by the Department of Health and Human Services, that address the use and disclosure of health information, patient consent and authorization for the use of information, patient rights to review their health information, request edits and demand an accounting of disclosures of health information.
2. Security standards for health information including administrative, technical and physical safeguards to ensure the integrity and confidentiality of health information and to protect against security breaches and unauthorized use or disclosure of health information.
3. Standards for the transfer of information among health plans needed, for example, for the coordination of benefits, sequential processing of claims.
4. Standards to enable electronic interchange. HIPAA calls for the adoption of standards for certain transactions and data elements, such as health claim status, eligibility for a health plan, health plan enrollment/disenrollment.
5. Standards for code sets for the data elements for the transactions covered above.
6. Standards for unique health identifiers for individuals, employers, health plans and health care providers.
7. Standards for electronic signatures.
8. Requirements related to notifying patients and DHHS in the event of a breach of PHI.

HIPAA requires that we track disclosures of PHI for purposes other than releases for TPO or releases with patient authorization except in limited circumstances. The P of TPO has some instances which could lead to disclosures requiring accounting and others which would not. The decision is based on whether or not we are disclosing based on inaccurate information provided by the patient/provider vs. errors in the processing, whether intentional or not.

Examples

1. Cases where the disclosure would need to be listed in the accounting for disclosures log:
   • Clinical trial procedures incorrectly billed to insurance instead of to sponsor
   • Computer error in batch processing either through programming error or any other computer glitch
   • Mailing errors such as mismatch of letter and envelope
2. Cases where the disclosure would not need to be listed in the accounting for disclosures log:
   • Patient/hospital provides inaccurate information
   • Patient has changed coverage and has not provided updated information

Performance of Yale duties involving protected health information (PHI) offsite requires implementation of the same standards for privacy and security of PHI as is available on–campus. In addition, arrangements for staff to temporarily telecommute must comply with all applicable personnel practices (see YSM HR Policies and Procedures).

If it is decided that telecommuting is appropriate, the following items should be considered regarding the privacy and security of PHI:

• Follow recommendations for off–campus computers.
• HIPAA Privacy and Security training must be completed.
• Protected Health Information must be transported in a secure manner (for example: locked case)
• When transporting PHI, the vehicle must be secured during any stops along the way (for example: locked trunk or locked doors). PHI or electronic devices should not be left visible in the car.
• Protected Health Information must be stored in a secure place away from public or family exposure/access.
• Use of home computers for University business requires that anti-viral and anti-spyware software be current.
• Data should not be stored on non–Yale–owned computers.
• Any University documents stored offsite, in the home or on any other electronic device must not be accessible to anyone other than the Yale employee. Password protection and automatic log–off procedures must be utilized on the offsite device and paper records must be physically secured.
• Any University documents that are printed on an offsite or home computer must be secured and properly disposed of in a closed secure receptacle according to Yale University policy (i.e. Shred–It containers).