Privacy Rule

Section 164.510(b) of the Privacy Rule describes three ways that a provider can determine
whether the patient agrees or objects to a disclosure, including:

1. Obtaining the individual’s agreement to the disclosure
2. Providing the individual with a specific opportunity to object to the disclosure, and the
   individual does not express an objection to the disclosure
   3.Reasonably inferring from the circumstances, based on the exercise of professional
   judgment, that the individual does not object to the disclosure
   Part 1: Assume you are a hospital compliance officer and have been tasked with creating
   privacy and security policies and procedures for your organization. In crafting your policies and
   procedures, how would you structure your institution’s approach and why? Many disclosures of
   PHI are permitted based on the relationship of the person seeking information to the patient.
   What techniques should your hospital adopt through its policies for verifying the identity of an
   individual to whom information about the patient could be disclosed or to verify the individual’s
   relationship to the patient? Would you adopt a single approach, or would your policy vary, for
   instance, based on the circumstances? Please write up a brief response (2–3 pages max, double
   spaced) addressing these questions. Note that you do not have to create actual policies and
   procedures in crafting your response to these questions.
   Part 2: How would your policy apply in each of the cases below (e.g., are there certain people or
   categories of individuals with whom information regarding the condition and treatment of the
   patient would always, sometimes, or never be shared)? Please give support for your conclusions.
3. A school bus has overturned, and 30 elementary school children are rushed to your
   hospital. Some are in serious condition, some are dead when they arrive at the hospital, and
   some have merely cut and bruises and will be released shortly. As the person the hospital
   has designated the contact person regarding patients involved in this terrible accident,
   from whom would you likely receive requests for information about these children and
   their condition? To whom would you disclose PHI and to whom would you not disclose
   PHI? Why?
   Choose:
4. Obtaining the individual’s agreement to the disclosure
5. Providing the individual with a specific opportunity to object to the disclosure, and the
   individual does not express an objection to the disclosure
   3.Reasonably inferring from the circumstances, based on the exercise of professional
   judgment, that the individual does not object to the disclosure