TITLE:

DISCLOSURES OF PROTECTED HEALTH INFORMATION OVER THE TELEPHONE

POLICY:
Columbia University Medical Center will disclose only directory information about a patient over the telephone. Certain exceptions may apply as described below.

PURPOSE
In some situations, using the telephone to communicate with a patient or to respond to requests for a patient's PHI is necessary, more convenient, or better than communicating via mail or requiring the patient come to Columbia University Medical Center for a face-to-face meeting. However, the individual's identity cannot be verified with absolute certainty if communications are conducted solely via the telephone, and a patient's Protected Health Information (PHI) could inadvertently be released to an unauthorized individual purporting to be someone he/she is not.

This Policy describes the procedures individuals at Columbia University Medical Center will take to confirm the identity of the people to whom they disclose PHI to over the telephone to limit the possibility of unauthorized disclosures.

PROCEDURES:

1. Columbia University Medical Center will limit, to the extent practicable, the PHI communicated over the telephone.



2. Requests from or disclosures to a caller stating he/she is a patient. If a caller states he/she is a patient and he/she is requesting PHI about himself/herself, the employee will not provide the PHI unless the employee has made reasonable efforts to confirm the caller is the patient.
1. The employee will, prior to disclosing PHI, ask specific questions that could only be answered by the patient. For example, the patient's date of birth, address, father's name, or mother's name.



2. If the employee knows the patient and the patient's voice, and recognizes the voice on the telephone as being that of the patient, the employee will still confirm the caller's identity by asking specific questions that could only be answered by the patient.



3. The employee may elect to place a return call to the patient using the telephone number documented in the patient's file rather than immediately disclosing the patient's PHI to a caller initiating the telephone conversation.


3. Requests from or disclosures to a caller who is not a patient.
1. If the caller states he/she is an immediate family member (i.e., father, mother, child, sibling) of the patient, the employee will notify the health care provider who will, by asking specific questions, approve or disprove disclosure of PHI to the caller.



2. If the caller states he/she is a friend, relative, or acquaintance of the patient, or if the caller is unrelated to the patient (e.g., the patient's employer, a disinterested third party, a policeman, a reporter, etc.) the employee will:
1. not disclose PHI without the patient's authorization; or



2. provide only directory information about the patient. Directory information is defined as:
1. the patient's name;
2. the patient's location at Columbia University Medical Center; and
3. the patient's condition described in general terms that do not communicate specific PHI about the patient (e.g., "good," "stable," "critical," etc.).


3. If the patient or his/her personal representative has requested confidential status (no information is to be provided), the employee will respond, "I can neither confirm nor deny that "Patient Name" is a patient at Columbia University Medical Center."



4. Documenting disclosures made over the telephone.
1. If PHI is disclosed to a caller, the employee will document the disclosure with:
1. the name and contact information (address and telephone number) of the caller;



2. the date of the disclosure;



3. a brief description of the PHI disclosed (e.g., condition, location, lab results in general terms, etc.); and



4. a brief statement of the purpose of the disclosure (e.g., provide information for follow-up appointment, provide information for second opinion, etc.).


2. Disclosures of a patient's PHI to the patient or pursuant to the patient's authorization need not be documented.



3. Documentation of any disclosures of PHI made over the telephone will be maintained for a minimum of six (6) years and may be stored in the patient's file or on a disclosures log. If the documentation of disclosures made is stored in the patient's file, it will not be considered part of the patient's file, and would not be provided as part of the patient's medical record.


5. Questions. Questions about whether patient's PHI may be disclosed over the telephone should be directed to the employee's supervisor or the HIPAA Privacy Officer.



6. Definitions.

Protected Health Information is information about a patient, including demographic information that may identify a patient, that relates to the patient's past, present or future physical or mental health or condition, related health care services or payment for health care services.

RESPONSIBILITY:         HIPAA Privacy Officer, Departments