Confidentiality, Privacy and Security

Sending PHI to requestors - best practices

  • 1.  Sending PHI to requestors - best practices

    Posted 10 days ago
    We have had an increase in misdirected mailings in the last year, including one case where a law office requested a paper copy of a patient record - the request was fulfilled and mailed first class to the office and the office received an empty, damaged envelope.  So our compliance officer and senior management is asking me if a) sending PHI via first class mail is a best practice or at least still commonly done and b) If there's diversion or inappropriate access of something sent regular mail, are we absolved of any responsibility from a HIPAA enforcement standpoint, assuming it was appropriately addressed?  For b), I don't think so but would like verification and I don't find that clear in the rule.

    Thank you,
    Lance

    ------------------------------
    Lance Smith
    Privacy Officer
    ------------------------------


  • 2.  RE: Sending PHI to requestors - best practices

    Posted 9 days ago
    Lance...I love the post.  I will post some responses.  Hoping to read what others may also share:

    a) sending PHI via first class mail is a best practice or at least still commonly done
    I think this is probably the MOST often used method of sending PHI through the mail.

    b) If there's diversion or inappropriate access of something sent regular mail, are we absolved of any responsibility from a HIPAA enforcement standpoint, assuming it was appropriately addressed?
    I would go one step further and say that the point A to B is from the sending facility to the intended recipient.  So if the post office delivers a correctly addressed letter with Lance's PHI to Frank...ask yourself...do you have an impermissible disclosure (note...the question is not asking whose fault it is)...how you handle that question often helps dictate how an organization views is responsibility...or not.  Hint...you can find clarification on this on OCR supplied guidance.

    Let's see what others have to say.




    Posted: 7:27 AM AZ time


    ------------------------------
    Frank Ruelas
    Compliance Professional
    Arizona
    ------------------------------