Written Authorization

Authorization under HIPAA addresses written permission we must obtain from the patient for certain uses and disclosures of patient information. Generally, an authorization applies to all requests for patient information including requests for marketing, research and psychotherapy notes with certain exceptions. There are several exceptions to the authorization requirement. In some cases where authorizations are excepted under the Privacy Rule, state law may require authorization. In such cases, you must require authorization in accordance with the stricter law.

The Privacy Rule requires that specific content be included in a patient authorization for use/disclosure. If you currently use or disclose PHI for non-TPO purposes in your office, unit or department you must utilize the Authorization for Release of Protected Health Information form provided by the Health Information Management (HIM) Department.

Marketing have special conditions that apply which are discussed in more detail under the section. Psychotherapy notes have special authorization requirements that apply. To learn more on this topic visit the psychotherapy notes module where it is discussed in more detail.

What are Authorization Requirements for Uses and Disclosures Within the LLUH OHCA for Treatment, Payment and Health Care Operations (TPO)?

Patient authorization is not required when you use PHI within the Loma Linda University Health (LLUH) Organized Health Care Arrangement (OHCA)  for treatment, payment and our internal health care operations. Additionally, patient authorization is not required when you disclose PHI to a business associate for payment or health care operations on LLUH behalf.

For treatment purposes

Forward all external requests for PHI for treatment to the Health Information Management (HIM) Department. The HIM Department will determine if an emergency circumstance or referral relationship (e.g., consult, treatment) exists. If an emergency circumstance or referral relationship does not exist, patient authorization may apply. In some cases, the HIM Department has approved for some clinics/departments to release certain amounts of information providing the proper authorization form is used. Contact the HIM Department for questions regarding release of information.

For payment purposes

Designated individuals, outlined by job function or role, may disclose PHI externally for payment purposes without patient authorization ONLY UPON verification that the individual/entity to whom the information is to be disclosed (or the individual/entity who has made the request for PHI) represents the patient's insurer or payer as indicated on the patient's face sheet. Generally, all external requests for PHI for payment should be forwarded to Billing, Patient Business Offices or the HIM Department.

For health care operation purposes

"Health care operations" is defined by the Privacy Rule as certain administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business and to support the core functions of treatment and payment. These activities, include but are not limited to:

• Quality assessment and improvement activities
• Population-based activities relating to improving health/reducing health care costs
• Protocol development (excluding research)
• Case management and care coordination
• Contacting health care providers and patients with information about treatment alternatives
• Competency and qualification reviews of health care professionals
• Practitioner and provider performance evaluations
• Training programs for health care providers
• Training of non-health care professionals
• Accreditation
• Certification
• Licensing
• Credentialing
• Underwriting and premium rating
• Conducting or arranging for medical review, legal services, auditing functions
• Business planning and development (e.g., cost management and planning related services)
• Business management
• Resolution of internal grievances
• Sale, transfer, merger or consolidation
• Creating de-identified health information or a limited data set
• Fundraising (for our own benefit)

An LLUH entity  that participates in the LLUH OHCA may disclose PHI about an individual to another LLUH entity that participates in the same OHCA for any health care operations activities of the OHCA.

Do not disclose PHI outside the LLUH OHCA for another covered entity's health care operations . Forward all requests to the HIM Department for processing. Some disclosures may require patient authorization.

Organized Health Care Arrangement (OHCA)

The Health Insurance Portability and Accountability Act (“HIPAA”) defines an Organized Health Care Arrangement (“OHCA”) to include, among other arrangements, an organized system of health care in which more than one covered entity participates and in which the participating covered entities hold themselves out to the public as participating in a joint arrangement and participate in certain joint activities as specified in the Privacy Regulations. Such entities, each independent of each other, have agreed to collaborate voluntarily to give coordinated high-quality care to their patients.

Entities That Are Included in the Loma Linda University Health (LLUH) Organized Health Care Arrangement (OHCA)

• Loma Linda University Medical Center (LLUMC) (to include but not limited to)
  • Loma Linda University Medical Center – East Campus Hospital
  • Loma Linda University Surgical Hospital
  • Behavioral Medicine Center
• Loma Linda University Children’s Hospital (LLUCH)
• Loma Linda University Medical Center – Murrieta (LLUMC-M)
• Loma Linda University Health Care (LLUHC)
• Loma Linda University Faculty Practice Plan (LLUFPP)
  • Faculty Physicians and Surgeons of Loma Linda University School of Medicine (LLUSM)
  • Loma Linda University Faculty Medical Group
  • Faculty Medical Group of LLUSM
  • Loma Linda University Anesthesiology Medical Group, Inc.
  • Loma Linda University Pathology Medical Group, Inc.
  • Loma Linda University Radiation Medicine
• Loma Linda University
• Loma Linda University Health Education Consortium (LLUHEC)
• Behavioral Health Institute (BHI)
• Beaumont Surgery Center, LLC dba Highland Springs Surgical Center (HSSC)
• Beaumont Radiology Services, LLC dba Highland Springs Imaging Center (HSIC)
• Loma Linda University Shared Services

Previous | TOC | Next