[ad_1]
By Joan M. Kiel, PhD, CHPS
The health information management profession continues to expand its boundaries and be a true asset to society. During the pandemic, for instance, health information (HI) professionals can function as an ally to social service agencies. They can assist one of the most critical elements of the pandemic—food banks—by helping them operate under the Health Insurance Portability and Accountability Act (HIPAA) to serve those in need of food and decrease the inequity of access to food.2 This article will share excerpts from the law that HI professionals can use to reach out and assist social service organizations.
HIPAA and Food Banks
HIPAA protects the privacy and security of personal/patient health information (PHI). In many instances, individuals will reveal to a healthcare provider that they lack food and access to food.1 This results in many not only going hungry, but becoming malnourished and further contributing to poor health status. These conversations are noted in the legal, medical record and are subsequently under HIPAA. Thus, HIPAA and food banks must operate in an integrated fashion to help those in need.
Although HIPAA protects patient data, healthcare providers can communicate to social service agencies such as food banks information on individuals’ needs in certain circumstance and under various parameters. This is even more evident during a public health emergency, such as the COVID-19 pandemic, whereby medically vulnerable people were able to obtain food in a contactless manner.
What Can Be Told and When
HIPAA is not a blanket “do not tell” policy, but you must carefully follow the law to know when and how to use HIPAA. If a provider finds malnutrition is an underlying medical condition, under the minimum necessary clause and treatment clause, the provider can communicate with the food bank. Under 45CFR164.502(b)(1), HIPAA specifies that the “minimum amount of information” be conveyed to complete the task at hand. Therefore, a healthcare provider can make a referral to a food bank and say they are referring to a patient/client, but they need not specify a medical diagnosis or health history. This also complies with the HIPAA need-to-know clause, 45CFR164.514(d)(2)(i)(A). Under this clause, employees who, in their role, require the information to do their job, are given access to it. However, the need for patient health information must be specified in the employee’s job description.
HIPAA allows the sharing of PHI for treatment, payment, and healthcare operations per 45CFR164.501. Treatment includes the “coordination or management of healthcare by a healthcare provider with a third party.” Under this instance, food is viewed as healthcare, as it is life sustaining. The third party is the food bank; therefore, HIPAA allows the communication of PHI among healthcare providers and food banks.
Public Health, the Pandemic, and HIPAA
Under a public health crisis, such as a pandemic, and in accordance with 45CFR164.512(b)(1)(i), HIPAA allows for the sharing of information for the purpose of “preventing and controlling disease.” As mentioned, following state and Centers for Disease Control and Prevention (CDC) guidelines, food banks were able to provide food to people in a contactless manner. This was critical, as research showed that “60% of people were afraid to go grocery shopping in a store.”4 Thus, food banks served a critical and life-sustaining need.
The most direct manner to have the healthcare provider and food bank communicate is to have the individual/patient sign an authorization to disclose form. In accordance with 45CFR164.508(a)(1), individuals can sign an authorization to disclose form in their healthcare provider’s office or in the emergency room allowing the healthcare provider to talk specifically to the food bank personnel. In this manner, the food bank can truly understand the person and provide individual attention.
In further examining food banks and HIPAA, food banks can be considered a business associate in accordance with 45CFR164.502e(1)(i); they can use personal health information, yet it is not their primary mission. Here the food bank can sign a business associate agreement (BAA) to share the PHI. Under the BAA, the food bank agrees to follow all the HIPAA privacy and security mandates to maintain the confidentiality of data.
Food banks need to secure the PHI with technical, administrative, and physical security in accordance with 45CFR164.530(c)(1). Technical security are those measures associated with computers such as password-protected access and screen log-offs after a specified time of inactivity. Administrative security are those measures associated with the organizational policies of the food bank in handling all client information in a confidential and private manner. Physical security are those measures that provide a solid boundary to protect PHI, such as a locked office or locked file cabinet.
HIPAA is a complex law, and food banks would be wise to train their personnel on its nuances. In accordance with 45CFR164.530(b)(1), training can be provided to ensure that everyone is aware of their duty when serving the food bank patrons.
Food banks have a tremendous societal mission—even more so during a pandemic. No law can thwart that mission. HIPAA and food banks can and should work in concert with each other.
Notes
- Food Research & Action Center. December 2017. “Hunger and Health – The Impact of Poverty, Food Insecurity, and Poor Nutrition on Health and Well-Being.” https://frac.org/research/resource-library/hunger-health-impact-poverty-food-insecurity-poor-nutrition-health-well
- The Center for Health Law and Policy Innovation of Harvard Law School. June 2020. “Food Banks as Partner in Health Promotion: Navigating HIPAA. Center for Health Law & Policy Innovation.” https://hungerandhealth.feedingamerica.org/wp-content/uploads/2017/03/HIPAA-Resource_FINAL_June-2020.pdf
- HIPAA Privacy Rule. Department of Health and Human Services, Office for Civil Rights. 45CFR Parts 160 and 164.
- Teboe, Chloe. 2020 (May 1). Study: 60% of American shoppers are afraid to go to grocery stores amid coronavirus. News Center Maine. https://www.newscentermaine.com/article/news/local/as-seen-on-tv/tips-for-american-shoppers-to-avoid-fear-stress-of-grocery-shopping-during-covid-19-pandemic/97-b1510342-9d23-4790-8cdb-3c6340afbbd2
Joan M. Kiel (kiel@duq.edu) is a professor at Duquesne University and a University HIPAA Compliance Officer.
Leave a comment
[ad_2]
