POLICY
Glenn County Health and Human Services Agency (HHSA) will not use or disclose protected health information (PHI) unless required or permitted by law, or in cases when a valid authorization from the client is required. These regulations apply even after a client’s death.
HHSA may disclose PHI after a client’s death in the following circumstances, as mandated by HIPAA and/or California law:
To public health agencies for reporting purposes and other required functions;
To coroners, medical examiners, or funeral directors to carry out their duties;
To organ procurement organizations or similar authorized entities to assist transfer, if the client was a registered organ donor;
For research purposes;
To law enforcement for limited purposes; and
To a family member, a personal representative of the client, or another person responsible for the care of the decedent, for limited purposes, unless restricted by the client prior to death.
HHSA has adopted this policy to comply with HIPAA, HITECH, and all other state and federal laws pertaining to the privacy, security and release of protected health
information, to protect the confidentiality and integrity of confidential medical information as required by law, professional ethics, and accreditation requirements.
Public Health Agencies
Without written authorization, California law allows HHSA to report a client’s death to public health agencies for functions related to vital records.
Coroners and medical examiners
Without written authorization, HHSA may disclose PHI to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. Any HHSA staff member who also performs the duties of a coroner or medical examiner may use PHI for the purposes described in this paragraph.
Funeral directors
Without written authorization, HHSA may disclose PHI to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent.
*32*
Original: 01/27/03 Revised: 02/24/14 Page 2 of 4
HIPAA 108-Uses and Disclosures after Client Death 2
Also, HHSA may disclose the PHI prior to, and in reasonable anticipation of, the individual’s death, if necessary to the funeral director’s function.
Organ Procurement
Without written authorization, provided that a client was a registered organ donor, HHSA may use or disclose PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye, or tissue donation and transplantation.
Research
Without written authorization, HHSA may disclose PHI of a decedent for research purposes, provided that HHSA obtains the following from the researcher:
1. Representation that the use or disclosure sought is solely for research on the PHI of decedents;
2. Documentation that proves the death of such individuals; and
3. Representation that the PHI for which use or disclosure is sought is necessary for the research purposes.
Law Enforcement
HHSA may disclose PHI of a decedent to law enforcement in the following circumstances:
HHSA may disclose PHI about a client who has died to a law enforcement official for the purpose of alerting law enforcement of the death of the client if HHSA has a suspicion that the death may have been a result of criminal conduct.
HHSA may disclose PHI in response to a law enforcement’s request for such information for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person, with the following stipulations:
o HHSA may disclose only the following information: (a) Name and address;
(b) Date and place of birth; (c) Social Security number; (d) ABO blood type and rh factor; (e) Type of injury; (f) Date and time of treatment; (g) Date and time of death; and (h) A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair, scars, and tattoos.
o HHSA may not disclose for the purposes of identification or location any PHI related to the individual's DNA or DNA analysis, dental records, or typing, samples or analysis of body fluids or tissue.
Family Members, Personal Representatives, and/or Others involved in Client’s Care Without written consent, unless otherwise noted, HHSA may disclose a decedent’s PHI to family members, personal representatives, and/or others involved in the client’s care or payment of care, as follows:
HHSA may use or disclose PHI to notify a family member, a personal
representative of the client, or another person responsible for the care of the client of the client’s death.
Except as noted, HHSA may disclose limited PHI to a family member, or other persons who were involved in the client’s care or payment for care prior to the client’s death. The disclosure is limited to PHI that is relevant to the person's
*33*
Original: 01/27/03 Revised: 02/24/14 Page 3 of 4
HIPAA 108-Uses and Disclosures after Client Death 3
involvement (for example, if an individual helped to pay for a client’s care, financial, HHSA may disclose PHI that is relevant to the payor’s involvement).
o Exception: HHSA may disclose PHI in this case unless doing so goes against any prior expressed preference of the client that is known to HHSA.
HHSA shall not release PHI regarding a deceased client unless a valid Personal Representative has been established and the Representative has requested the PHI through the proper authorization process.
If under applicable law, an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual’s estate, San Benito County must recognize such person as a Personal Representative under this policy.
Absent a Personal Representative, executor, administrator or other court-appointed representative for the deceased individual’s estate, the following
individuals listed below may authorize the release of PHI, in order of priority. An entire category must be exhausted (no people in the category exist or are still alive) before moving to the next category.
o In the case of a deceased, married individual survived by a spouse with or without descendants:
Spouse
Adult children
Adult grandchildren
Parents
Adult descendants of parents (brothers and sisters)
Brothers and sisters’ adult children
Brothers and sisters’ adult grandchildren
Grandparents
Adult descendants of grandparents (uncles and aunts)
o In the case of a deceased individual with no spouse (i.e. never married, or currently widowed, or currently divorced and not remarried) with or without descendants:
Adult children
Adult grandchildren
Parents
Adult descendants of parents (brothers and sisters)
Brothers and sisters’ adult children
Brothers and sisters’ adult grandchildren
Grandparents
Adult descendants of grandparents (uncles and aunts)
Refer to the Glenn HIPAA_Disclosures of Protected Health Information to Personal Representatives for Client Care and Notification Purposes policy.
*34*
Original: 01/27/03 Revised: 02/24/14 Page 4 of 4
HIPAA 108-Uses and Disclosures after Client Death 4
ENFORCEMENT
An employee or team member learning of violations of this policy MUST notify his/her supervisor as soon as possible. Staff are responsible for adhering to this policy.
Individuals who violate this policy will be subject to the appropriate and applicable disciplinary process, up to and including termination or dismissal.
DEFINITIONS
Disclosure: The release, transfer, provision of access to, or divulgence in any other manner, of information to any organization external to HHSA.
Personal Representative means a person who has authority under applicable law to make decisions related to health care on behalf of an adult or an emancipated minor, or the parent, guardian, or other person acting in loco parentis who is authorized under law to make health care decisions on behalf of an unemancipated minor, except where the minor is authorized by law to consent, on his/her own or via court approval, to a health care service, or where the parent, guardian, or person acting in loco parentis has assented to an agreement of confidentiality between the provider and the minor.
Protected Health Information (PHI) means individually identifiable information relating to the past, present, or future physical or mental health or condition of an individual, provision of health care to an individual, or the past, present, or future payment for health care provided to an individual. Information is considered PHI where there is a reasonable basis to believe the information can be used to identify an individual.
Use: The sharing, employment, application, utilization, examination, or analysis of individually identifiable health information within HHSA.
References: 45 CFR Sections 164.510 and 164.512.
*35*
Original: 01/06/03 Revised: 06/24/14 Page 1 of 3
HIPAA 109_Use and Disclosures of Substance Abuse Records 1