36C77619R0003-008.pdf

T-1

Department of Veterans Affairs VHA HANDBOOK 1907.01 Veterans Health Administration Washington, DC 20420 August 25, 2006

HEALTH INFORMATION MANAGEMENT AND HEALTH RECORDS

1. REASON FOR ISSUES. This Veterans Health Administration (VHA) Handbook is issued to provide basic health information procedures for managing the patient health record.

2. SUMMARY OF MAJOR CHANGES. Procedures have been revised to delineate new and additional specificity for health record documentation requirements, management of the health record, and management of health information.

3. RELATED DIRECTIVE. VHA Directive 1907 (to be published).

4. RESPONSIBLE OFFICE. The VHA Chief Health Informatics Officer is responsible for the contents of this Handbook. Questions may be referred to 760-777-1170.

5. RESCISSIONS. VHA Handbook 1907.1, dated April 15, 2004, is rescinded.

6. RECERTIFICATION. This VHA Handbook is scheduled for recertification on or before the last working day of August 2011.

Michael J. Kussman, MD, MS, MACP Acting Under Secretary for Health

DISTRIBUTION: CO: E-mailed 8/25/2006 FLD: VISN, MA, DO, OC, OCRO, and 200 – E-mailed 8/25/2006

ATTACHMENT 7

August 25, 2006 VHA HANDBOOK 1907.01 i

CONTENTS

HEALTH INFORMATION MANAGEMENT AND HEALTH RECORDS

PARAGRAPH PAGE

1. Purpose

2. Background

3. Authority

4. Definitions

5. Privacy, Confidentiality, and Information Security

a. Authority

b. Confidentiality

c. Access

d. Security

e. Provider to Provider E-mail Communication

f. Employee Health Records

g. Facsimile

h. Compliance

6. General Guidelines

a. Responsibility

b. HIM Professional

c. Health Record Creation

d. Types of Patients

e. Health Record and/or Information Availability

f. Ownership

g. Legibility

h. Patient Identification

i. Language

j. Retention, Disposition, and Transfer

k. Symbols and Abbreviations

l. Forms and Template Management

m. Authentication

n. Authorized Entries

o. Sensitive Records

p. Complete and Incomplete Records

q. Master Patient Index (MPI)

r. Adverse and Sentinel Events and Close Call Reporting

s. Fee Basis

t. Research, Clinical Trials, and Experimentation

u. Disaster Recovery Plan

VHA HANDBOOK 1907.01 August 25, 2006 ii

CONTENTS Continued

7. Electronic Health Record

a. General

b. Standards of Electronic Notes

c. Copy and Paste, “Cloned Notes,” Imported Text, Objects, etc

d. Clinical Postings

e. Clinical Reminder

f. Electronic Signatures

g. Health Record Alterations and Modification

h. Document Scanning

8. Documentation

a. General

b. Documentation Principles

c. Medical Alert

d. Evaluation and Management Services

e. Inpatient Health Care

f. Emergency and Urgent Care

g. Outpatient and/or Ambulatory Care

h. Initial Assessments

i. History and Physical (H&P)

j. Re-assessments

k. Treatment Plan and/or Care Plan

l. Laboratory and Imaging

m. Progress Notes

n. Commitment

o. Seclusion and/or Restraints

p. Inter-service and/or Inter-ward Transfer Note

q. Discharge Progress Note and/or Discharge Instructions

r. Consultations and Referrals

s. Informed Consent

t. Anesthesia

u. Surgeries and Procedures

v. Orders

w. Advance Directive

x. Discharge Summary

y. Autopsy iii

CONTENTS Continued

9. Health Information Management (HIM)

a. HIM Functions

b. The Health Information Professional

c. Management Processes

d. HIM Program Attributes

e. Reviews and Monitors

f. Health Record Review

g. Employee Orientation

h. Coding

i. Transcription

j. Release of Information

10. Management of the Paper Health Record

a. Medical Record File Activity

b. Filing Medical and Administrative Records Folders

c. Record Charge Out System

d. File Area Rules and Procedures

e. Duplication, Transfer, and Loan of Records

f. Administrative Records

g. Filing Arrangement of Administrative Records

h. Community-based Outpatient Clinic Records

i. Unit Numbering System

11. Paper Health Record Maintenance

a. General

b. Filing Sequence for Hospital Inpatients

c. Filing Sequence for Ambulatory and/or Outpatient Care Records

d. Filing Sequence for Nursing Home Care Records

12. References

HEALTH INFORMATION MANAGEMENT HANDBOOK

1. PURPOSE

This Veterans Health Administration (VHA) Handbook is issued to provide basic health information procedures for managing the patient health record. Procedures have been revised to delineate new and additional specificity for health record documentation requirements, management of the health record, and management of health information.

2. BACKGROUND

a. VHA, by Federal policy, must maintain complete, accurate, timely, clinically-pertinent, and readily-accessible patient records which contain sufficient recorded information to serve as a basis to plan patient care, support diagnoses, warrant treatment, measure outcomes, support education and research, facilitate VHA performance improvement processes and legal requirements.

b. The most current standards of the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) must be followed, unless specifically otherwise stated.

c. The record must be standardized with regard to content, creation, maintenance, management, processing, and expected quality measures. Electronic capture and storage of patient health information must be implemented to enhance access to patient data by health care practitioners and other authorized users. Electronically stored and/or printed patient information is subject to the same medical and legal requirements as handwritten information in the health record.

3. AUTHORITY

Title 38 United States Code (U.S.C.) 7304(a) is the statutory authority for the Under Secretary for Health to promulgate regulations concerning the custody, use, and preservation VHA of records and papers.

4. DEFINITIONS

The following terms are defined, as used in this Handbook:

a. Active Record. An active record is the health record of a patient who is currently receiving VHA authorized care.

b. Addendum. An addendum is the inclusion of additional information to a source document.

c. Administrative Correction. Administrative correction is the documentation by administrative personnel with the authority to correct information previously captured by, or in, error.

d. Administrative Record. See subparagraph 4nn,Health Record.

e. Advance Directive. An Advance Directive is a specific written statement made by a patient who has decision-making capacity, regarding future health care decisions. This information is available to instruct the surrogate and practitioners about the patient’s wishes when the patient can no longer make health care decisions.

f. Alerts. See subparagraph 4ddd, Notifications.

g. Ambulatory or Outpatient Care. Ambulatory or outpatient care is defined as health care services provided to patients who are not classified as inpatients.

h. Amendment. An amendment is alteration of health information by modification, correction, addition, or deletion.

i. Authentication. Authentication may include a written signature, written initials, or electronic signatures. Authentication can be used in the following contexts:

(1) To authorize or validate an entry in a record by a unique identifier that allows identification of the responsible individual;

(2) To corroborate that the source or sender of the data received is as claimed; and

(3) To provide assurance of the claimed identity of the entity or receiver.

j. Authorization Subscription Utilities (ASU)

(1) ASU are rules that execute facility policy; they list and describe those categories of personnel authorized to make entries into Computerized Patient Record System (CPRS) and they determine the levels of required authentication. They also provide tools for creating business rules that apply to documents used by members of those authorized personnel groups.

(2) Strict maintenance of ASU and User Class software packages at facilities is required to ensure security and integrity of health record documentation.

k. Boilerplate. A boilerplate is a pre-defined Text Integration Utilities (TIU) electronic overprinted form that displays required data elements, whether completed or not; it is filled in with pre-defined text that is associated with an electronic document title. NOTE: Use of boilerplates is strongly discouraged.

l. Business Rules. Business rules authorize specific users, or groups of users, to perform specified actions on documents in particular statuses (e.g., a practitioner who is also the expected signer of the note may edit an Unsigned Progress Note). NOTE: Sites can modify or add to these rules to meet their own local needs.

m. Clinical Applications Coordinator (CAC). The CAC is a person at a hospital or clinic assigned to coordinate the installation, maintenance, and upgrading of CPRS and other Veterans Integrated and Systems Technology Architecture (VistA) software programs for the end users.

n. Clinical Reminder. A clinical reminder is a notation to remind clinicians of an action that is generally required for an individual patient or patients in particular groups.

o. Cloned Notes. See subparagraph 4x, “Copy and Paste.”

p. Collateral. Collateral is a spouse, family member, or significant other who receives services relative to the patient's care.

q. Community-based Outpatient Clinic (CBOC). A CBOC is a Department of Veterans Affairs (VA)-operated clinic (in a fixed location), or a VA-funded or reimbursed health care facility or site that is geographically distinct or separate from the parent medical facility.

r. Compliance. Compliance is an oversight process, supported by appropriate organizational conditions (culture, regulations, policies, procedures, controls, etc.), which, over time, are most likely to ensure that employee actions and character are consistent with VHA core values. As an oversight process, compliance is used by all levels of the organization to identify high-risk areas, and to see that appropriate corrective actions are taken.

s. Computerized Patient Record System (CPRS). CPRS is the primary patient record system that stores information in VistA, or other automated systems using electronic storage.

CPRS supports entry of notes and orders, rules-based order checking, and results reporting. Also integrated into CPRS is VistA imaging which permits display of radiological images, Electrocardiograph (ECG) tracings, imaging from other sources, and document scanning.

t. Confidential. Confidential is the status accorded to data or information indicating that it is protected for some reason, and therefore it needs to be guarded against theft, disclosure, or improper use, or both, and must be disseminated only to authorized individuals or organizations with a need to know. Patient health records are sensitive due to the requirements of confidentiality as they contain restrictive information about the individual. Per the Security Rule, confidentiality is the property that data or information is not made available or disclosed to unauthorized persons or processes.

u. Consolidated Health Record (CHR). See subparagraph 4nn, “Health Record.”

v. Consultant Report. A consultant report is a signed (authenticated) opinion of the consultant’s findings for making a diagnosis or providing treatment advice on a specific patient.

w. Consultation. A consultation is a service performed when an opinion or advice regarding evaluation and/or management of a specific problem is requested.

x. Copy and Paste. Copy and paste are duplicating selected text or graphic(s) and inserting it in another location, leaving the original unchanged.

y. Crises, Warnings, Allergies and/or Adverse Reactions, and Directives (CWAD).

CWAD are displayed on the Cover Sheet of a patient’s computerized record, and can be edited, displayed in greater detail, or added to (see subpar. 4jjj, Patient Postings).

z. Delinquent Record. A delinquent record is an incomplete record that has not been finished within the timeframe specified in the facility's medical staff By-laws, rules, and regulations.

aa. Demographic Data. Demographic data is information used to identify an individual such as name, address, gender, age, and other information specifically linked to a specific person.

bb. Dialog Template. See subparagraph 4ooo, Point and Click Template.

cc. Document Definitions. Document definitions are a subset of TIU that provide structure for electronic documents, by organizing the documents into a hierarchy of document classes and titles that inherit characteristics from the higher levels, Class and Document Class. They also allow the creation and use of boilerplate text and embedded patient VistA database objects into electronic templates.

dd. Domiciliary. A domiciliary is a residential rehabilitation program that provides short-term rehabilitative and long-term health maintenance care for veterans who require minimal medical care.

ee. Electronic Signature. An electronic signature is a computer data compilation of any symbol or series of symbols executed, adopted, and/or authorized by an individual to be the legally binding equivalent of the individual’s handwritten signature.

ff. Electronic Signature Block. The electronic signature block is a field that prints underneath the name of the author of a document that designates the position of the individual at a facility.

gg. Encounter. An encounter is a professional contact between a patient and a practitioner vested with primary responsibility for diagnosing, evaluating, and/or treating the patient’s condition (adapted from American Society for Testing and Materials (ASTM), 1999, p. 2).

hh. Erroneous Entries. Erroneous entries are incorrect data within the content of a note or are information entered on a wrong patient document.

ii. Extended Care. See subpar. 4eee, Nursing Home Care.

jj. Facility. Facility includes a hospital, medical center, nursing home, domiciliary, outpatient clinic, and/or CBOC (satellite clinic), unless otherwise specified.

kk. Fee Basis Record. A fee basis record is a record of treatment by non-VA health care providers authorized and paid for by VA.

ll. Fellows. See subparagraph 4uuu, Resident.

mm. Health Information Administrator or Manager. A Health Information Administrator or Manager is the professional title of practitioners, usually certified by the American Health Information Management Association (AHIMA), with recognized health information management credentials, who have primary responsibility for the management of the health record and health information program, computer-based or otherwise. NOTE:

Henceforth the Health Information Manager is referred to as a health information professional.

nn. Health Record. A health record includes the electronic medical record and the paper record, combined, and is also known as the legal health record. A health record can be comprised of two divisions, which are the:

(1) Health Record. This is the documentation of all types of health care services provided to an individual, in any aspect of health care delivery. It includes individually identifiable data, in any medium, collected and directly used in and/or for documenting health care. The term includes records of care in any health-related setting used by health care professionals while providing patient care services, to review patient data or document their own observations, actions, or instructions. The health record includes all handwritten and computerized components of the documentation.

(2) Administrative Record. This is an official record pertaining to the administrative aspects involved in the care of a patient, including demographics, eligibility, billing, correspondence, and other business-related aspects.

oo. Health Record Review. Health record review is the process of measuring, assessing and improving the quality of health record documentation; i.e., the degree to which health record documentation is accurate, complete, and performed in a timely manner. This process is carried out with the cooperation of relevant departments or services. The function includes the oversight of the development of document titles, computerized templates, overprinted forms, order sets, boilerplates, and note titles for standardization in the health record.

pp. Health Summary. Health summary is the compilation of components of patient information extracted from other VistA applications.

qq. Inactive Record. An inactive record is the record of a patient who has not received VHA authorized health care in a 3-year period.

rr. Incomplete Record. An incomplete record is a patient record that is missing content, reports, and/or authentications, as defined by medical staff By-laws and/or facility policy.

ss. Inpatient. An inpatient is a recipient of medical services who is admitted to a VA facility and receives health care services, room, board, and continuous nursing service in a unit or area of the hospital where patients generally stay overnight. NOTE: This excludes admission for observation.

tt. Inter-service and/or Inter-ward Transfer. Inter-service and/or inter-ward transfer is the formal transfer of an inpatient during an episode of inpatient care from one nursing care unit, clinical service, or supervising practitioner to another.

uu. Legal Health Record. The legal health record is the documentation of the health care services provided to an individual in any aspect of health care delivery by a health care provider organization. The legal health record is individually-identifiable data, in any medium, collected and directly used in and/or documenting health care or health status.

vv. Lodgers. Lodgers are persons who are housed in the facility for non-medical purposes and who are not receiving health care services while lodged; they are not considered inpatients.

Nursing home beds may not be used for lodgers.

ww. Long-term Care. See subparagraph 4eee, Nursing Home Care.

xx. Master Patient Index. VHA's Master Patient Index (MPI) is the enterprise-wide database that uniquely identifies all active patients who have been admitted, treated, or registered in any VHA facility, and assigns a unique identifier to the patient. The database contains patient-identifying information and correlates a patient's identity across the enterprise, including all VistA systems and external systems, such as the Federal Health Information Exchange (FHIE) at any VHA facility since 1996. NOTE: At some point in the future, the database may also incorporate persons other than patients, including employees and providers and may be used throughout VA to uniquely identify persons.

yy. Medical Record. See subparagraph 4nn, “Health Record.”

zz. Medical Staff Member. Medical staff members are physicians and dentists, or other licensed individuals, permitted by the health care facility's By-laws to provide patient care services independently, i.e., without supervision or direction.

aaa. National Patient Care Database. The National Patient Care Database (NPCD) is VHA’s principal national repository of patient care data. NPCD is a patient-centered, relational database (a data warehouse) that receives encounter data directly from VHA clinical systems via Health Level 7 messaging. It holds records of all VHA outpatient encounters since October 1996 and all inpatient admissions since October 1998.

bbb. Need to Know. Need to know is access to health information by authorized clinical or administrative users based on the user's role and a specific reason the information is needed to perform the user's job function.

ccc. Note Title. The note title is the designation given to an electronic document in CPRS or a paper form that enables a user to retrieve information from the health record.

ddd. Notifications. Notifications are electronic messages that provide information or which prompt staff to act on a clinical event. Clinical events, such as unsigned or un-cosigned documents, critical laboratory value, or a change in orders, trigger a notification to be sent to all recipients identified by the corresponding package (Laboratory, CPRS, Radiology, etc.). NOTE:

In CPRS, notifications are located on the bottom of the Patient Selection screen. In VistA, notifications are located with a prompt "View Alerts" when the user logs onto the system.

eee. Nursing Home Care. Nursing home care consists of a dynamic array of services, such as, but not limited to: short stay skilled nursing, rehabilitation, hospice or an array of longer stays such as dementia or maintenance care for veterans who have sufficient functional impairment and/or nursing and medical needs that can not be provided in other non-institutional settings. Short-stay nursing home care is for admissions that are 90 days or less, and long-stay is for admissions greater than 90 days.

fff. Observation Status or Patient. An observation patient is one who presents with a medical condition, with a significant degree of instability or disability, and who needs to be monitored, evaluated, and assessed for either admission to inpatient status or assignment to care in another setting. An observation patient can occupy a special bed set aside for this purpose, or a bed in any unit of a hospital, i.e., urgent care, medical unit. These types of patients need to be evaluated against standard inpatient criteria. These beds are not designed to be a holding area for emergency rooms. The length-of-stay in observation beds must not exceed 23 hours and observation patients are not considered inpatients. NOTE: Routine post-surgery recovery is not observation.

ggg. Outpatient. An outpatient is a recipient of medical services who is not admitted to a bed.

hhh. Patient. A patient is the recipient of VHA-authorized care. Veterans admitted to nursing home care units may also be referred to as “residents”. For the purposes of this document, “patient” will include reference to nursing home residents.

iii. Patient Care Encounter (PCE). PCE is a data repository that captures clinical data resulting from ambulatory care patient encounters.

jjj. Patient Postings. Patient postings are a component of CPRS that includes messages about patients; it is an expanded version of CWAD.

kkk. Patient Record. See subparagraph 4nn, Health Record.

lll. Patient Treatment File (PTF). PTF is an Automatic Data Processing (ADP) system for inputting, maintaining, and presenting personal, demographic, and clinical data related to care and treatment episodes of individuals who are patients or members:

(1) In VA hospitals, domiciliaries, nursing care units, and restoration centers, or

(2) Are provided care or treatment under VA auspices in a non-VA hospital or non-VA nursing home.

mmm. Perpetual Medical Record (PMR). PMR are specific documents on specific patients from inpatient episodes of care that were maintained at the facility after retirement of the health record. Documents originally included: the autopsy, if appropriate; discharge summaries;

pathology reports; operation reports; and the most recent VA Form 10-10, Application for Medical Benefits. Health records are no longer perpetualized. NOTE: On August 17, 1992, the National Archives and Records Administration granted approval to discontinue the creation of

PMR.

nnn. Person Class. Person class is a profession and/or occupation code defined by Medicare that is assigned to individual providers. It reflects training, licensure, and scope of practice for that individual. Person Class associations are part of the minimum data set reported to the NPCD.

ooo. Point and Click Template. NOTE: Also referred to as a Dialog Template. Point and Click Templates are only available in the Graphical User Interface (GUI) version of CPRS; they permit rapid entry of information for Progress Notes and Consult Requests through the use of radio buttons, check boxes, and free-text fields. These templates are used with any appropriate note title; only the selections made within the dialog template appear in the note.

ppp. Practitioner

(1) Licensed Practitioner. A Licensed Practitioner is an individual at any level of professional specialization who requires a public license and/or certification to practice the delivery of care to patients. A practitioner can also be a provider.

(2) Licensed Independent Practitioner. A Licensed Independent Practitioner is an individual permitted by law and by the organization to provide care and services, without direction or supervision, within the scope of the individual’s license and consistent with individually-granted clinical privileges.

(3) Non-licensed Practitioner. A non-licensed Practitioner is an individual without a public license or certification who is supervised by a licensed and/or certified individual in delivery of care to patients. Physician residents may be licensed or non-licensed practitioners, but must be supervised by a supervising practitioner when functioning as part of an accredited residency training program.

(4) Supervising Practitioner. Supervising practitioner refers to licensed, independent physicians, dentists, podiatrists, and optometrists, regardless of the type of appointment, who have been credentialed and privileged at VA medical centers in accordance with applicable requirements.

(5) VA Special Fellow. The term VA Special Fellow refers to a VA-based physician or dentist trainee who has enrolled in a VA Special Fellowship Program for additional training, primarily in research. Physicians in VA Special Fellowships have completed an ACGME-accredited core residency (medicine, surgery, psychiatry, etc.) and may also have completed an accredited sub-specialty fellowship. They are board-eligible or board-certified, and consequently, are licensed independent practitioners. Dentists in VA Special Fellowships have completed a Commission on Dental Accreditation (CDA)-accredited residency and are licensed independent practitioners. All VA Special Fellows must be credentialed and privileged in the discipline(s) of their completed (specialty or subspecialty-training) programs. VA Special Fellows may function as supervising practitioners for other trainees, and billing may occur in their name.

qqq. Provider. A provider is a business entity that furnishes health care to a consumer; it includes a professionally-licensed practitioner who is authorized to operate within a health care facility.

rrr. Query Form. A query form is a written communication tool sent by clinical coding personnel to a physician when medical record documentation is unclear or conflicting.

sss. Redact. Redact is to remove, hide from view and/or obliterate those parts of an otherwise releasable document that contains individual identifiers or other information that the Government is authorized or mandated to withhold under applicable provisions of the Freedom of Information Act, Privacy Act, or other applicable confidentiality provisions, such as 38 U.S.C.

7332.

ttt. Referral. Referral is a request to evaluate and assume the responsibility for care.

uuu. Resident. The term ‘resident’ refers to an individual who is engaged in a graduate training program in medicine (which includes all specialties, e.g., internal medicine, surgery, psychiatry, radiology, nuclear medicine, etc.), dentistry, podiatry, or optometry, and who participates in patient care under the direction of supervising practitioners. NOTE: The term “resident” includes individuals in their first year of training often referred to as “interns” and individuals in approved subspecialty graduate medical education programs who historically have also been referred to as “fellows” by some sponsoring institutions.

vvv. Resident Assessment Instrument Minimum Data Set (RAI MDS). Standardized instrument specifically designed for nursing home initial assessment, regular assessment and treatment planning. Use of the electronic version of the RAI MDS is required for all nursing home admissions.

www. Retired Record. A retired record is a record stored off site at an authorized records and storage facility, or archived to electronic storage medium.

xxx. Retract. Retract is to withdraw, call back, or indicate an item when validity and/or integrity is no longer in place.

yyy. Scan or Scanning. To scan is to digitalize documents and data via imaging and/or pictorial technology.

zzz. Information Security. Information security is protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide:

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and propriety information; and

(3) Availability, which means ensuring timely and reliable access to, and use of, information aaaa. Templates. See subparagraph 4nnn, Point and Click Template. Templates can also include overprinted paper health record documents.

bbbb. Terminal Digit (TD) Order. TD order is the filing system for the health record system; it is a method of filing in which a number is divided into two digit pairs and read in those pairs from right to left rather than left to right for filing purposes.

cccc. Telemedicine. Telemedicine is telecommunications technology as a medium to provide medical services to sites that are a distance from the provider. Telemedicine telecommunications link providers and patients together from diverse geographic locations, and they transmit text and images for medical consultation and treatment.

dddd. Text Integrated Utilities (TIU). TIU is a VistA document management application.

TIU documents include, but are not limited to: discharge summaries, progress notes, operative reports, and consult reports.

eeee. Update. An update is current information entered in place of existing data, for example, an address change. Data meant to be frequently updated is considered to be transient, i.e., by nature, bound to change.

ffff. User Class. User Classes (e.g., attending physician, dentist, optometrist, podiatrist, resident physician, provider, medical record technician, nurse, Chief, Health Information Management Service (HIMS)) and sub-classes are defined in the VistA User Class File (8930).

Responsibilities and privileges (for accessing, entering, signing, co-signing, editing, deleting, etc.) are defined through this file.

gggg. Veterans Equitable Resource Allocation (VERA). VERA is a patient classification system developed by VHA and used to allocate funds based on classification.

hhhh. View Alerts. See subparagraph 4ddd, Notifications.

iiii. Veterans Health Information Systems and Technology Architecture (VistA).

Software applications previously known as the Decentralized Hospital Computer Program

(DHCP).

jjjj. VA Sensitive Information. VA sensitive information is all VA data, on any storage media, or in any form or format, which requires protection from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes information whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary information, records about individuals requiring protection under various confidentiality provisions, such as the Privacy Act, the Health Insurance Portability and Accountability Act Privacy Rule, and information that can be withheld under the Freedom of Information Act. Examples of VA sensitive information include: individually-identifiable medical, benefits, and personal information; financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, investigatory, and law enforcement information;

information that is confidential and privileged in litigation, such as: information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege;

and other information, which, if released could result in violation of law, harm, or unfairness to any individual or group; or could adversely affect the national interest, or the conduct of Federal programs.

5. PRIVACY, CONFIDENTIALITY, AND INFORMATION SECURITY

a. Authority

(1) The privacy and security of patient information stored in any media must be protected in accordance with, but not limited to, the Privacy Act of 1974, Freedom of Information Act, Federal Information Security Management Act, Office of Management and Budget (OMB) Circulars A-123 and A-130, VHA Directive 6210, Health Insurance Portability and Accountability Act of 1996 (HIPAA), Title 45 Code of Federal Regulations (CFR) Parts 160 and 164, VHA Handbook 1605.1 and JCAHO standards.

(2) In accordance with the Privacy Act and VHA Directive 6210, Automated Information Systems (AIS) Security, local safeguards must be established concerning patient record security and confidentiality.

b. Confidentiality

(1) All staff with access to patient information in the performance of their duties are informed of responsibilities in maintaining the confidentiality of patient information. NOTE:

Emphasis needs to be placed on the annual VHA Privacy Policy training requirement, as well as other applicable privacy awareness education.

(2) Patient records are confidential regardless of medium. The privacy of patient information must be preserved and the information will not be accessible to, or discussed with, unauthorized persons.

(3) Every employee with access to patient records in any medium is responsible for the proper handling of the patient records. Each employee is accountable for safeguarding patient confidentiality and privacy, and failure to do so may result in disciplinary or other adverse action up to, and including, termination.

(4) VHA employees must transport patient records within the medical center. Where resources are not available, the patient may transport the patient’s own health record as long as good judgment is exercised and appropriate measures are taken to ensure confidentiality and integrity. NOTE: The use of locked bags is strongly encouraged.

c. Access

(1) Access to health care information is controlled to ensure integrity, to minimize the risk of compromising confidentiality, and to increase reliability.

(2) Access to health records and health record file areas is limited to authorized personnel.

Only authorized personnel are allowed to print extractions from the electronic record or to make copies from the paper chart.

(3) Active records must be readily accessible to authorized clinical staff.

d. Security

(1) Security measures for authorizing access to the patient's health record must be delineated in local policy.

(2) Only the Chief, HIMS, or designee, can approve the physical removal of original health records from the treating facility.

(3) Health records in file areas and other areas where health records are temporarily stored (clinic or treatment areas, record review areas, quality assurance areas, release of information, etc.) must be locked when responsible personnel are not present to ensure the security of the area and to ensure records are not accessible to unauthorized individuals.

(4) Precautions must be taken by staff to ensure that patient records on computer screens cannot be seen by individuals who do not have a legitimate need-to-know.

(5) All patient-identifiable waste paper, or discarded materials, from any department must be shredded or disposed of in accordance with approved disposal policies and procedures. Locked containers or shredders must be provided in employee work areas for disposal of sensitive patient information.

(6) A disaster plan for protecting and recovering health records damaged or destroyed by fire, flood, or by other means must be in place in accordance with VHA Directive 6210. The disaster plan must include provisions for recovering health care records on different types of storage media. The plan needs to emphasize that the goal is to prevent damage first, and then focus on recovery if records are damaged or destroyed.

e. Provider to Provider E-mail Communication

(1) Electronic mail and information messaging applications and systems can only be used for authorized government purposes and must contain only non-sensitive information unless the data, and are protected with a VA-approved encryption mechanism.

(2) For Outlook/Exchange mail, the Office of Cyber and Information Security (OCIS) issues Public Key Infrastructure (PKI) certificates to encrypt communications between a sender and receiver. NOTE: Personnel must follow the national PKI policies and procedures issued by

005. Requests for PKI certificates are to be directed to the local ISO, who typically serves as the Local Registration Authority (LRA) for VAPKI deployment.

f. Employee Health Records

(1) The health records of employees are under the management of human resources and are maintained in a separate location from veteran health records. If documented electronically in CPRS, they may be secured utilizing appropriate business rules and note titles to limit access to identified personnel; all employee health records in CPRS must be designated as sensitive.

(2) The records of employees who receive care as a veteran are under the auspices of Health Information Management (HIM) and are maintained with other veteran records. These records may be sequestered in a special location if directed by local policy. The electronic documentation of these records must be secured by identifying them as “sensitive” records in

CPRS.

g. Facsimile

(1) Information received via facsimile is acceptable and may be included in the patient’s health record. Fax machine transmittals must not include drug, alcohol, Human Immunodeficiency Virus (HIV), or sickle cell anemia patient information. The fax machine transmittals must be limited to immediate need to render patient care. All established fax protocols must be strictly observed.

(2) A confidentiality statement must be attached to the cover page when transmitting individually-identifiable health information. For example, when transmitting outside VA:

"The documents accompanying this transmission contain confidential health information that is legally privileged. This information is intended only for the use of the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information to any other party unless required to do so by law or regulation and is required to destroy the information after its stated need has been fulfilled and in accordance with agency destruction and retention requirements. If you are not the intended recipient, you are hereby notified that any disclosure, copying, or distribution is strictly prohibited as this information is protected by Federal Privacy law (e.g., HIPAA Privacy Rule). If you have received this information in error, please notify the sender immediately and arrange for the return or destruction of these documents."

NOTE: See VHA Handbook 1605.1, Privacy and Release of Information, for more information.

h. Compliance. There must be periodic review, or audit, of access to patient records to ensure compliance with record privacy and confidentiality standards.

6. GENERAL GUIDELINES

a. Responsibility. Administrative management of health records is the responsibility of HIM. Clinical management of health records is ultimately the responsibility of the Chief of Staff, or designee, with each clinician and professional service contributing to the content of the patient record.

b. HIM Professional

(1) Health information professionals serve as a resource to the facility and are active in the facility’s decision-making activities related to health information systems, health record content, authentication of record entries, correction of documentation errors, documentation approaches, information system backup, and disaster recovery. Health information professionals play an active role along with administration and the clinical staff in the development of future strategies for initiatives based on the organization’s health information. The health information professional may serve as the Privacy Officer.

(2) Health information professionals at the facility level are responsible for planning, managing, advising, and directing the health information program in accordance with applicable Federal laws, facility By-law, VHA policy, JCAHO standards, the Rehabilitation Accreditation Commission (CARF) formerly known as the Commission on the Accreditation of Rehabilitation Facilities, and other regulatory and accrediting agencies. Health information professionals at the facility level are responsible for creating and monitoring systems to ensure accurate, timely, and complete health records, in accordance with VHA policy and JCAHO health information protocols. The health information professional is involved in all decisions, both technical and administrative, that impact, define and/or control access to patient health records.

c. Health Record Creation. A separate, unique health record is created and maintained for every individual assessed or treated by VHA, as well as those receiving community or ancillary care at VHA expense. It is not required to print and file paper documents from electronic media for active records.

d. Types of Patients. Patient records must be maintained on the following:

(1) The inpatient admitted to any level of care (hospital, domiciliary, Nursing Home Care Unit (NHCU)).

(2) The applicant who is found not to be in need of care or ineligible for care.

(3) The individual who is dead on arrival (authorized and/or unauthorized admission).

(4) The person who is rendered ambulatory care for humanitarian reasons.

(5) The veteran whose State Home or non-VHA hospital care or treatment is provided at VHA expense.

(6) The veteran whose community nursing home care is provided at VHA expense.

(7) The veteran examined for possible exposure to herbicides (includes Agent Orange), radiation, asbestos, and environmental contaminants.

(8) Veterans undergoing Compensation and Pension (C&P) or Persian Gulf examinations.

(9) The individual placed in pre-bed care, on ambulatory care and/or outpatient status or on fee-basis status.

(10) The non-veteran patient who is evaluated and/or treated in a VHA facility under a sharing agreement (e.g., TRICARE, Civilian Health and Medical Program of VA

(CHAMPVA)).

(11) A collateral or family member of a veteran attending individual counseling.

(12) A veteran who is being treated at a CBOC under VA auspices or at VA.

(13) Patients examined for Military Sexual Trauma (MST).

e. Health Record and/or Health Information Availability. During the transition from paper health record systems to full implementation of CPRS, there must be a local policy and process that describes how the facility assembles all relevant health information when a patient is admitted to inpatient or nursing home care, seen for a prescheduled or unscheduled ambulatory care visit, or presents for emergency services. In addition, there must be processes in place that ensure health information is available during scheduled and non-scheduled downtime of the computer systems. Health records must contain original signed documents, or electronically-authenticated documents.

f. Ownership. The health record and the health information within the health record are property of VA, as specified in 44 U.S.C. § 3301.

g. Legibility. Legibility refers to the quality of penmanship used when recording data, including a clear, written signature, as well as content and appearance of dictated, copied, and/or scanned information. Patient safety and the general usefulness of the paper record depend on the legibility and the readability of the entries. Paper entries must be made in black ink to ensure permanent recording. NOTE: Handwritten entries are being phased out and need to be limited only to those documents that current technologies cannot yet support.

h. Patient Identification. The patient name, SSN, and date of birth are used to identify the patient. In the event the identity of a patient is unknown and the moniker of John Doe is assigned, a pseudo SSN and the date of birth (DOB) of 1/1/1900 will be used. The patient is then treated as a non-veteran, humanitarian emergency. NOTE: If a patient is admitted under an incorrect name, once the name correction is made in VistA, all electronic documentation must be linked to the correct patient (see subpar. 7g) including health information in packages other than TIU and CPRS (i.e., laboratory, radiology). Any paper health information must also be corrected to reflect the correctly identified patient.

i. Language. All entries must be in English and must conform to acceptable English grammar.

j. Retention, Disposition, and Transfer

(1) Policy. The retention policy applies equally to both paper and electronic records. VHA health record retention policy is 75 years after the last episode of care. Retention policies and guidelines are detailed in VHA Records Control Schedule (RCS) 10-1. Disposal procedures are set forth in 44 U.S.C. Chapter 33.

(2) Facility Storage. Records must be stored at the treating VHA facility for 3 years following last patient activity. Paper records may be retired to the VA Records Center and Vault

(VA RC&V).

(3) Retirement of Records

(a) Permission may be obtained from the VA RC&V to retire records earlier due to storage space. As of April 1, 2002, new accessions are sent to:

VA Records Center 11693 Lime Kiln Drive Neosho, Missouri 64850

NOTE: Printing of electronic and digitized (scanned) records at the time of retirement is not necessary if it can be ensured that the computerized system retention period is consistent with current health record retention requirements, and if there is a quality control process in place to ensure that: electronic and digitized records can be efficiently identified for authorized use; the images are retrievable and legible; and that the integrity of digitized records is maintained.

(b) Electronic and digitized (scanned) records may not be purged.

(4) Previous Inpatient and Outpatient Records. Previous inpatient and outpatient records existing at the facility must be made available upon specific request for treatment purposes.

When there is evidence that a record exists at another VA facility, or the VA RC&V, the record must be ordered upon specific request.

(5) Loaning Health Records. Health records may be copied, loaned, or transferred to other VHA facilities that have a need for the information in the performance of their duties (treatment, examination, research, adjudication, and other related purposes). NOTE: Loaning or mailing original health records is strongly discouraged. Facilities are encouraged to utilize available electronic means for viewing and/or copying for record transfer. If it is necessary to loan or mail original health records, VA Directive 7179 is to be followed sending the records by either Federal Express, Inc. or the U.S. Postal Service (USPS). The sender must track the shipment via the Federal Express Tracking Number when using Federal Express, Inc., or by certified priority mail, if using USPS, validating that the record(s) is received the following day. Records must not be sent with a weekend delivery.

(6) Electronic Viewing. For most cases where a patient is treated or seen at another VHA facility, the Patient Data Exchange (PDX), Network Health Exchange (NHE) or Remote Data View (RDV), VistA web, or Register Once software must be used to expedite the transfer of needed health information between facilities; however, scanned documents are not yet viewable through these technologies. Facilities must use the PDX encryption feature when transmitting data to other VHA facilities. If additional information is required, it may be copied and sent via overnight mail or fax machine when absolutely necessary.

(7) Permanent Transfer. For permanent transfer, all electronic and digitized portions of the health record must be identified, printed, and filed appropriately prior to permanent transfer of the record. NOTE: Once scanned documents can be viewed across all VHA sites, printing will no longer be required.

(8) External Source Documents. Only those external source documents that are authenticated may be maintained as part of the patient’s VHA permanent health record at the practitioner’s written request. Practitioners must indicate which documents need to be retained and limit this to pertinent, present, and/or continued care. A summary progress note written by an appropriate clinician after a review of the external source documents may be used in lieu of filing and/or scanning any external source documents.

(a) Any documents or information filed, maintained, or scanned into a patient’s health record, including external source documents, are deemed to be part of the patient’s VA health records. These records are subject to all applicable Federal regulations concerning maintenance and disclosure including the Privacy Act of 1974 (5 U.S.C. 552a) and VA confidentiality statutes. Once a document is filed, absent Federal law or regulation to the contrary, it becomes a VA record subject to protection and release under Federal law.

(b) A request to amend an external source document must be referred back to the original source.

k. Symbols and Abbreviations. While there is no JCAHO requirement for a list of approved symbols and abbreviations, if they are used in the health record there must be an explanatory legend or standardized list available to decipher their meaning. There must be a list of unapproved symbols and abbreviations which must be made available to all those who make entries in the health record and to others who use health records in the course of their official duties. Symbols and abbreviations are not to be used when documenting final diagnoses and procedures on patients released from inpatient and ambulatory and/or outpatient services.

l. Forms and Template Management

(1) A local process for initiating, developing, and approving new electronic templates and overprinted paper health record documents must be established under the auspices of the health record review function.

(2) All internally-generated forms and shared templates that become part of the health record must receive prior approval.