VA257-17-R-0506-015.pdf

T-1

Department of Veterans Affairs Veterans Health Administration Washington, DC 20420

VHA HANDBOOK 1605.02

Transmittal Sheet January 23, 2013

MINIMUM NECESSARY STANDARD FOR PROTECTED HEALTH INFORMATION

1. PURPOSE. This Veterans Health Administration (VHA) Handbook establishes guidance on the procedures for determining the minimum necessary amount of Protected Health Information (PHI) that members of the VHA workforce may access, use, disclose or request and defines the assignment of Functional Categories to VHA employees. AUTHORITY: Title 45 Code of Federal Regulation (CFR) Parts 160 and 164.

2. SUMMARY OF CONTENTS AND MAJOR CHANGES. This is a revised Handbook that:

a. Defines the minimum necessary standard for what VHA personnel may access, use, disclose or request.

b. Designates the responsibilities of health care facility management and VHA Privacy Officers.

c. Establishes procedures for determining the minimum necessary amount of PHI involving paper and electronic data.

d. Defines routine and non-routine disclosures of information.

e. Describes the handling of routine and reoccurring requests for information, as well as non-routine and non-reoccurring requests.

f. Outlines the assignment of Functional Categories to VHA personnel.

3. RELATED DOCUMENTS. VHA Directive 1605, VHA Privacy Program, VHA Handbook 1605.1, Privacy and Release of Information, VHA Handbook 1605.03, Privacy Compliance Assurance Program and Privacy Monitoring.

4. RESPONSIBLE OFFICE. The VHA Office of Informatics and Analytics (10P2C1) is responsible for the contents of this Handbook. Questions may be referred to the Director, Information Access and Privacy Office, at 704-245-2492

5. RESCISSIONS. VHA Handbook 1605.2, Minimum Necessary Standard for Protected Health Information, dated April 9, 2003, is rescinded.

6. RECERTIFICATION. This document is scheduled for recertification on or before the last working day of January 2018.

Robert A. Petzel, M.D.

Under Secretary for Health

DISTRIBUTION: E-mailed to the VHA Publications Distribution List 1/25/2013

January 23, 2013 VHA HANDBOOK 1605.02 i

CONTENTS

PARAGRAPH PAGE

1. Purpose

2. Background

3. Scope

4. Definitions

5. Compliance with Federal Law, Regulation, and VHA Policy

6. Compliance with Minimum Necessary Standard

7. Responsibilities of the Health Care Facility Director

8. Responsibilities of the Health Care Facility Privacy Officer

9. Use of Information

10. Disclosure of Information

11. Requests for Information

APPENDICES

A. Glossary .............................................................................................................................. A-1

B. Functional Categories Identifying Appropriate Levels of Access to Protected Health Information .......................................................................................................................... B-1

C. Accessible VHA Systems of Records as Defined for Entire Medical Record ..................... C-1

D. Routine and Recurring Disclosures ..................................................................................... D-1

E. Assignment of Functional Category Worksheet ................................................................... E-1

1. PURPOSE

This Handbook establishes Veterans Health Administration (VHA) procedures for determining the minimum necessary amount of Protected Health Information (PHI), including paper and electronic data, that VHA personnel may access, use, disclose, or request and the assignment of Functional Categories for each VHA employee to notify them of their obligation to only access the minimum data necessary to conduct their job duties. The procedures in this Handbook comply with the minimum necessary requirements in the Standards for Privacy of Individually-Identifiable Health Information, title 45 Code of Federal Regulation (CFR) Parts 160 and 164, (Privacy Rule) promulgated by the Department of Health and Human Services (HHS) under the Health Insurance Portability and Accountability Act (HIPAA).

2. BACKGROUND

As required by the provisions of the Standards for Privacy of Individually-Identifiable Health Information, 45 CFR Parts 160 and 164, VHA must provide policy guidance on minimum necessary standard for use, disclosing, and requesting PHI. VHA, as a HIPAA-Covered Entity is required to apply the minimum necessary standard to PHI under the HIPAA Privacy Rule. This standard is derived from confidentiality codes and practices in common use today, and is based on sound current practice that PHI must not be used, disclosed, or requested by a Covered Entity except when it is necessary to satisfy a particular purpose to or carry out a function, treatment, payment, or health care operations (TPO). The HIPAA Privacy Rule’s minimum necessary standard requires Covered Entities, such as VHA, to evaluate its practices and, in accordance with the Privacy Rule standard, establish policies and procedures to limit the use or disclosure of, and requests for, PHI to the minimum amount necessary to accomplish the intended purpose of its use.

3. SCOPE

This Handbook establishes the categories of job functions and the corresponding minimum necessary need for access to PHI. These functional categories set VHA’s expectations for each workforce member as to the minimum necessary information needed to conduct their job function. NOTE: Functional Categories are not synonymous with access controls or menu trees. Functional Categories are specific definitions of categories of job functions and the corresponding minimum amount of data for each category.

a. For routine or recurring disclosures (see App. D), VHA is not required to conduct a review for each individual disclosure. NOTE: There is a difference between routine disclosure and a routine use under a Privacy Act System of Records. Before making a routine disclosure (i.e. a customary or regular occurring request), the individual making the disclosure should check to make sure that there is legal authority for the particular disclosure prior to disclosing

VHA PHI.

VHA HANDBOOK 1605.02 January 23, 2013

1. VHA must identify the persons or classes of personnel within the organization who need access to PHI to carry out their official duties, the types of PHI needed, and conditions appropriate to such access.

2. Where the minimum necessary standard applies, VHA must make reasonable efforts to limit the use of PHI to the minimum amount necessary to accomplish the intended purpose of the use.

3. When disclosing PHI, VHA must develop standard policies and procedures for routine or recurring disclosures. VHA must limit the PHI disclosed to the minimum that is necessary for that particular type of disclosure.

4. For routine or recurring requests, individual review of each request is not required.

b. For non-routine disclosures, VHA must develop reasonable criteria for determining and limiting disclosure to the minimum amount of PHI necessary to accomplish the purpose of a non-routine disclosure. Non-routine disclosures must be individually reviewed in accordance with these criteria and limited accordingly.

c. If VHA does not agree that the amount of information requested is reasonably necessary for the requesting Covered Entity, then VHA must negotiate a resolution as to the amount of information needed. It is permissible to use Reasonable Reliance as to the minimum necessary request of another Covered Entity if VHA cannot determine what would constitute the minimum necessary amount.

d. The minimum necessary standard does not apply to the following:

(1) Disclosures to, or requests by, a health care provider for treatment purposes.

(2) Disclosures to the individual who is the subject of the information.

(3) Uses or disclosures made pursuant to an individual’s authorization.

(4) Uses or disclosures required for compliance with the HIPAA Administrative Simplification Rules, including uses and disclosures for electronic transactions. VHA has established Privacy and Security rules to protect individuals’ electronic personal health information that is created, received, used and maintained for use by VHA and other approved entities. The Privacy Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic PHI.

(5) Disclosures to Health and Human Services (HHS) Office for Civil Rights (OCR) when disclosure of information is required under the Privacy Rule for compliance and enforcement purposes such as for Breach notification.

(6) Disclosers to a health care oversight committee or office for purposes of oversight.

(7) Uses or disclosures that are required by other law, if the use or disclosure meets the requirements of the other law such as Public Health Authorities, Law Enforcement, etc. (For other examples see App. D).

(8) De-identified information as defined in VHA Handbook 1605.1, Privacy and Release of Information.

4. DEFINITIONS

For definitions see Glossary in Appendix A. NOTE: Where this Handbook uses terms defined in Federal statutes or regulations, the terms in the Handbook have the same definitions as the statutory or regulatory definitions. The definitions in the Handbook are meant to be easy to understand without changing the legal meaning of the term.

5. COMPLIANCE WITH FEDERAL LAW, REGULATION, AND VHA POLICY

a. All VHA personnel must comply with all Federal laws and regulations, the Department of Veterans Affairs (VA) regulations and policies, and VHA policies.

b. All employees must conduct themselves in accordance with the rules of conduct concerning the disclosure or use of information in the government-wide and VA Standards of Ethical Conduct and Related Responsibilities of Employees. NOTE: For more information see 5 CFR 2635.101, 2635.703, and 38 CFR 0.735-10.

c. All VHA Program Offices, Veterans Integrated Service Network (VISN) and Medical facility Directors are responsible for implementing their facilities and offices privacy policies, which includes assigning functional categories to staff.

d. A procedure must exist for monitoring the accuracy of the functional category assignments. The monitoring of this process must be done in accordance with VHA Handbook 1605.03, Privacy Compliance Assurance Program and Privacy Compliance Monitoring.

6. COMPLIANCE WITH MINIMUM NECESSARY STANDARD

a. All VHA personnel must use, disclose, or request PHI to the minimum amount necessary required to perform their specific job functions and to accomplish the intended purposes of the use, disclosure, or request.

b. VHA personnel must not access information that exceeds the limits of PHI for their functional category as defined in Appendix B. VHA personnel must only access the PHI needed to perform their official duties even if the functional category to which they have been assigned allows for greater access.

c. VHA personnel must be assigned a functional category by the supervisor upon initial hire, position change, and annually thereafter to review applicability to their official job duties. This assignment must be documented in the competency folder.

d. VHA personnel must acknowledge in writing either by using Appendix E of this Handbook or by the supervisor documenting in the employee’s personnel competency folder that they understand their functional category. NOTE: See Appendix E for Assignment of Functional Category.

7. RESPONSIBILITIES OF THE HEALTH CARE FACILITY DIRECTOR

The health care facility Director is responsible for:

a. Ensuring that all VHA personnel are classified into at least one designated functional category for their primary job function and that they are classed into all applicable functional categories for other additional job duties.

b. Limiting access to PHI, including electronic and paper records, to the extent that it is necessary to perform job functions, but not to exceed the defined limits in Appendix B.

c. Ensuring supervisors and managers are aware of their subordinate’s personnel functional categories and PHI access limitations and that they have assigned, documented, received signed acknowledgement by the employee and maintain a copy of this documentation.

d. Documenting the assignment of the functional category in writing and ensuring the employee’s signature is obtained. The supervisor may file the documentation of the assignment of functional categories and the employee’s signed acknowledgement in the employees’ Competency Folder. Anytime the employee’s job changes, the employee must sign a new form reflecting any new job functional categories. The type of PHI designated under a functional category as outlined in Appendix B is the maximum allowable information for the individuals in a given category. VHA personnel may only access the PHI authorized for their functional categories. The existence of defined use for maximum allowable information for each functional category does not mean that all individuals in a functional category need access to the maximum allowed information or for the purpose for which maximum access is allowed, e.g., access to the information for TPO, unless required in performance of their official job duties. It may be appropriate that VHA will deny access based on job descriptions. When an individual falls into more than one functional category, access based on the less restrictive category must be granted to meet the need of an intended purpose. Personnel must follow the guidelines for the functional category for the job they are performing at the time they are accessing the information.

e. Ensuring compliance with the policies and procedures in this Handbook.

f. Ensuring that personnel use, disclose, or request only the minimum amount of PHI necessary.

g. Determining routine and recurring requests for PHI and develop standard protocols to limit the information requested (see par. 10).

8. RESPONSIBILITIES OF THE HEALTH CARE FACILITY PRIVACY OFFICER

The health care facility Privacy Officer(s) is responsible for:

a. Establishing a process to inform facility employees of their functional categories to ensure they understand they can only access and use the minimal necessary amount of information in order to perform their job functions.

b. Monitoring facility employees’ awareness of their functional category quarterly through random checks to confirm that employees understand and are following their minimum necessary limits.

c. Randomly checking to see that the assignments of functional categories are documented by supervisors when they inform their personnel of the functional category assignment (see VHA Handbook 1605.03, Privacy Compliance Assurance Program and Privacy Compliance Monitoring).

9. USE OF INFORMATION

a. VHA health care facilities will identify the classes of personnel who need access to health information to carry out their official duties, and identify the categories or types of PHI needed to perform their duties. (See App B.) VHA health care facilities must develop role-based menu options based on functional categories (i.e., X-ray technician vs. administrative support).

b. VHA health care facilities will state when access to the entire medical record is necessary, when limited access is required and when there is no need for access. Case-by-case review of each use of the entire medical record is not required.

c. When using PHI, VHA health care facilities must make reasonable efforts to limit access to PHI to the minimum amount necessary to accomplish the intended purpose of the use.

d. Uses that are authorized by the individual are exempt from the minimum necessary requirements. The authorization must meet the requirements of VHA Handbook 1605.1, Privacy and Release of Information and 45 CFR 164.508. NOTE: For other exempt categories under minimum necessary, see par. 3d.

10. DISCLOSURE OF INFORMATION

a. In certain circumstances, VHA may rely on the statement by the party requesting the disclosure of PHI that the information requested is the minimum amount of information necessary to meet their requirements regardless of whether the disclosure is routine, recurring, or non-routine. Such reliance must be reasonable under the particular circumstances of the disclosure. This Reasonable Reliance is permitted when the disclosure request is made by:

(1) A public official or agency who states that the information requested is the minimum necessary for a purpose for which the official requested the information under 45 CFR 164.512, such as for public health purposes as found in 45 CFR 164.512(b);

(2) Another Covered Entity, such as a health plan (e.g., Blue Cross and Blue Shield);

(3) A professional who is a VA workforce member or business associate of VHA and who states that the information requested is the minimum necessary for the stated purpose; or

(4) A researcher with appropriate documentation from an Institutional Review Board (IRB) or Privacy Board.

b. VHA retains discretion to make its own minimum necessary determination for any disclosures to which subparagraph 9a applies.

c. Routine and Recurring Disclosures. VHA must standardize policies and procedures for routine and recurring disclosures and must limit PHI disclosed to the minimum necessary for that disclosure. Individual review of each routine disclosure is not required. NOTE: See Appendix D for list of Routine and Recurring Disclosures.

d. Non-Routine Disclosures. VHA must develop reasonable criteria for determining and limiting disclosure to only the minimum amount of PHI necessary to accomplish the purpose of a non-routine disclosure. Non-routine disclosures must be reviewed on an individual basis in accordance with the following:

(1) Determine the legal authority for making the disclosure (see VHA Handbook 1605.1, Privacy and Release of Information) to see if the minimum necessary standard exemptions apply as described in subpar. 3d can be used;

(2) Determine who is requesting the disclosure of PHI to see if reasonable reliance as described in subparagraph 9a can be used; and

(3) Review the purpose for the requested disclosure and use professional judgment to determine if the amount of information requested is the minimum amount necessary to meet the intended purpose for the information. NOTE: Legal authority must be established before any disclosure of PHI is made outside of VHA regardless of the amount being requested. If it is determined that the disclosure of the requested PHI would exceed the minimum amount necessary, the facility privacy officer, or designee, must notify the requester.

e. VHA may not disclose an entire medical record, except when the entire medical record is specifically justified as the amount that is reasonably necessary to accomplish the purpose of the disclosure, or the disclosure is not subject to the minimum necessary standard and is permitted under all applicable laws, regulations and VHA policy. This Handbook does not eliminate the requirements to meet all restrictions related to disclosures as outlined in all applicable privacy statutes or other VA or VHA policies.

11. REQUESTS FOR INFORMATION

a. Routine and Recurring Requests. For routine and recurring requests by VHA of PHI, applicable policy and procedures must limit PHI requested to that, which is minimally necessary for that particular type of request. Individual review of each request is not required.

b. Non-Routine and Non-Recurring Requests. When making non-routine and non-recurring requests by VHA for PHI, VHA must review each request in order to ask for only that information reasonably necessary for the purpose of the request. For non-routine and non-recurring requests, reasonable criteria for determining and limiting the request to only the minimum amount of PHI necessary to accomplish the purpose of a non-routine disclosure or request must be applied. Non-routine and non-recurring requests must be reviewed on an individual basis in accordance with these criteria and limited accordingly.

c. To determine the minimum necessary amount of PHI for making requests VHA must:

(1) Determine the purpose of the request;

(2) Identify the data elements required to fulfill the request;

(3) Verify that the minimum amount of data necessary to complete the request has been requested; and

(4) Make the request.

d. When requesting PHI from another health care provider, health plan, or health care clearinghouse, except when requesting information as a health care provider in order to treat a patient, VHA must limit requests to only the minimum amount necessary to accomplish the needed purpose.

e. Requests by VHA for PHI, as a health care provider, for treatment purposes are explicitly exempted from the minimum necessary requirements (see subpar. 3d). However, VHA may not request the entire health record of an individual, except when the entire health record is specifically justified as the amount that is reasonably necessary to accomplish the purpose for the request (For more information see 45 CFR 164.514d(5)).

APPENDIX A

A-1

GLOSSARY

1. Access. For purposes of this Handbook, access means obtaining or using information electronically, on paper, or other medium for the purpose of performing an official function.

2. Business Associate. A Business Associate is an individual, entity, company, or organization, (other than VHA workforce members) who, on behalf of VHA:

(a) Performs or assists in the performance of functions or activities involving the use or disclosure of PHI, or

(b) Provides certain services to VHA and the provision of those services involve the disclosure of PHI by VHA.

3. Competency Folder. For the purpose of this Handbook, competency folder is a place where supervisors maintain copies of employees’ position descriptions, current verification of licensure, initial competency assessment and documentation, performance evaluations, ongoing competency assessments, and ongoing education records.

4. Condition of Access. The condition of access is the circumstances under which a VHA employee would require or need access to PHI contained in VHA records.

5. Covered Entity. For the purpose of this Handbook, a Covered Entity is a:

(a) Health plan,

(b) Health care provider who transmits any health information in electronic form in connection with a transaction covered by 45 CFR Parts 160 and 162, or

(c) Health care clearinghouse.

NOTE: For the purposes of definition of Covered Entities as it relates to VA, the programs within VHA are the Covered Entity. Other Administrations and Staff Offices in VA are not Covered Entities per the definition in this section.

6. Disclosure. Disclosure is the release, transfer, provision of, access to, or divulging in any other manner of information outside VHA.

7. Entire Health Record. For the purpose of this Handbook, the term “entire health record” refers to all information about an individual in all VHA systems of records listed in Appendix B, in some cases including research records.

8. Functional Categories. For the purpose of this Handbook, the term “functional categories” refers to a grouping (into classes) of individuals based upon VHA employee duties and responsibilities with a corresponding minimum standard for the need to access and use PHI to conduct their job duties. All VHA employees must be categorized into at least one functional

A-2 category. Individuals that fit into more than one functional category will be assigned a functional category for each appropriate job function and given access to the minimum necessary information needed to complete all job duties, but the employee must be informed by their supervisor to only access VHA data based on the functional category related to the job they are doing at a given time.

9. Health Care Facility. For the purpose of this Handbook, the term “health care facility” encompasses all staff and facilities, including but not limited to: VA Central Office, Veterans Integrated Service Networks (VISNs), Department of Veterans Affairs (VA) medical centers, VHA Health Care Systems, Community-based Outpatient Clinics (CBOCs), Readjustment Counseling Centers (Vet Centers), and VHA Research Centers of Excellence.

10. Health Care Operations. Health Care Operations are any of the following activities:

conducting quality assessment and improvement activities; population-based activities relating to improving health or reducing health care costs, protocol development, and/or case management;

reviewing competence or qualifications of health care professionals, evaluating practitioner performance, health plan performance, conducting training programs, and certification, licensing, or credentialing activities; conducting medical reviews, legal services, and auditing functions;

business planning and development; and business management and general administrative activities including, but not limited to: management, customer service, and the resolution of internal grievances.

11. Health Information. Health information is any information created or received by a health care provider or health plan that relates to: the past, present, or future physical or mental health condition of an individual; the provision of health care to an individual; or payment for the provision of health care to an individual. Health Information includes information pertaining to examination, medical history, diagnosis, findings or treatment, including such information as: laboratory examinations, X-rays, microscopic slides, photographs, and prescriptions.

12. Individually-Indentifiable Health Information. Individually-Identifiable Health Information (IIHI) is a subset of health information, including demographic information collected from an individual, that:

(a) Is created or received by a health care provider, health plan, or health care clearinghouse;

(b) Is related to the past, present, or future condition of an individual and provision of, or payment for health care; and

(c) Identifies the individual or a reasonable basis exists to believe the information can be used to identify the individual.

NOTE: IIHI does not have to be retrieved by name or other unique identifier to be covered by this Handbook.

A-3

13. Limited Health Record. For the purpose of this Handbook, the term “limited health record” means a subset of the entire health record. The functional category determines the subset (See App. B). A VHA employee has limited access to PHI data contained in the VHA systems of records according to the functional category. Access is granted based on specific conditions related to the performance and completion of the VHA personnel’s responsibilities.

14. Menu Assignment. For the purpose of this Handbook, the term “menu assignment” means, the access level within VHA software applications (e.g., Vista and CPRS). Menus are the software applications in which each individual is given access to specific sets of data in order to complete their official job duties. Menu Options are usually assigned by the supervisor, clinical application coordinator (CAC), automated data package application coordinator (ADPAC). CAC’s and ADPAC’s also remove access to software applications when the employee’s responsibilities change, such as a transfer of position, retirement, resignation and/or termination.

15. Need to Know. For the purpose of this Handbook, the term “need to know” is defined as a requirement of a VHA employee to obtain access to or possess PHI that is needed to carry out official job duties in relation to TPO. Need to know is considered the same as the minimum necessary as defined in this Handbook.

16. Payment. A payment is an activity undertaken by a health plan to obtain premiums, to determine its responsibility for coverage, or to provide reimbursement for the provision of health care including, but not limited to eligibility, enrollment, and authorization for services.

Activities undertaken by a health care provider to obtain reimbursement for the provision of health care, including, including, but not limited to pre-certification and utilization review, and are considered payment. VHA is both a health plan and a health care provider.

17. Personnel. For the purpose of this Handbook, the term “VA personnel” includes those officers and employees of the Department; without compensation (WOC); contractors; medical students, and other trainees; and uncompensated services rendered by volunteer workers, excluding patient volunteers; providing a service at the direction of VA staff. NOTE:

Compensated Work Therapy (CWT) workers are not VHA personnel; they are patients receiving active treatment or therapy.

18. Protected Health Information (PHI). PHI is IIHI maintained in any form or medium.

NOTE: PHI excludes employment records held by a Covered Entity in its role as an employer.

19. Reasonable Reliance. Reasonable reliance is used, in certain circumstances when a Covered Entity relies on the judgment of the party requesting the disclosure as to the minimum amount of information that is needed by the requester. Such reliance must be reasonable under the particular circumstances of the request and VHA may be required to obtain documentation or representations from the specific requester.

20. Routine and Recurring Disclosure. For the purpose of this Handbook, the term “routine and recurring disclosure” is a disclosure of PHI maintained by VHA to a requester or for a purpose consistent with normal health care functions on a frequent or recurrent basis; for

A-4 example, disclosure of health information to insurance carriers for reimbursement of services.

NOTE: See Appendix D for a list of Routine and Recurring Disclosures.

21. Routine and Recurring Request. For the purpose of this Handbook, the term “routine and recurring request” is a request by VHA for PHI from an individual or organization for a purpose consistent with normal health care functions on a frequent or recurrent basis; for example, a request for health information from Veterans for a satisfaction survey.

NOTE: Internal use and sharing of PHI by VHA personnel within and among health care facilities is not a routine and recurring request.

22. Treatment. Treatment is the provision, coordination, or management of health care or related services by one or more health care providers. This includes, but is not limited to: the coordination of health care by a health care provider with a third party, consultation between providers relating to a patient, and the referral of a patient for health care from one health care provider to another.

23. Use. “Use” is the sharing, employment, application, utilization, examination, or analysis of information within VHA.

24. Workforce. HIPAA defines the term “workforce” to include employees, volunteers, trainees, and other persons whose conduct in the performance of work for a covered entity is under the direct control of such entity, whether or not they are paid by the covered entity.

APPENDIX B

B-1

FUNCTIONAL CATEGORIES IDENTIFYING APPROPRIATE LEVELS OF ACCESS

TO PROTECTED HEALTH INFORMATION

Functional Categories

(Class of Persons)

Type of Protected Health Information

Accessible

Allowable Systems of Records for Limited Access

(See Appendix C) Official Duties of VHA

Personnel Direct Care Providers (e.g., Licensed Independent Practitioners, Nurses, Psychologists, Dieticians, Therapist, Clinical Pharmacy Specialists, Social Workers)

Entire Health Record Access

Treatment of Individuals

Department of Veterans Affairs (VA) Researchers

Entire Health Record Access including research records

Activities and Access as approved by an Institutional Review Board or Privacy Board; Preparatory to research

Indirect Care Providers (e.g., Pharmacists, Pharmacy Technicians, Lab Technicians, X-ray Technicians)

Entire Health Record Access

In support of treatment of individuals

Chief Business Office Administrative (e.g., Medical Care Cost Recovery)

Entire Health Record Access

For oversight of reimbursement, payment and financial services

Health Information Support Staff (e.g., Unit Health Coordinators, Clinic Clerks, Medical Records Technicians)

Entire Health Record Access

Assigning codes, transcription, filing, scanning, release of information, patient look up, providing or inputting registry data

Quality, Oversight and Investigations (e.g., Quality Management, Risk Management, Infection Control, Utilization Review)

Entire Health Record including research records

Medical Inspections, investigations, complaint review and resolution, quality reviews and compliance, and congressional response

Safety (e.g., Engineering Service, Maintenance) Patient safety, radiation safety and environmental safety, and biomedical safety)

No need for access to

PHI

Veteran Integrated Service Network (VISN), Privacy Officer (PO), VISN Compliance, VISN Information Security Officer (ISO), Facility ISOs, POs, Records Control Officer, Compliance Officers, Research Compliance Officers, Patient Advocate

Entire Health Record including research records

Monitoring and tracking of security, records control, privacy and patient concerns

APPENDIX B

B-2

Functional Categories

(Class of Persons)

Type of Protected Health Information

Accessible

Allowable Systems of Records for Limited Access

(See Appendix C) Official Duties of VHA

Personnel Operations and Environmental Support (e.g., Contracting, Human Resources ,Acquisitions, Employee Education Service, Forms, Library, Medical Media, Mail Room, Telecommunications, Groundskeepers, Building Management)

Facility and VISN Leadership and Management

Limited Health Record, where necessary to complete task

79VA10P2,

24VA10P2

54VA16, 23VA16

Overseeing of operation and management, executive decisions for health care operations

Non Health Information Administrative Support (e.g., Administrator of the Day (AOD), Public Affairs, Equal Employment Opportunity (EEO), Unions, Information desk)

Limited Health Record, where necessary to complete task

79VA10P2,

24VA10P2

Administrative, public and employee support, Eligibility and Enrollment Staff Entire Health Record Enrollment, eligibility, income and insurance verification

Chief of the Department of Veterans Affairs (VA) Police

Limited Health Record, where necessary to complete task

79VA10P2 Looking up patients information in Patient Inquiry

VA Police Staff, Contracted Security Police

No Need for Access to

Information Technology, Clinical Applications Coordinators (CAC’s), Automated Data Processing Application Coordinators (ADPACS), Chief Health Informatics Officer (CHIOS)/Chief Medical Information Officers (CMIOs)

Limited Heath Record where necessary to complete task

79VA10P2,

24VA10P2,

121VA10P2,

54VA16, 23VA16

Computer Systems Maintenance and Support

Veterans Canteen Service, Cafeteria, Retail Store

VHA Program Office, VACO leadership

Limited access, where necessary to complete task

79VA10P2,

24VA10P2,

54VA16, 23VA16

Overseeing of operation and management, executive decisions for VA Central Office

Volunteer Services Limited Health Record Access, where necessary to complete task

79VA10P2,

24VA10P2

Transportation of patients with vehicle, information desk support and escort to appointments.

APPENDIX C

C-1

ACCESSIBLE VETERANS HEALTH ADMINISTRATION SYSTEMS OF RECORDS

AS DEFINED FOR ENTIRE MEDICAL RECORD

(As of August 2012)

NOTE: As new Veterans Health Administration (VHA) systems of records containing PHI are published, they will be considered part of this list.

See http://vaww.vhaco.va.gov/privacy/SystemOfRecords.htm for list. NOTE: This is an internal VA Web site and is not available to the public.

VHA SYSTEM OF

RECORD NUMBER

VHA SYSTEM OF RECORD NAME

04VA115 Blood Donor Information- Department of Veterans Affairs (VA) 07VA138 Department of Medicine and Surgery Engineering Employee

Management Information Records-VA 20VA138 Motor Vehicle Operator Accident Records-VA 23VA16 Non Fee-Basis Records-VA

24VA10P2 Patient Medical Records-VA 28VA119 Personnel Registration under Controlled Substance Act-VA

32VA10Q

Veteran, Employee and Citizen Health Care Facility Investigation Records-VA

33VA113 National Prosthetics Patient Database-VA

34VA12

Veteran, Patient, Employee and Volunteer Research and Development Project Records-VA

54VA16

Health Administration Center Civilian Health and Medical Program Records-VA

57VA135 Voluntary Service Records-VA

64VA15

Readjustment Counseling Service (RCS) Vet Center Program-

VA

65VA122 Community Placement Program-VA 69VA131 Ionizing Radiation Registry-VA 73VA14 Health Professional Scholarship Program-VA

77VA10Q Health Care Provider Credentialing and Privileging Records-VA

79VA10P2

Veterans Health Information System and Technology Architecture (VistA)-VA

84VA111K National Chaplain Management Information System (NCMIS)-

VA

89VA19 Healthcare Eligibility Records-VA 90VA194 Call Detail Records-VA 93VA131 Gulf War Registry-VA 97VA105 Consolidated Data Information System-VA http://vaww.vhaco.va.gov/privacy/SystemofRecords.htm

APPENDIX C

C-2

VHA SYSTEM OF

RECORD NUMBER

VHA SYSTEM OF RECORD NAME

98VA104A Disaster Emergency Medical Personnel System -VA 99VA13 Automated Safety Incident Tracking System-VA

100VA10NS10 Patient Representation Program-VA 105VA131 Agent Orange Records Registry-VA 106VA17 Compliance Records, Response, and Resolution of Reports of

Persons Allegedly Involved in Compliance Violations–VA 108VA11S Spinal Cord Injury and Disorders Outcomes-Repository

(SCIDO–R)-VA

110VA10 Employee Incentive Scholarship Program-VA 113VA112 Telephone Service for Clinical Care Records-VA 114VA16 The Revenue Program – Billing and Collections Records-VA 115VA10 Education Debt Reduction Program-VA 117VA103 Veterans Canteen Service (VCS) Payroll Deduction Program

(PDP)-VA

121VA10P2 National Patient Databases-VA

130VA19 My HealtheVet (MHV)-VA 136VA19E VA Library Network (VALNET)-VA 142VA114 Community Residential Care and Medical Foster Home

Programs-VA 147VA16 HEC Enrollment and Eligibility-VA 150VA19 Administrative Data Repository-VA

152VA10E Electronic Ethics Consultation Database (ECWeb)-VA 155VA16 Customer Relationship Management System-VA 158VA11 Suicide Prevention Database-VA

160VA10A2 All Employee Survey-VA 161VA10A2 VHA Leadership and Workforce Development-VA 162VA10MI Investigative Database-Office of the Medical Inspector (OMI)-

VA

168VA10P2 Virtual Lifetime Electronic Record (VLER) -VA 169VA10NC Veteran Child Care Programs-VA

APPENDIX D

D-1

ROUTINE AND RECURRING DISCLOSURES

PURPOSE ENTITY AUTHORITY REVIEW MINIMUM AMOUNT

1. Health Care Operations (Legal Advice) Office of General Counsel (OGC) VHA Hdbk. 1605.1, par. 16.

Health information necessary to provide the legal support requested.

2. Health Oversight Department of Veterans Affairs (VA) Inspector General (IG) VHA Hdbk. 1605.1, par. 16.

Not Applicable (see subpar. 3d of this Handbook)

3.

Required by Law, i.e. Compliance with Equal Employment Opportunity Requirements

Office of Resolution Management (ORM) VHA Hdbk 1605.1, par. 16.

Health information necessary to meet the legal requirements.

Consult Regional Counsel.

4. Eligibility and Entitlement to Benefits Veterans Benefits Administration (VBA) VHA Hdbk. 1605.1, par. 16.

Health information needed to determine eligibility for benefits.

5. Adjudication of Claim Veterans Benefits Administration (VBA) VHA Hdbk. 1605.1, par. 16.

Health information related to the claim submitted by the veteran.

6. Eligibility for or Entitlement to Benefits Board of Veterans Appeals (BVA) VHA Hdbk. 1605.1, par. 16.

Health information related to the claim being appealed.

7.

Eligibility for or Entitlement to Burial Benefits

National Cemetery Administration (NCA) VHA Hdbk. 1605.1, par. 16.

Health information necessary to bury a deceased veteran or provide survivor benefits.

8.

Required by Law, i.e. Compliance with Requirements

Office of Employment Discrimination, Complaints and Adjudication (OEDCA) VHA Hdbk. 1605.1, par. 16.

Health information necessary to meet the legal requirements.

Consult Regional Counsel.

9.

Member and Organization Representation Unions VHA Hdbk. 1605.1, par. 16.

Health information necessary to provide the Union representation

10. Non-VHA Research Studies Researchers VHA Hdbk. 1605.1, par. 13.

Health information authorized by the Institutional Review Board. (See subpar. 9a of this Handbook)

11.

Location and Identification of Suspects, Criminals, and Others under Investigation, etc. Law Enforcement Agencies VHA Hdbk. 1605.1, par. 21.

Eight data elements listed in VHA Hdbk 1605.1, par. 21.

12. Audits and Evaluations General Accounting Office (GAO) VHA Hdbk. 1605.1, par. 34.

Not applicable (See subpar. 3d of this Handbook)

APPENDIX D

D-2

PURPOSE ENTITY AUTHORITY REVIEW MINIMUM AMOUNT

13. Health Care Oversight Congressional Oversight Committees VHA Hdbk. 1605.1, par. 18.

Not applicable (See subpar. 3d of this Handbook)

14. Complaint of Veteran Congressman VHA Hdbk. 1605.1, par. 18.

(Authorization always required)

Not applicable (See subpar. 3d of this Handbook)

15. Payment of Claims Insurance Company or Health Plan VHA Hdbk. 1605.1, par. 22.

Health information necessary to obtain reimbursement for services being billed or to provide payment information on claims processed by VHA.

16.

Reporting Debt (e.g., co-payment debt of veteran) Consumer Reporting Agency VHA Hdbk 1605.1, par. 19 and 22.

Health information required by the consumer reporting agency in order to report the individual’s debt owed to VA.

17. Legal Processing Courts, Judicial Body, or Attorney VHA Hdbk 1605.1, par. 20.

(Court Order provided)

Health information required by the Court Order.

18.

Inquiry Regarding a Patient Hospitalized General Public (Anyone)

VHA Hdbk. 1605.1, par. 5 and 23.

(Individual must be in the Facility or Patient Directory)

Only patient location and general condition may be provided.

19.

Inquiry Regarding a Patient’s Condition and Care

Next-of-Kin, Family, and Others with a Significant Relationship Who are Involved in the Veteran’s Care

VHA Hdbk. 1605.1, par. 23.

(Only applies if no other authority exists, e.g., Power of Attorney

(POA))

Health information determined appropriate for involvement in care and treatment of the veteran based on good medical ethical judgment of provider.

20. Treatment of Patients Non-VA Health Care Providers inc.

Physicians, Hospital and Nursing Homes VHA Hdbk. 1605.1, par. 24.

Not applicable (See subpar. 3d of this Handbook)

21.

Treatment of Patients without Title 38 United States Code (U.S.C.) 7332 conditions State Veteran Homes VHA Hdbk 1605.1, par. 29.

Not applicable (See subpar. 3d of this Handbook)

22.

Treatment of Patients with 38 U.S.C. 7332 Conditions State Veteran Homes

VHA Hdbk 1605.1, par. 29.

(Authorization always required)

Not applicable (See subpar. 3d of this Handbook)

23.

Determining suitability of Organs or Tissues for Donation Organ Procurement Organizations (OPO)

VHA Hdbk 1605.1, par. 25.

Health information the OPO indicates is necessary to determine suitability.

24.

Reporting Communicable Diseases Public Health Authorities VHA Hdbk 1605.1, par. 27.

Health information requested. (See subpar. 9a of this Handbook)

25. Reporting for Cancer Follow-up Public Registries VHA Hdbk 1605.1, par. 28 Health information requested. (See subpara. 9a of this Handbook)

26. Making Funeral Arrangements Funeral Homes VHA Hdbk 1605.1, par. 31 Only health information required to make funeral arrangements.

APPENDIX E

E-1

ASSIGNMENT OF FUNCTIONAL CATAGORY

10-0539 1-12.pdf http://vaww.ga.gov/vaforms/medical/pdf/vha-10-0539-fill.pdf