HIPAA has specific rules for workers who deal with patient information all the time. One rule says that workers- especially clinical staff - must get patients' permission to do certain activities.
Work Activities That Require Written Permission (Authorization)
There are certain activities that workers cannot do with patient information, unless the patient signs a special HIPAA authorization form. Workers must get a patient's HIPAA authorization before doing the following activities:
- Many research activities
- Many marketing activities
- Many fundraising communications
- Making disclosures to patients' attorneys
If you perform these activities, you will need to get patient authorizations. Some of you are currently getting signed forms for other activities as well, however. And this brings up an important point about HIPAA. HIPAA sets a minimum standard for patient privacy. If state law or UW Health's own policies require us to do more for patients, then we must do more. If you are already getting written permission for an activity, keep it up: HIPAA does not remove any of our current patient permission and signature rules.
Workers affected by HIPAA's written permission rules will receive additional training.
Work Activities That Require Spoken Permission (i.e., Patient Must be Given a Chance to Object)
There are certain activities that workers cannot do unless you get the patient's spoken permission. The patient must be given a chance to object to the activity, i.e., a chance to say yes or no.
- Disclosures to family members and close friends. Before we can tell a patient's family member or friend how the patient's treatment is going, we must ask the patient, and make sure the patient does not object.
- Disclosures in a facility directory. The UW Hospital can list an inpatient's name, room number, condition, and religion in a directory, so long as the patient is told about this, and does not object.
Please contact your supervisor or a HIPAA Privacy Officer if you have questions about the activities above that require permission (authorizations, or chance to object).