HIPAA - Guidance: Use of Protected Health Information(PHI) in Education

GUIDANCE (February 18, 2008)

USE OF PROTECTED HEALTH INFORMATION (PHI) IN EDUCATION

Clinical education and training activities of University of Chicago Medical Center (UCMC) students, including residents and fellows are fundamental to the UCMC mission. However, it is important that we use and disclose protected health information (PHI) for these activities in a HIPAA compliant manner.

The HIPAA Privacy Rule allows physicians and staff to use and disclose PHI without a patient's written authorization for purposes related to treatment, payment, and health care operations. It further defines "heath care operations" to include "to conduct training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers."

As such, UCMC physicians and staff can use PHI, without a patient's written authorization, to teach medical residents, medical students, nursing students, and other clinical students or trainees, subject to the following guidelines:

The Use and Disclosure Must Be Internal: The PHI must stay within the UCMC (Medical Center and BSD)

It can not be shared outside the UCMC (including to students, faculty, and staff of non-BSD parts of the University of Chicago), at professional meetings, conferences and lectures, and for non-UCMC courses, etc.

Minimal Information: The amount of PHI used must be the minimum amount necessary to conduct the training.

Example #1:

In an on-campus lecture showing a radiologic image of a knife wound or foreign object, remove the patient name, medical record number, dates, and any other information that could lead to the identification of the patient that is not necessary to the training. Only show the foreign object and the relevant anatomy.

Example #2:

In an UCMC grand rounds presentation/discussion about a patient's tumor, only include information relevant to the case. In other words, only include race, age, other medical conditions, prior medical conditions, and other background information only if necessary to accomplish the medical training. Do not include the patient's name and medical record number. In addition, do not talk about other identifying characteristics, for example the patient's job, job title, where they work, where they live, their community activities, etc.

UCMC physicians and staff may not use PHI in any research, case studies, articles, industry conferences/lectures, posters, fliers, or any other material or media unless:

The physician seeks the patient's permission, and the patient signs a HIPAA compliant written authorization - Education Authorization Form (the signed authorization form should be maintained in the patient's medical record); or
The PHI is de-identified according to Administrative Policy 05-22; or
The PHI is aggregated with a sufficient number of other data such that the PHI could not be linked to a particular patient.

UCMC physicians and staff may not search UCMC databases or applications (e.g. OACIS) to data mine for interesting trends or patient cases to use for educational/training activities. A "trusted requestor form" must first be signed and submitted to the HIPAA Program Office for approval. Upon approval, the appropriate data administrator will provide the minimum amount of information necessary to satisfy the request.

In circumstances where a patient is to be photographed or videotaped for training purposes, the physician will seek the patient's permission, and then the patient will complete the HIPAA Education Authorization Form. Only the minimum amount of PHI should be disclosed.

Reference: Department of Health and Human Services Office for Civil Rights (OCR)

Website - HIPAA Privacy Questions and Answers at
http://www.hhs.gov/hipaafaq/limited/209.html

Back to Guidances