In Washington State,
the Uniform Health Care Information Act (UHCIA - RCW 70.02) governs
the disclosure of health care information by health care providers and
their agents or employees.
The UHCIA stipulates that a health care provider may not disclose
health care information about a client/patient unless there is a
statutory exception or a written authorization signed by the
client/patient. Some of the former, legally defined exceptions
included disclosures for the provision of health care; quality
improvement, legal, actuarial, and administrative services; research
purposes; directory information; public health and law enforcement
activities as required by law; and judicial proceedings.
Recent modifications to the Uniform Health Care Information Act:
1) expands the health care providers’ authority to disclose health
care information without a client/patient’s authorization or
knowledge; 2) diminishes a client’s right to receive information
relating to disclosures of their health care information (by adding
exceptions); and 3) requires authorizations (for release of client
information) to contain an expiration date or event.
How is This Going to Occur?
In the past the UHCIA required health care providers to chart all
disclosures of health care information, except for disclosures made to
third party payors. This charting occurred in the client’s chart (or
record), which was available to the client for review— thus giving a
client access to the information about disclosures made, regarding
their healthcare.
The modification to the UHCIA has done away with this charting
requirement and replaced it with the client’s right to request an
“accounting of disclosures” made during the six years prior to the
client’s request for that accounting. Though this sounds good (in
terms of informing the client about what disclosures are made of their
private information), this legally defined “accounting” has quite a
list of exceptions, which means an accounting does not include
disclosures:
• for treatment, payment & healthcare operations
• to the client/patient regarding his/her own healthcare information
• for uses and disclosures permitted by law
• for authorizations by the client/patient about his/her own health
care information
• of directory information (i.e., a hospital directory)
• to people involved in the client’s care
• for national security or intelligence
• to correctional institutions or law enforcement officials, or
• of a limited data set without direct identifiers
Changes to the UHCIA also include the addition of definitions of
three terms that are in the above list of exceptions:
“Health Care Operations” - the activities of a health care provider,
health care facility, or third-party payor related to their business,
including conducting quality improvement; reviewing the competence and
qualifications of health care providers; underwriting and
premium-rating; conducting or arranging for medical review, legal, and
auditing services; conducting business planning and development; and
carrying out business management and administration functions.
“Payment” - the activities of 1) a third-party payor to obtain
premiums or provide coverage and benefits, or 2) a health care
provider or facility or third-party payor to obtain or provide
reimbursement for health care services.
“Treatment” - the provision, coordination, or management of health
care services by health care providers or facilities, including
coordination of health care with a third party and consultation with
or referral to another health care provider or facility.
So, what this means is that though a client may request an accounting
of disclosures, this accounting is not required to include disclosures
about a client made to anyone working within a treatment agency; to
third party payors; to the clinician’s attorney, accountant, or
business consultant; to any staff the clinician might employ; to third
party payors; to other treatment providers; to a consultant; or to
someone to whom the clinician refers the client.
In the past, clients had some built-in control of the release of their
healthcare information in that any authorizations they signed (with
the exception of authorizations to third party payors), expired in 90
days, and did not include information regarding future healthcare
services more than 90 days after the date they signed the
authorization. With the changes to the UHCIA, this 90 day expiration
no longer exists, nor does the limit on future healthcare services
beyond 90 days.
Additional latitude for disclosure includes a new permission that a
health care provider, facility, or third-party payor may disclose a
client’s health care information for its own operations or the
operations of another health care provider/facility/third party payor
without the client’s authorization if the other entity had a
“relationship” with the client/patient.
Clinicians should be aware that these changes are in addition to the
section of the UHCIA that already included permission for a health
care provider or clinician to disclose health care information about a
client/patient without the client/patient’s authorization, to someone
the clinician believes is providing healthcare to the client/patient;
and/or to anyone who requires that information for health care
education or planning, quality assurance, peer review, or
administrative, legal, financial, actuarial services to or on behalf
of the health care provider; or to any person if the provider believes
this disclosure will minimize or avoid an imminent danger to any
individual; or to immediate family members or any other individual
with whom the client/patient has a close personal relationship (unless
the client/patient has told the provider to not make such a
disclosure).
New Criteria for Valid WA State Authorization for Disclosure:
• Must be in
written form, dated, & signed by the client/patient
• Must identify the nature of the information to be disclosed
• Must identify the name and institutional affiliation of the person
or class of persons to whom the info is to be disclosed
• Must identify the provider or class of providers who are to make
the disclosure
• Must identify the patient/client
• Must contain an expiration date or an expiration event that
relates to the patient/client or the purpose of the use or
disclosure.
• May be written to include disclosure to a class of persons,
including researchers or third-party payors.
