In Washington State, the Uniform Health Care Information Act (UHCIA - RCW 70.02) governs the disclosure of health care information by health care providers and their agents or employees.
The UHCIA stipulates that a health care provider may not disclose health care information about a client/patient unless there is a statutory exception or a written authorization signed by the client/patient. Some of the former, legally defined exceptions included disclosures for the provision of health care; quality improvement, legal, actuarial, and administrative services; research purposes; directory information; public health and law enforcement activities as required by law; and judicial proceedings.
Recent modifications to the Uniform Health Care Information Act: 1) expands the health care providers’ authority to disclose health care information without a client/patient’s authorization or knowledge; 2) diminishes a client’s right to receive information relating to disclosures of their health care information (by adding exceptions); and 3) requires authorizations (for release of client information) to contain an expiration date or event.
How is This Going to Occur?
In the past the UHCIA required health care providers to chart all disclosures of health care information, except for disclosures made to third party payors. This charting occurred in the client’s chart (or record), which was available to the client for review— thus giving a client access to the information about disclosures made, regarding their healthcare.
The modification to the UHCIA has done away with this charting requirement and replaced it with the client’s right to request an “accounting of disclosures” made during the six years prior to the client’s request for that accounting. Though this sounds good (in terms of informing the client about what disclosures are made of their private information), this legally defined “accounting” has quite a list of exceptions, which means an accounting does not include disclosures:
• for treatment, payment & healthcare operations
• to the client/patient regarding his/her own healthcare information
• for uses and disclosures permitted by law
• for authorizations by the client/patient about his/her own health care information
• of directory information (i.e., a hospital directory)
• to people involved in the client’s care
• for national security or intelligence
• to correctional institutions or law enforcement officials, or
• of a limited data set without direct identifiers
Changes to the UHCIA also include the addition of definitions of three terms that are in the above list of exceptions:
“Health Care Operations” - the activities of a health care provider, health care facility, or third-party payor related to their business, including conducting quality improvement; reviewing the competence and qualifications of health care providers; underwriting and premium-rating; conducting or arranging for medical review, legal, and auditing services; conducting business planning and development; and carrying out business management and administration functions.
“Payment” - the activities of 1) a third-party payor to obtain premiums or provide coverage and benefits, or 2) a health care provider or facility or third-party payor to obtain or provide reimbursement for health care services.
“Treatment” - the provision, coordination, or management of health care services by health care providers or facilities, including coordination of health care with a third party and consultation with or referral to another health care provider or facility.
So, what this means is that though a client may request an accounting of disclosures, this accounting is not required to include disclosures about a client made to anyone working within a treatment agency; to third party payors; to the clinician’s attorney, accountant, or business consultant; to any staff the clinician might employ; to third party payors; to other treatment providers; to a consultant; or to someone to whom the clinician refers the client.
In the past, clients had some built-in control of the release of their healthcare information in that any authorizations they signed (with the exception of authorizations to third party payors), expired in 90 days, and did not include information regarding future healthcare services more than 90 days after the date they signed the authorization. With the changes to the UHCIA, this 90 day expiration no longer exists, nor does the limit on future healthcare services beyond 90 days.
Additional latitude for disclosure includes a new permission that a health care provider, facility, or third-party payor may disclose a client’s health care information for its own operations or the operations of another health care provider/facility/third party payor without the client’s authorization if the other entity had a “relationship” with the client/patient.
Clinicians should be aware that these changes are in addition to the section of the UHCIA that already included permission for a health care provider or clinician to disclose health care information about a client/patient without the client/patient’s authorization, to someone the clinician believes is providing healthcare to the client/patient; and/or to anyone who requires that information for health care education or planning, quality assurance, peer review, or administrative, legal, financial, actuarial services to or on behalf of the health care provider; or to any person if the provider believes this disclosure will minimize or avoid an imminent danger to any individual; or to immediate family members or any other individual with whom the client/patient has a close personal relationship (unless the client/patient has told the provider to not make such a disclosure).
New Criteria for Valid WA State Authorization for Disclosure:
• Must be in written form, dated, & signed by the client/patient
• Must identify the nature of the information to be disclosed
• Must identify the name and institutional affiliation of the person or class of persons to whom the info is to be disclosed
• Must identify the provider or class of providers who are to make the disclosure
• Must identify the patient/client
• Must contain an expiration date or an expiration event that relates to the patient/client or the purpose of the use or disclosure.
• May be written to include disclosure to a class of persons, including researchers or third-party payors.
