Requests for disclosure of records containing Protected Health Information (PHI)
must be in writing and authorized by the HIPAA Compliance Officer in advance of
Required: The privacy rule defines a covered entity as a health care
provider, a health plan or a health care clearinghouse. PVEA is considered a covered
entity based on this definition. Covered entities are required to disclose PHI under
two (2) circumstances:
PHI must be disclosed to individuals who request their PHI in writing or in person
or a written request for accounting of PHI disclosures.
PHI must be disclosed when required by the U.S. Department of Health and Human
Services (HHS) or its subsidiaries to determine a covered entity's compliance with
the privacy rule. Permitted: A covered entity is permitted to use and disclose patient
PHI without consent or authorization or without allowing the patient to object or
agree in the following circumstances.
The PHI is used by or disclosed to the individual who is the subject of the PHI; or
The use or disclosure is for the covered entity's treatment, payment or health
care operations or specified treatment, payment or operations purposes of another
For example, it would be permitted for PVEA and a hospital to exchange PHI concerning
a specific call because of their direct treatment relationship with the patient.
Another example, PVEA would be permitted to submit or exchange PHI to a health
insurance provider for billing or payment purpose
All requests for medical information for legal purposes pertaining to care
rendered by PVEA must be referred to the HIPAA Compliance Officer. Stringent
confidentiality requirements are observed in reference to all medical information.
Subpoenas must be in writing and dated when received. Under no circumstances
are documents containing PHI to be released upon oral request.
PVEA Retains Patient Care Reports under the following guidelines:
Patient Care Records Age 18 or older at time of response
0 years to under age 18 at time of response: 10 years from patient's 18th birthday
Records subject to legal proceedings: Permanent
Call response not involving patient contact or care: 3 years
© 2017 Penfield Volunteer Emergency Ambulance Service Inc.