UAMS ADMINISTRATIVE GUIDE

NUMBER: 3.1.29
DATE: 04/01/03
REVISION: 3/1/2004

SECTION: ADMINISTRATION
AREA: GENERAL ADMINISTRATION
SUBJECT: REQUEST FOR DATA EXTRACTS



SCOPE

UAMS workforce

DEFINITIONS

 

Disclosure means the release, transfer, provision of access to, or divulging of information in any manner (verbally or in writing) by UAMS to persons who are not UAMS employees or students, or to any other person or entity OUTSIDE of UAMS.

Fundraising  means any activity relating to the efforts of raising funds for the institution of UAMS and its related health care facilities.

Minimum Necessary means limiting Protected Health Information to the minimum necessary to accomplish the intended purpose of the use, disclosure or request.

Protected Health Information (PHI) means information that is part of an individual’s health information that identifies the individual or there is a reasonable basis to believe the information could be used to identify the individual, including demographic information, and that (i) relates to the past, present or future physical or mental health or condition of the individual; (ii) relates to the provision of health care services to the individual; or (iii) relates to the past, present, or future payment for the provision of health care services to an individual.  This includes PHI which is recorded or transmitted in any form or medium (verbally, or in writing, or electronically). PHI excludes health information maintained in educational records covered by the federal Family Educational Rights Privacy Act and health information about UAMS employees maintained by UAMS in its role as an employer.

UAMS Workforce means for purposes of this Policy, physicians, employees, volunteers, trainees, and other persons whose conduct, in the performance of work for UAMS, are under the direct control of UAMS, whether or not they are paid by UAMS.

POLICY

When a member of the UAMS workforce requests access to any PHI stored electronically concerning a group of patients in order to create a separate database or “data extract” for a use or disclosure permitted by the HIPAA regulations, UAMS will undertake reasonable efforts to limit access to the PHI in the data extract to the Minimum Necessary to carry out the duties of the workforce member or to the amount reasonably necessary to achieve the purpose of the disclosure. 

All such uses or disclosures of data extracts containing PHI must be in compliance with UAMS policies, federal and state law, and HIPAA regulations.

UAMS will identify those persons and job titles authorized to perform searches of data to produce and receive data extracts.  Periodic audits to determine compliance with this Policy will be conducted.

PROCEDURE

A.                UAMS Information Technology Department will maintain an inventory of databases containing PHI.

B.                 UAMS workforce members seeking an electronically stored data extract containing PHI must complete a "Request for Data Extract" and submit it to the UAMS custodian of the data who must be authorized by UAMS to perform searches of data to produce extracts.  A form is available for your convenience.

C.                The following information must be included in the request:

1.                 Name, job title and phone number.

2.                 Complete description of data required including time periods, specific search criteria and other information needed from the database.

3.                 Entities or individuals for whom the use or disclosure of the PHI is required.

4.                 The purpose of the use or disclosure of the data requested.

5.                 “Yes” and “no” boxes for the requestor to indicate:

a.                   Is the requestor a Principle Investigator or Research Assistant?

b.                   If the data will be used for research, has an appropriate patient authorization been obtained or has an IRB waiver of authorization been granted?

c.                   If the data requested is to conduct research on deceased individuals, is the Certification for Use or Disclosure of Protected Health Information for Deceased Individuals form current and on file in the UAMS Office of Research and Sponsored Programs.

d.                  If the data is to be used for Review Preparatory to Research, is the Certification for Use or Disclosure of Protected Health Information for the Purpose of Review Preparatory to Research form current and on file in the UAMS Office of Research and Sponsored Programs.

6.                 Statement that the requesting party certifies that the information requested is the Minimum Necessary to carry out his or her job duties; or if the request is for a disclosure of PHI, a statement that the requesting party certifies that the information requested is the Minimum Necessary to accomplish the purpose of the disclosure.

7.                 Any other information requested by the custodian of the database.  A custodian may request completion of a “Request for Data Extract” form. 

D.                If the purpose of the data request is for research or review preparatory to research and the appropriate boxes under (C)(5)(b) through (C)(5)(d) above are not marked “yes,” the request must be denied.   If the purpose of the data request is a use or disclosure that is not permitted by the UAMS policies, federal or state law, and the HIPAA regulations, the request must be denied.

E.                 Request for Information for Fundraising Purposes:  UAMS will use only the following information for Fundraising purposes.   See UAMS Use and Disclosure of PHI for Fundraising Policy, 3.1.35

            1.         a patient’s demographic information; and

            2.         dates of health care services provided to the patient.

No other PHI may be used or disclosed by UAMS for Fundraising purposes without the patient’s signed authorization using the UAMS Authorization for Use/Disclosure of PHI for Fundraising Form.

F.                 The UAMS personnel providing the data extract shall record the date the extract was given to the requesting party and shall maintain a copy of the Request for a minimum of six years from the date of the request.

G.                UAMS may rely, if such reliance is reasonable under the circumstances, on a requested use as the Minimum Necessary for the stated purpose when the information is requested by a professional who is a member of the UAMS workforce if the professional represents that the information requested is the Minimum Necessary to carry out his or her job duties; or if the request is for a disclosure of PHI, UAMS may rely on representations from the person requesting the information that the information requested is the Minimum Necessary to accomplish the purpose of the disclosure.

H.                For all requests of data extracts containing PHI that will be disclosed outside of UAMS, the UAMS HIPAA Office must approve these requests, including requests by individuals who are not members of the UAMS workforce.

I.                   Knowledge of a violation or potential violation of this policy must be reported.  Refer to UAMS  Reporting Policy for HIPAA Violations, 3.1.23.

J.                  Disciplinary action may be imposed for accessing, using, or disclosing PHI in violation of this policy.

For a printable version of the form below, please see the Request for Data Extract Word document.

UAMS REQUEST FOR DATA EXTRACT FORM

All of the information below  must accompany all requests for data extracts that contain

identifiable patient information.

It is the policy of UAMS to protect the privacy and security of a patient’s Protected Health Information (PHI).

 

Requestor’s Name                                                                                                                                                                                                                                                    

Requestor’s Job Title _____________________________________Phone #                                              

 

Description of data required (include time periods, specific search criteria, etc.):                                          

 

_____________________________________________________________________________________         

 

_____________________________________________________________________________________         

 

Entities and/or individuals for whom the use or disclosure of PHI is required: ______________________  

 

_____________________________________________________________________________________         

 

_____________________________________________________________________________________         

 

Purpose of the use or disclosure of the requested data: _________________________________________           

 

_____________________________________________________________________________________         

 

_____________________________________________________________________________________         

         Is the requestor a Principal Investigator?  □ yes   □ no

         If data will be used for research, has an appropriate patient authorization been obtained or has an IRB waiver of authorization been granted?   □ yes   □ no     □ N/A

            If “no”, you must submit the appropriate authorization or waiver before requested data can be released.

         If the data requested is to conduct research on deceased individuals, is the Certification for Use or Disclosure of Protected Health Information of Deceased Individuals form current and on file in the UAMS Office of Research and Sponsored Programs, #636   □ Yes   □ No     □ N/A

         Text Box: I am a member of the UAMS workforce and certify that the information requested is the minimum necessary to carry out job duties/accomplish research goals and will be used for the purpose stated above.  I am making this request in compliance with the UAMS Minimum Necessary Policy 3.1.25 and, if applicable, with Research Policy 3.1.27.
Signature of Requestor _________________________________________________Date ______________________
If data requested is to be used for Review Preparatory to Research, is the Certification for Use or Disclosure of Protected Health Information for the Purpose of Review Preparatory to Research form current and on file in the UAMS Office of Research and Sponsored Programs, #636   □ Yes  □ No  □ N/A