Accessing Patient Records
HIPAA regulations can be confusing and sometimes misunderstood. There is a difference in what you are allowed to access in your role as a health care professional/employee versus what you may access in your role as a parent, family member, or neighbor.
As a health care professional and/or employee, you have access to information which you need to know to perform your job and provide care to your patients. In general this means that you may, without the patient’s permission:
Discuss the patient’s care with other providers within and outside Cooper, e.g., a Cooper physician discussing a hospital stay with the patient’s primary care physician; or
- Discuss the patient’s care with the patient’s care designee; or
- Provide a copy of the patient’s medical record to a patient’s specialist, nursing home, rehab center, etc.
Actions such as those above are defined under HIPAA as “purposes of treatment.” “Purposes of treatment” means activities that you are performing as part of your job at Cooper as a professional treating provider. Unless you are accessing the patient’s medical record as part of your Cooper job responsibilities to treat the patient, you are NOT accessing the record for purposes of treatment.
A HIPAA violation occurs when an employee (physician or otherwise) accesses the medical record of any individual that is not related to the performance of the employee’s job responsibilities (treatment, payment, or operations) UNLESS Cooper has a signed written authorization from the patient authorizing the employee or physician to allow access to their medical record.
The following outline summarizes conduct consistent with Cooper policy and HIPAA requirements (acceptable) vs. conduct that is not (unacceptable) and the disciplinary process that will follow unacceptable conduct. This policy will apply to all employees including physicians:
Accessing your own medical record – Acceptable to access your own medical record. (Cooper prefers that in lieu of accessing your own medical record, you set up a MyCooper account which can be accomplished by contacting your PCP office.)
Accessing the medical record of an adult family member living within your household WITH a signed written authorization (see attachment). The authorization form must be signed prior to the access, scanned into the patient’s Epic medical record and is good for 1 year. – Acceptable to access the medical record, assuming there is not malicious intent. (Cooper prefers that, in lieu of accessing the patient’s medical record directly, you set up a proxy access in MyCooper, which can be accomplished by contacting the patient’s PCP office).
Accessing the medical record of an adult family member living within your household outside of payment, treatment and operations WITHOUT a signed written authorization. – Unacceptable to access the medical record.
- First Offense – written warning and re-education, assuming there is no malicious intent.
- Second Offense – termination
Accessing the medical record of your custodial minor family member under the age of 12 – Acceptable to access the medical record, assuming there is no malicious intent.
Accessing the medical record of your own minor family member outside of payment, treatment and operations over the age of 12 – Unacceptable.[1]
- First Offense – written warning and re-education, assuming there is no malicious intent.
- Second Offense – termination
Accessing the medical record of all other adult individuals WITH a signed written authorization (see attachment). The authorization form must be signed prior to the access, scanned into the patient’s Epic medical record and is good for 1 year. –Acceptable to access the medical record, assuming there is no malicious intent. (Once again, Cooper prefers that you set up proxy access in MyCooper in lieu of accessing the patient record directly).
Accessing the medical record of all other adult individuals outside of payment, treatment and operations WITHOUT a signed written authorization. -Unacceptable to access the medical record.
- First Offense – termination
Accessing the medical record of all other minor individuals outside of payment, treatment and operations. – Unacceptable to access the medical record.
- First Offense – termination
Cooper reserves the right to vary the discipline outlined above based on the existence of mitigating or aggravating circumstances.
Please click here for the HIPPA authorization form
These requirements and limits apply to all Cooper personnel and medical staff members. If you have questions, please call Cooper’s Privacy Officer, Phil Curran, at 856.361.1697 or e-mail privacyofficer@cooperhealth.edu.
______________________________
[1] Under N.J. law, minors are treated as adults for the purpose of consent to treatment in certain areas, including pregnancy, venereal disease, HIV, drug and alcohol dependency, and treatment in connection with a sexual assault. Since EPIC does not provide a mechanism to limit access to these protected areas, the expectation is that the employee will communicate with HIM to obtain the medical record so that HIM will have the opportunity to redact any information protected by the statutory prerogatives for minors’ consent to care.