Is Emergency Information PHI?

[PhilB]

My company is a hybrid entity under HIPAA - we are a plan sponsor, administrator, and operate an on-site clinic. In the past, our administrator unit has shared information relating to employees' medical conditions with our medical department so thatthey would have up to date information in the event of a work related medical emergency. Is this type of information considered PHI or would it fall under "employment records" (such as the emergency health information forms many employers have new employees complete?

[Jbentz]

Do you have a signed release from the patient/employee?

[Steve72]

When you refer to the "administrator unit", I assume you mean those employees who work on behalf of the plan. IIHI received by these individuals is PHI, and should be used and disclosed in accordance with HIPAA's rules.

A signed release will not permit the disclosure unless it is a HIPAA compliant authorization (including the requirement that the authorization have a specified expiration date or event).

A covered entity may release PHI for treatment purposes of a health scare provider. If the individual requires treatment, the administrator may disclose relevant PHI to the clinic, subject to the minimum necessary rule. However, it sounds as if the PHI is bveing released prior to any tretment need. This would likely go beyond the permitted disclosure, and would almost certainly violate the minimum necessary rule.