POLICY: USE DISCLOSURE AND ACCESS TO
PROTECTED HEALTH INFORMATION
PURPOSE
To establish requirements for protecting the confidentiality of patient health information and for the lawful use, disclosure, access, inspection, copying, and release of protected health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA), applicable federal law, Louisiana law, Medicare hospice requirements, and Brighton Bridge Hospice policies.
POLICY
Brighton Bridge Hospice shall protect PHI in every form and permit access, use, and disclosure only under a lawful basis. This policy applies to employees, volunteers, students, contractors, and other persons acting for BBH. Follow HIPAA, Medicare hospice requirements, Louisiana law, and additional confidentiality protections when applicable. A patient’s direction alone does not override legal restrictions. Apply the controlling requirement that provides greater privacy or access protection where required by law.
DEFINITIONS
PHI means individually identifiable protected health information in paper, electronic, verbal, photographic, or other form. A personal representative is a person with applicable legal authority to act for the patient within the scope of that authority. The Privacy Officer is the designated official responsible for privacy requests, decisions, complaints, and compliance.
PROCEDURE
I. PROTECTED HEALTH INFORMATION
Protected health information includes individually identifiable health information maintained or transmitted by Brighton Bridge Hospice in any form or medium, including:
II. NOTICE OF PRIVACY PRACTICES
Provide the current Notice of Privacy Practices no later than first service delivery. In an emergency, provide it as soon as reasonably practicable. Except in an emergency, make a good-faith effort to obtain written acknowledgment; document unsuccessful efforts and the reason. Acknowledgment is receipt of the notice, not authorization for other disclosures.
Make the notice available on request, post it prominently at service sites where patients can reasonably read it, and prominently post and make it electronically available on any hospice website describing services or benefits. Provide a paper copy on request, including after electronic delivery. Revise the notice when required and promptly make the revised notice available and post it as applicable.
The notice shall identify permitted uses and disclosures, patient rights, agency duties, complaint procedures, and the Privacy Officer contact. It shall include the applicable 2026 provisions for records protected by 42 CFR Part 2 and fundraising opt-out rights. This internal policy supports the notice and does not replace it.
Provide the Notice of Availability of Language Assistance Services and Auxiliary Aids and Services with the Notice of Privacy Practices, including the required Louisiana translations and accessible formats. Include it with admission and intake forms, consent forms, patient handbooks, complaint forms, and other communications covered by 45 CFR 92.11(c)(5). Provide it at least annually to patients and upon request; post it conspicuously on the hospice website and in clear, prominent physical locations. Physical postings shall use at least 20-point sans-serif type. The Privacy Officer shall maintain the current notice and verify that it includes English and at least the 15 languages most commonly spoken by people with limited English proficiency in Louisiana. Any individual alternative under 45 CFR 92.11(d) must meet and document all applicable conditions; silence is not an opt-out.
III. DISCLOSURES FOR TREATMENT, PAYMENT, AND HEALTHCARE OPERATIONS
Brighton Bridge Hospice may use and disclose PHI without a separate written authorization for treatment, payment, and healthcare operations when permitted by HIPAA.
Examples may include appropriate disclosures to:
Such disclosures shall be limited to information appropriate for the permitted purpose.
Louisiana hospice requirements also apply: obtain and retain written consent from the patient or legally authorized representative before releasing patient information or records, unless the release is required by law. The Privacy Officer shall confirm both federal and Louisiana authority. A notice acknowledgment is not release consent, and family relationship alone does not establish authority. Apply this requirement to the disclosures described in this policy, including Section VI.
IV. MINIMUM NECESSARY STANDARD
Apply role-based access and limit uses, requests, and disclosures to the information needed for the task when the minimum necessary rule applies. Routine disclosures shall follow approved protocols; the Privacy Officer shall review nonroutine requests. Staff may not browse records out of curiosity.
The rule does not apply to disclosures to or requests by a healthcare provider for treatment, disclosures to the individual, disclosures under a valid authorization, disclosures to HHS for enforcement, disclosures required by law, or disclosures required for HIPAA administrative simplification. Internal access remains subject to assigned duties and safeguards. Treatment exceptions do not remove special confidentiality protections.
V. PATIENT AUTHORIZATION
Obtain a valid, plain-language authorization before a use or disclosure requiring authorization. It must identify the information, authorized discloser, recipient, purpose (including “at the request of the individual” when applicable), expiration date or event, signature, signature date, and representative authority when applicable.
Include required statements about written revocation and its exceptions, whether conditioning treatment or benefits is permitted and the consequences, and possible redisclosure. Give the individual a copy when the hospice seeks the authorization. Do not use expired, revoked, materially incomplete, or otherwise defective authorizations.
Document written revocation promptly and stop future reliance, except to the extent action has already been taken in reliance. Do not condition hospice treatment on an authorization except where expressly permitted by law.
Psychotherapy notes generally require separate authorization, subject to specific exceptions. Most marketing and sale-of-PHI activities require authorization; identify remuneration when required. A general admission consent or notice acknowledgment does not authorize advertising, testimonials, public photographs, or social-media disclosure. Any permitted fundraising use shall follow HIPAA limits, described in the notice, and offer a clear, easy opt-out in each communication. Honor opt-outs and do not condition care or payment on accepting fundraising communications. Apply additional Part 2 consent requirements when relevant.
VI. PATIENT DESIGNATED FAMILY MEMBERS AND OTHER INDIVIDUALS
The patient may identify family members, caregivers, friends, or other individuals with whom Brighton Bridge Hospice may communicate regarding the patient's care.
The hospice shall verify the identity and authority of individuals requesting PHI before disclosure.
When permitted by HIPAA, hospice personnel may share information directly relevant to an individual's involvement in the patient's care or payment for care when:
A signed authorization is not required for every communication with an involved caregiver when HIPAA otherwise permits the disclosure.
VII. IDENTITY VERIFICATION
Before releasing PHI, Brighton Bridge Hospice shall take reasonable steps to verify:
Verification methods may include information such as:
VIII. PATIENT RIGHT OF ACCESS
A patient or legally authorized personal representative has the right to inspect and obtain a copy of PHI contained in the designated record set, subject to limitations permitted by HIPAA.
A patient may request:
The hospice shall not require the patient to provide a reason for exercising the right of access.
The hospice shall not require the patient to hire an attorney or have legal counsel request the record.
The designated record set includes medical and billing records and other records used to make decisions about individuals, including records maintained by a business associate for BBH. Do not require a HIPAA disclosure authorization, a reason, an in-person visit, or an attorney merely to obtain the individual’s own records. A reasonable written access request may be required if patients are informed. Verify identity without creating unreasonable barriers.
A signed request directing an electronic copy of an electronic health record to a third party shall clearly identify the recipient and destination. Apply the current HHS guidance following Ciox when classifying third-party requests; other releases may use a valid authorization or another lawful basis.
IX. TIMEFRAME FOR ACCESS
Date-stamp each request and route it to the Privacy Officer or records custodian the same business day. Record the requester, scope, identity verification, format, delivery method, due date, and completion date.
BBH shall provide access promptly and use a 15-calendar-day completion standard. Louisiana R.S. 40:1165.1(A)(2)(c) addresses production within a reasonable time not exceeding 15 days after receipt of the request and written authorization. Help the requester promptly resolve missing information; do not impose unnecessary authorization requirements on an individual seeking their own records.
HIPAA otherwise requires action within 30 calendar days of receipt and permits one additional period of no more than 30 days with written reasons and a completion date furnished within the initial period. This federal extension does not override an applicable shorter Louisiana deadline. Escalate anticipated delays immediately; do not treat the extension as routine or wait until the last day to respond.
X. FORM AND FORMAT OF RECORDS
When PHI is readily producible in the form and format requested by the patient, Brighton Bridge Hospice shall provide it in that form and format.
When it is not readily producible, the hospice and patient shall agree upon an alternative readable form or format.
If PHI is maintained electronically and the patient requests an electronic copy, an electronic copy shall be provided when required by HIPAA.
Records may be transmitted through appropriate methods such as:
Reasonable safeguards shall be used to protect confidentiality.
XI. FEES FOR PATIENT ACCESS REQUESTS
Brighton Bridge Hospice may charge a fee for copies provided pursuant to an individual's HIPAA right of access only when permitted by federal and Louisiana law.
For an individual's HIPAA access request, any fee shall be reasonable and cost-based and shall be limited to costs permitted by 45 CFR §164.524.
Permissible costs may include, when applicable:
The hospice shall not charge the patient for:
Per-page fees shall not be charged for electronic copies of PHI maintained electronically when prohibited by HIPAA.
When both Louisiana law and HIPAA apply, Brighton Bridge Hospice shall follow the requirement that provides the patient the greater privacy or access protection, as applicable.
Staff shall follow the agency’s approved fee schedule for record copies, consistent with applicable law.
Provide an advance fee estimate. No fee applies merely to inspecting records. Do not withhold HIPAA access because the patient owes for healthcare. Distinguish the individual’s own access request, including a personal representative acting within authority, from a third-party release; apply current HHS Ciox guidance and Louisiana limits to the latter. Do not automatically apply Louisiana handling or per-page charges to a HIPAA individual-access request.
XII. DENIAL OF ACCESS
Only the Privacy Officer, with an appropriately licensed healthcare professional when required, may approve a denial on lawful grounds. Psychotherapy notes kept separately from the medical record and information prepared for legal proceedings are excluded from the HIPAA access right; ordinary clinical, social work, and counseling notes are not automatically psychotherapy notes.
A concern that the patient may be upset, unpaid care bills, or an unfinished chart is not by itself a valid HIPAA denial. Do not apply a broader state denial ground that impermissibly limits the federal access right.
Provide a timely written denial explaining the basis, applicable review rights, how to seek review, and how to complain to BBH or HHS, with the designated contact’s name or title and telephone number. Provide accessible portions of the record. For a reviewable denial, arrange prompt review by a licensed healthcare professional not involved in the original decision, notify the requester in writing, and follow that decision. If BBH does not hold the requested information but knows where it is maintained, direct the requester there.
XIII. AMENDMENT OF RECORDS
Patients may request amendment of PHI in the designated record set. BBH may require a written request and reason if patients are informed in advance. Act within 60 calendar days; one extension of up to 30 days is allowed with written reasons and a completion date sent within the original period.
If accepted, identify and append or link the amendment, inform the patient, and obtain agreement to notify relevant recipients. Make reasonable efforts to notify persons identified by the patient and known recipients, including business associates, who may rely on the information to the patient’s detriment.
A denial must be based on a permitted ground: information not created by BBH (unless its originator is unavailable to act), outside the designated record set, excluded from access, or accurate and complete. Give a written explanation, statement-of-disagreement rights, the right to request that the denial and amendment request accompany future disclosures if no disagreement is submitted, and complaint instructions. Link the request, denial, disagreement, and any rebuttal to the record and include them or an accurate summary in later disclosures as required. Preserve original entries and the audit trail.
XIV. PERSONAL REPRESENTATIVES
Verify legal authority, its scope, and any conditions before treating another person as the patient. A healthcare power of attorney, court appointment, or applicable Louisiana surrogate law may establish authority; family relationship or financial power of attorney alone does not automatically establish full authority over a living patient’s records.
Document the authority and whether it is currently effective. Limit access to the matters covered by it. Apply the special rules for minors and legally consented confidential services when relevant.
The Privacy Officer may decline to recognize a representative where HIPAA permits this because of a reasonable belief of abuse, neglect, domestic violence, or endangerment and professional judgment supports that doing so is not in the patient’s best interest. Document the basis and obtain legal guidance when needed.
XV. DECEASED PATIENTS
HIPAA protects identifiable health information for 50 years after death; this does not require retaining the chart for 50 years. Verify the authority of an executor, administrator, or other person legally authorized to act for the deceased or estate.
Louisiana R.S. 40:1165.1 also identifies the surviving spouse, parents, and children among persons entitled to request deceased-patient records subject to its requirements. The Privacy Officer shall verify identity, relationship, documentation, and the lawful basis for release, including any special confidentiality restrictions.
HIPAA permits relevant disclosures to persons involved in care or payment before death unless inconsistent with a known prior preference of the patient. This limited permission is distinct from access to the entire record. Do not assume that a healthcare power of attorney continues after death.
XVI. REQUIRED OR PERMITTED DISCLOSURES WITHOUT AUTHORIZATION
PHI may be disclosed without patient authorization when permitted or required by law.
Examples may include disclosures for:
Staff shall consult the Administrator when there is uncertainty regarding a requested disclosure.
XVII. SUBPOENAS AND LEGAL REQUESTS
Immediately forward subpoenas, court orders, attorney requests, and law-enforcement demands to the Privacy Officer. Preserve potentially relevant records. A subpoena or request alone does not automatically authorize release.
For a court or administrative order, release only the information expressly authorized and otherwise lawfully disclosable. For a subpoena or discovery request without an order, verify the required notice to the patient, qualified protective order, or another lawful HIPAA basis. Confirm Louisiana privilege and procedural requirements before release, obtaining legal counsel when needed.
Apply stricter protections for Part 2 and other specially protected records. Keep the demand, verification, legal basis, scope released, recipient, date, and any required accounting entry. Do not delay a mandatory report while seeking routine administrative approval.
XVIII. COMMUNICATION BY TELEPHONE
Before discussing PHI by telephone, staff shall make reasonable efforts to verify the identity and authority of the person receiving the information.
Telephone discussions shall occur in a manner that reasonably protects patient privacy.
Voicemail messages shall contain only the minimum information appropriate under the circumstances.
XIX. EMAIL, TEXTING, AND ELECTRONIC COMMUNICATION
PHI transmitted electronically shall be protected through safeguards consistent with HIPAA and agency security policies.
Staff shall use agency approved systems for transmission of PHI whenever required.
PHI shall not be transmitted through personal accounts or unauthorized communication systems contrary to agency policy.
Electronic communication with patients and caregivers shall be performed in accordance with the patient's preferences, applicable privacy requirements, and reasonable safeguards.
Verify addresses and fax numbers before sending. Protect devices with approved access controls, lock screens, secure storage, and timely access termination. Use audit controls, backups, risk assessment, and contingency procedures under agency policies and procedures for protecting electronic patient information. Do not place PHI in unapproved AI tools, personal cloud storage, or consumer messaging applications. Document the patient’s informed choice before unencrypted email delivery; a patient’s preference does not authorize staff to bypass safeguards for unrelated communications.
XX. FACILITY PATIENTS AND IDT COMMUNICATION
For patients in nursing facilities, assisted living, hospitals, or other settings, exchange information lawfully needed to coordinate care. Verify recipients and use approved communication systems and applicable written agreements. Maintain BBH’s own complete hospice record, with appropriate access to relevant facility documentation; do not mingle hospice records with another agency’s records.
The interdisciplinary team (IDT/IDG) shall share current assessments, plans of care, orders, and changes with authorized clinicians and involved facilities. BBH schedules IDT review and updates every 14 days unless the scheduled date falls on a holiday. When a holiday affects the schedule, arrange review so the comprehensive assessment and plan of care are reviewed and updated at least every 15 calendar days and sooner when the patient’s condition requires. Holidays do not extend the regulatory maximum.
Discuss patients in private settings. Restrict attendance and access to people with an authorized role. A facility relationship does not authorize unrestricted access to all hospice records. On transfer to a Medicare/Medicaid-certified facility, forward the discharge summary and, if requested, the clinical record. On revocation or discharge, forward the summary and requested clinical record to the attending physician. Include the course of care, current plan, latest orders, and information needed for continuity.
XXI. BUSINESS ASSOCIATES
Before a vendor creates, receives, maintains, or transmits PHI on BBH’s behalf, determine whether a Business Associate Agreement (BAA) is required and execute it before access. Examples include EMR hosting, billing, record storage, and certain IT services. A provider receiving information solely for treatment is not a business associate for that reason alone.
BAAs shall address permitted uses, safeguards, incident and breach reporting, subcontractor obligations, assistance with patient rights, access by HHS, termination, and return or destruction of PHI when feasible. Track agreements and address material violations. Outsourcing records does not transfer BBH’s responsibility for timely patient access.
XXII. UNAUTHORIZED ACCESS AND BREACH RESPONSE
Immediately report suspected unauthorized access, lost records or devices, misdirected communications, improper disposal, or cybersecurity events to the Privacy Officer and designated security official. Staff shall preserve evidence, follow containment instructions, and avoid deleting logs or investigating independently.
The Privacy Officer shall document discovery, contain the incident, mitigate harm, and assess whether a HIPAA breach exception applies or whether there is a low probability of compromise. Unless an exception applies, an impermissible use or disclosure is presumed to be a breach unless a documented assessment supports a low probability of compromise. Assess the information and identifiers involved, the unauthorized recipient, whether information was actually acquired or viewed, and mitigation.
For a reportable breach of unsecured PHI, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Use required content and delivery methods, including substitute notice when required. For breaches affecting 500 or more individuals, notify HHS at the same time affected individuals are notified, without unreasonable delay and no later than 60 calendar days after discovery. For fewer than 500, maintain a log and report no later than 60 days after the end of the discovery year. Notify prominent media when more than 500 residents of a state or jurisdiction are affected. Apply legally permitted law-enforcement delays only when documented.
Also evaluate Louisiana R.S. 51:3071–3077 and applicable Attorney General rules, including state timing, notice, and reporting obligations; federal reporting does not automatically satisfy every state duty. Coordinate Part 2 requirements when protected SUD records are involved. Maintain the assessment, notices, decisions, and corrective actions.
XXIII. ACCOUNTING OF DISCLOSURES
Maintain the date, recipient and address if known, description of PHI, and purpose or lawful basis for disclosures subject to accounting, including applicable business-associate disclosures. Preserve required information for six years.
Provide the accounting requested for up to the preceding six years within 60 calendar days. One additional period of up to 30 days is permitted with timely written reasons and a completion date. The first accounting in any 12-month period is free; notify the individual in advance of any reasonable cost-based fee for another accounting and allow withdrawal or modification.
Exclude disclosures HIPAA exempts, such as treatment, payment, healthcare operations, disclosures to the individual, authorized disclosures, and qualifying care-involvement disclosures. Apply required oversight or law-enforcement suspensions only on a documented lawful basis. The Privacy Officer shall separately evaluate any additional Part 2 accounting obligations and their applicable effective dates.
XXIV. STAFF CONFIDENTIALITY
All Brighton Bridge Hospice employees, contractors, volunteers, students, and other workforce members shall protect patient confidentiality.
Workforce members shall not:
Violations may result in corrective or disciplinary action consistent with agency policy.
XXV. DOCUMENTATION AND RECORD RETENTION
Keep required HIPAA policies, notices, authorizations, training records, complaints, rights-request responses, breach documentation, and related compliance records for at least six years from creation or the date last in effect, whichever is later.
Retain clinical records under BBH’s approved record retention schedule and the longest applicable federal, Louisiana, payer, or contractual requirement. Medicare hospice rules require at least six years after death or discharge unless state law requires longer. A shorter general schedule shall not reduce that minimum. Suspend destruction for litigation, audit, investigation, preservation requests, or other applicable holds until authorized release of the hold and expiration of all retention requirements.
Store records securely and make them retrievable for authorized care, patient access, and oversight. Establish custody and patient access arrangements if BBH ceases operation, consistent with state law. Approved destruction shall render paper unreadable and electronic data unrecoverable using appropriate methods, with a destruction record and vendor safeguards. If operations cease, notify the state agency and CMS Regional Office where records will be stored and how they can be accessed.
XXVI. RESTRICTIONS AND CONFIDENTIAL COMMUNICATIONS
Patients may request restrictions on use or disclosure. BBH need not accept every restriction but shall honor an accepted restriction and document its scope and lawful termination. Emergency treatment exceptions shall be handled under HIPAA, including requesting that the recipient not further disclose restricted information.
Honor a request not to disclose to a health plan for payment or healthcare operations when the PHI relates solely to a service or item paid in full by the individual or someone other than the health plan on the individual’s behalf, unless disclosure is required by law. Route such requests to the Privacy Officer and billing staff; do not promise restrictions inconsistent with required Medicare reporting.
Accommodate reasonable requests for communications by alternative means or at alternative locations. Do not require an explanation. BBH may require a written request, a workable alternative address or method, and information on handling payment when appropriate. Record and communicate approved preferences to responsible staff.
XXVII. SPECIALLY PROTECTED RECORDS
The Privacy Officer shall determine whether records received are protected by 42 CFR Part 2. A substance use diagnosis or hospice opioid prescription alone does not make every hospice record a Part 2 record. Identify protected records and maintain any associated consent and redisclosure restrictions.
For Part 2 records, confirm valid consent or a specific exception before use or disclosure. When records are received under consent for treatment, payment, and healthcare operations, HIPAA-regulated recipients may redisclose as Part 2 permits, subject to its restrictions. Include the required Part 2 notice and consent copy or clear scope explanation when required. Separate consent requirements apply to SUD counseling notes.
Do not use or disclose Part 2 records or testimony in proceedings against the patient without the required specific consent or qualifying Part 2 court order and associated legal process. A routine HIPAA authorization, subpoena, or general TPO consent may be insufficient. Apply Part 2 emergency, audit, and other exceptions only within their conditions and document the basis.
Evaluate additional protections for HIV-related information, mental health records, genetic information, and minor-consented services under applicable Louisiana and federal law. Refer uncertain requests for review before release. Do not withhold ordinary records solely because they mention a sensitive diagnosis.
XXVIII. PRIVACY ADMINISTRATION AND COMPLAINTS
The Administrator shall serve as the Privacy Officer unless the governing body designates another qualified individual. The hospice shall also designate a security official responsible for electronic protected health information safeguards. Maintain current contact information in the notice and staff directory. Staff shall direct privacy requests and complaints promptly to the Privacy Officer.
Train new workforce members within a reasonable time after joining and affected staff within a reasonable time after material policy changes. BBH shall also provide annual refresher education as an agency practice. Document completion, apply appropriate sanctions consistently, and mitigate known harmful effects of improper disclosures.
Accept and document complaints, investigate, and record resolution and corrective action. Inform patients of their right to complain to HHS Office for Civil Rights and applicable oversight agencies. Do not retaliate, intimidate, or require waiver of HIPAA rights as a condition of care. Provide language and disability communication assistance as required.
Language assistance and effective communication
Ask the patient and, when relevant, the companion about their preferred language and communication needs. Record the need and the assistance provided. Arrange qualified language interpreters, including qualified sign language interpreters, and appropriate communication aids or accessible information promptly and at no cost to the individual. Give primary consideration to the aid or service requested by a person with a disability and ensure communication is effective.
Staff shall access the hospice’s contracted interpreting service for qualified human interpreting appropriate to the encounter and medical terminology. The Administrator shall maintain staff access instructions, verify contracted services and availability, and arrange an effective alternative when the service, connection, equipment, or interpreter does not meet the individual’s needs. For video sign language interpreting, ensure a clear, real-time view of the interpreter and the patient’s face, hands, arms, and fingers, adequate sound where used, and staff able to operate the equipment. Arrange another effective method, including an in-person interpreter when needed, if video is ineffective.
Do not require a patient to supply or pay for an interpreter. Do not routinely use minor children, unqualified staff, or accompanying adults to interpret; apply only the narrow exceptions permitted by law. Use qualified translators when written translation is required. Machine translation of critical or complex information must receive the qualified human review required by law.
The Privacy Officer shall verify the required business associate agreement and confidentiality safeguards for the contracted interpreter service before patient information is shared. Use approved private connections and disclose only information appropriate for the encounter. Train affected staff on requesting assistance, communicating with the patient, protecting information, and documenting service delivery. Direct service failures or unresolved communication needs promptly to the Administrator or Privacy Officer for correction.
Review this policy at least annually as an agency practice and when laws or operations change. Monitor access-request timeliness, access logs, incidents, BAAs, and corrective actions through the agency’s compliance and QAPI processes.
Revised: 02/16/2026; 10/02/2026