CHS may use or disclose PHI without the written authorization of the individual or the opportunity for the individual to object in the situations described in the policy.  When CHS is required by this section to inform the individual of, or when the individual may agree to, a use permitted by this section, the individual’s agreement can be given orally.

CHS may disclose PHI to a public health authority such as the Oklahoma State Department of Health or the Tulsa County Health Department that are authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury or disability.  This includes, but is not limited to the reporting of:

• Disease
• Injury
• Births
• Deaths
• Public health surveillance
• Public health investigations
• Public health interventions

CHS may also, at the direction of a public health authority, disclose the above to an official of a foreign government agency that is acting in collaboration with a public health authority.

CHS may disclose PHI to a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect.

CHS may disclose PHI to a person under the jurisdiction of the Food and Drug Administration with respect to an FDA regulated product or activity for which that person ahs responsibility for the purpose of activities related to the quality, safety or effectiveness of such products or activities.  This may include:

• Collecting or reporting adverse events with food or dietary supplements
• Product defects or problems
• Biologic product deviations
• To track FDA regulated products
• To enable product recalls, repairs or replacements, including notifying individuals who have received products that have been recalled
• To conduct post marketing surveillance.

CHS may disclose to a person who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease or condition, if CHS or public health entity is authorized by law to notify such person as necessary in the conduct of public health intervention or investigation.

CHS may disclose PHI to an employer of an individual who is a member of the workforce of the employer if the individual is an employee of OSU or is providing care to the individual at the request of the employer.  The uses of the PHI in this case is limited to:

• Conducting an evaluation relating to medical surveillance of the workplace
• To evaluate whether the individual has a work-related illness or injury

The PHI released to the employer consists of findings concerning a work related illness or injury or a workplace related medical surveillance.

The PHI is required by the employer to comply with Federal reporting requirements or under state law relating to reporting workplace illnesses or injuries or workplace medical surveillance.

CHS must provide the individual with a copy of the CHS Notice to Patients Being Treated of Work Related Illness or Injury. 

CHS may disclose PHI about an individual whom we believe to be a victim of abuse, neglect or domestic violence to a governmental authority including a social service or protective service agency authorized by law to receive such reports.  CHS will make such reports to the extent that the disclosure is required by law and the disclosure complies with and is limited to the relevant requirements of the law.  

CHS will make such a reports if the individual agrees to the disclosure or to the extent that the disclosure is specifically authorized by statute or regulation.  Such a disclosure will be made if a CHS provider exercising professional judgment believes the disclosure is necessary to prevent serious harm to the individual or other potential victims. 

CHS may also disclose if the individual is unable to agree because of incapacity and a law enforcement or other public official authorized to receive the report represents that the PHI is not intended to be used against the individual and that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to such a disclosure.

If CHS makes a disclosure under this section of this policy, CHS must inform the individual that such a report has been made or will be made.  However, if in the
professional judgment of the CHS provider, such information would place the individual at risk or harm, the notice can be excepted.

If CHS would be informing a personal representative of the disclosure and CHS believes that the personal representative is responsible for the abuse, neglect or other injury, and that informing such person would not be  in the best interest of the person, such notice is excepted.

CHS may disclose PHI to a health oversight agency for oversight activities authorized by law.  This includes:

• Audits
• Civil, administrative or criminal investigations
• Inspections
• Licensure or disciplinary actions
• Civil, administrative or criminal proceedings or actions
• Other activities necessary for appropriate oversight of:
  • The health care system
  • Government benefit programs
  • Compliance with governmental program standards
  • Civil rights laws for which health information is necessary

For the purpose of these disclosures, a health oversight activity does not include an investigation or other activity in which the individual is the subject of the investigation or activity that is not directly related to:

• Receipt of health care
• Claim for benefits related to health
• Qualification for receipt of public benefits or services

CHS may disclose PHI for judicial and administrative proceedings. CHS may disclose PHI in response to an order of a court with the PHI limited to only that for which the order is expressly authorized. 

CHS may also disclose PHI in response to a subpoena, discovery request or other lawful process if:

• CHS receives satisfactory assurance from the party seeking the information that efforts have been made by such party to ensure that the individual who is subject to the PHI has been given notice; or
• CHS receives satisfactory assurance from the party seeking the PHI that reasonable efforts have been made to secure a qualified protective order that meets the requirements under this section.

Any such request will be directed to the Compliance Office and/or OSU Legal Counsel for direction.

Satisfactory assurance required is a written statement and accompanying documentation that:

• The parties to the dispute have agreed to a protective order and have present it to the court with jurisdiction; or
• The party seeking the PHI has requested a protective order

A qualified protective order means an order of a court or a stipulation by the parties to the litigation that:

• Prohibits the parties from using or disclosing the PHI for any purpose other than the litigation or proceeding; and
• Requires the return to CHS or destruction of the PHI and all copies of the PHI at the end of the litigation or proceeding.

CHS may disclose PHI in response to a lawful process without receiving the described assurances if CHS makes reasonable efforts to provide notice to the individual. 

CHS may disclose PHI for law enforcement purposes. CHS will make such disclosures if the following conditions are met, as applicable:

• As required by law that require the reporting of certain wounds or injuries;
• In compliance with and limited to the relevant requirements of a court order, subpoena or summons by a judicial officer;
• A grand jury subpoena; or
• An administrative request including a summons or subpoena, a civil or an authorized investigative demand provided that:
  • The information sought is relevant and material to a legitimate law enforcement inquiry;
  • The request is specific and limited in scope to the extent practical in light of the investigation;
  • De-identified information could not be reasonably used.

CHS may disclose PHI in response to a law enforcement official’s request for such information for the purpose of identifying or locating a suspect, fugitive, material witness or missing person.  CHS may only disclose the following information:

• Name and address
• Date and place of birth
• SSN
• ABO blood type and rh factor
• Type of injury
• Date and time of treatment
• Date and time of death, if applicable
• A description of distinguishing physical characteristics such as:
  • Height
  • Weight
  • Gender
  • Race
  • Hair and eye color
  • Presence or absence of facial hair
  • Scars
  • Tattoos

CHS may not disclose any PHI related to the individual’s DNA, DNA analysis, dental records, or typing, analysis, or samples of body tissues or fluids.

CHS may disclose PHI in response to a law enforcement official’s request about an individual who is or is suspected of being victim of a crime, if:

1. The individual agrees to such disclosure; or
2. CHS is unable to obtain agreement because of incapacity or other emergency, provided that:
   1. The law enforcement official represents that such information is needed to determine whether a violation of law by a person other than the victim has occurred and such information is not intended to be used against the victim;
   2. The law enforcement official represents that the immediate law enforcement activity that depends on the disclosure would be adversely affected by waiting until the individual is able to agree to the disclosure; and
   3. The disclosure is in the best interest of the individual as determined by a CHS provider exercising professional judgment.

CHS may disclose PHI about an individual who has died to a law enforcement official for the purpose of alerting the official of the death if it is suspected that the individual’s death may resulted from criminal conduct.

CHS may disclose PHI to a law enforcement official if it believed that such information constitutes evidence of a crime within the premises of CHS.

CHS may disclose PHI for research with the following provisions: 
There must be OSU IRB approval, or documentation of IRB waiver.  Compliance with research uses and disclosures will be evaluated by the Compliance Office of CHS.