University of Connecticut University of UC Title Fallback Connecticut

Paper Communications Containing PHI

An individual comes to the IMA clinic and indicates he is there to pick up documents on behalf of a patient, Mr. Chuck Carefully, for whom he says he is the legal representative. After greeting the gentleman, the Clinic Office Assistant sees a sealed envelope on the desk with the patient’s name on it and hands it to the requester. Are there any concerns about the way this situation was handled?

In order to provide safe care and to protect the privacy of our patients’ medical information, the following must be considered:

  • Is the individual actually who he says he is and is he truly the patient’s legal representative?
  • Is the patient’s legal representative authorized to receive the documents on the patient’s behalf?
  • Are the correct patient’s documents being provided to the legal representative?
  • Are only the documents specific to the request in the envelope? (minimum necessary)

Per the new UConn Health policy # 2014-09 Handling Paper Communications About Patients Including Protected Health Information (PHI) – Assuring Proper Identity of the Patient, it is required that the following steps be followed when providing documents to a patient or another individual in person:

  1. When preparing documents, use two data points of patient identity to assure that the documents prepared pertain to the right patient.
  2. Review and initial each page to ensure that all documents pertain to the correct patient and are labeled with the correct patient’s name.
  3. Communicate to those who will actually hand the envelope/documents to the recipient that all pages have been checked and are accurate.
  4. Before handing documents to a patient or another individual on the patient’s behalf, verify the individual’s identity using two forms of identification.
  5. Verify that the recipient is authorized to receive the documents.

Remember that any situation in which documents are mailed or handed to the incorrect patient must be evaluated as a HIPAA Privacy breach. Notify the Privacy Office at 860-679-4180 immediately of such incidents.

For more information, please review the policies linked below:

Verification of Individuals or Entities Requesting Disclosure of Protected Health Information
Patient Right to Request Copies of His/Her Medical/Dental/Research and/or Billing Record
Minimum Necessary Data

January 2015 UConn Health Compliance Quandary