Privacy Officer's Roundtable

Right to Access (signature for email request)

  • 1.  Right to Access (signature for email request)

    Posted 07-16-2020 10:53 AM
    Edited by Matthew Mayo 07-16-2020 10:54 AM
    As more patients request our offices provide their employers, etc. with a copy of their COVID19 test results, I want to make the process easier.

    We serve an indigent population that may not have a computer, scanner or printer.  Patients lack transportation, nor do we want a positive patient coming to the center to complete an authorization.

    I understand that a 'Right to Access' letter can be provided to the clinic via fax, postal mail or email and must include a signature.  My question:  Can a typed signature (not a certified digital signature) in the body of an email message/letter be accepted?



    ------------------------------
    Matthew Mayo
    Grants & Compliance Coordinator/Privacy Officer
    North Florida Medical Centers, Inc.
    Tallahassee,FL
    ------------------------------
    2020 SCCE Membership


  • 2.  RE: Right to Access (signature for email request)

    Posted 07-16-2020 12:44 PM
    I don't believe the regs have any specific requirement for the signature (e.g. digital, pen, pencil, printed, cursive, etc), so we accept a typed signature.

    ------------------------------
    David Garrison
    Compliance/Privacy Officer
    SEARHC
    Juneau,AK
    ------------------------------

    2020 SCCE Membership


  • 3.  RE: Right to Access (signature for email request)

    Posted 07-17-2020 09:01 AM
    Matthew,
    If the document is serving as a valid authorization then it must be "signed" by the patient. That would not include their name simply typed on the form. However, in today's environment I doubt OCR would exercise enforcement if you added some additional controls around that like documenting that someone spoke with the patient and this is indeed their wish the information shared with the employer. While not technically compliant for a valid authorization I would be comfortable with that. Hope this helps. Marti

    ------------------------------
    Marti Arvin, JD, CHC-F, CCEP-F, CHRC, CHPC
    Executive Advisor
    CynergisTek, Inc.
    Marti.arvin@cynergistek.com
    615-540-8071
    ------------------------------

    2020 SCCE Membership


  • 4.  RE: Right to Access (signature for email request)

    Posted 07-17-2020 10:50 AM
    There is a FAQ on the HHS website regarding the use of electronic signatures. It is NOT prohibited by HIPAA or any other federal statute. It is governed by state law. Therefore, you will need to look at your state law regarding the enforceability of electronic signatures. Most states have adopted some sort of electronic signatures act which lays out the requirements of e-signatures. In most cases the document being signed needs to have some sort of statement for the person signing acknowledging that by typing their name it is the same as signing the document in person and holds the same legal authority that their actual signature would hold.

    Regards,
    Jamie

    ------------------------------
    Jamie Parker, JD, CHPC, CHRC
    Chief HIPAA / Medical Privacy Officer
    University of Alabama
    Tuscaloosa, AL
    ------------------------------

    2020 SCCE Membership


  • 5.  RE: Right to Access (signature for email request)

    Posted 07-17-2020 11:02 AM
    I agree Jamie, but the original question does not appear to be about an electronic signature but rather a typed name on an email. A typed name would not generally meet state law provisions for what constitutes a valid electronic signature that is legally binding. Marti

    ------------------------------
    Marti Arvin, JD, CHC-F, CCEP-F, CHRC, CHPC
    Executive Advisor
    CynergisTek, Inc.
    Marti.arvin@cynergistek.com
    615-540-8071
    ------------------------------

    2020 SCCE Membership


  • 6.  RE: Right to Access (signature for email request)

    Posted 07-17-2020 11:09 AM
    Edited by Frank Ruelas 07-17-2020 11:10 AM
    I know many organizations, given what a hot button "access to PHI" can create...that when they have received requests by email will do the following:

    1. Confirm the validity of the sender of the email (for example, calling the person or whatever is in their policy to contact Patient Frank to make sure he or she is the person actually making the request).
    2. If verification is successful, write on a print out of the email the name of the person making the verification, date and time and some brief notation "Called Patient Frank and Patient Frank confirmed the validity of the request to access PHI."
    3. Attach a copy of the email with notes to an Access for PHI form and where applicable, write "see attached copy of email request"
    4. Some organizations will scan and save copies of requests for access...so they make sure to scan the form and the attached email printout together.

    It takes literally 2 or 3 minutes...and no issues...and one organization even submitted this to OCR when a patient claimed an untimely response to a request and the OCR had no issues with the process as they did ask about it.  Of course...a lot of this has to depend on the investigator at OCR...but just sharing.

    ------------------------------
    -------------Frank "Snake Bite Leader" Ruelas--------------
    ► We don't fail unless we quit! ◄
    Bill Wong's Resource Folder: https://bit.ly/BillWong
    NEXT UP:
    Stay tuned...

    ░ Pass the Exam Group for 2020 ░
    Melissa Singleton - Jan - CHPC
    Julie Clutter - Jan - CHPC
    Tanisha Grant - Feb - CHC
    Lisa Bibby - Jan - CHPC
    Kelly Puida - Mar - CHPC
    Christina Serrano - Mar - CHC
    Rachel Anderson - May - CHC
    Melissa Alexander - June - CHC
    Theresa Veazey - June - CHC
    Barbara Zubeck - June - CHPC
    Patricia Radatz - June - CHC
    Anthony Fleming - July - CHC
    Laura Chaney - July - CHC
    ------------------------------

    2020 SCCE Membership


  • 7.  RE: Right to Access (signature for email request)

    Posted 07-17-2020 12:48 PM
    Hello,

    There is no language that requires a wet signature or prohibits an electronic one however, 164.514 (h) requires that you verify the identity of the individual requesting the information.

    ------------------------------
    Nancy O'Neill, RN, CHC, CHPC
    Sr. Director, Corporate Compliance/Privacy Officer
    Tampa General Hospital
    Tampa, FL
    noneill@tgh.org
    Responses are my own and not the view of my organization.
    ------------------------------

    2020 SCCE Membership


  • 8.  RE: Right to Access (signature for email request)

    Posted 07-17-2020 06:23 PM
    Nancy that is not true for an authorization. Marti

    Sent from my iPhone



    2020 SCCE Membership


  • 9.  RE: Right to Access (signature for email request)

    Posted 07-20-2020 11:01 AM
    Agreed, Marti. I was referring to the request for access as I thought that was what the question was pertaining to. Apologies for any confusion if it wasn't.

    ------------------------------
    Nancy O'Neill, RN, CHC, CHPC
    Sr. Director, Corporate Compliance/Privacy Officer
    Tampa General Hospital
    Tampa, FL
    noneill@tgh.org
    Responses are my own and not the view of my organization.
    ------------------------------

    2020 SCCE Membership


  • 10.  RE: Right to Access (signature for email request)

    Posted 07-23-2020 02:24 PM
    I agree with Nancy and Marti.

    In fact, HHS has stated that having an individual come in so the organization can "witness" the signature or have the individual sign an organizational form would be viewed as an "obstacle" to accessing the individual's PHI.

    Hernan

    ------------------------------
    Hernan Serrano
    St. Louis Metro Area
    ------------------------------

    2020 SCCE Membership