Use of PHI in Life University Classrooms, Clinics or Internal Web-Based Healthcare Education Policy AS.066

POLICY NUMBER: AS.066

EFFECTIVE DATE: 9/20/2024

APPROVAL DATE: 9/20/2024

REVISED DATE: N/A

PURPOSE: To establish guidelines for the use and disclosure of Protected Health Information (PHI) for education and training health care professionals in accordance with HIPAA.

ADDITIONAL AUTHORITY: N/A

SCOPE: Faculty, Staff and Students of Life University

RESPONSIBLE AUTHORITY:  Academic Affairs

RECIPIENTS:  Faculty, Clinic Administration, Deans, Staff and Students

PUBLICATIONS: Website, Clinic Handbook

DEFINITIONS:  Protected Health Information (PHI) – information that is individually identifiable to a patient that pertains to the patient’s past, present, or future physical or mental health or condition or the provision of health care to that patient or payment for the provision of health care to that patient.

PHI includes genetic information, which includes information about the following items (and excludes information about an individual’s sex or age):

• An individual’s genetic tests;
• The genetic tests of an individual’s family members; or
• The manifestation of a disease or disorder in such individual’s family members (i.e., family medical history).

PHI excludes:

• Individually identifiable health information of a person who has been deceased for more than fifty (50) years;
• Education records covered by the Family Educational Rights and Privacy Act (FERPA; 
• Employment records held by Life University in its role as an employer; and
• Individually identifiable health information of a person that has been de-identified pursuant to HIPAA and Life University’s De-Identification Policy.

Formal Training - as described in this policy, formal training includes learning that is delivered in an intentional way, and is guided by an instructor, supervisor, or other designated individual, versus casual unstructured, and/or self-directed access to or disclosure of PHI.  Perusing the records/images/labs of patients you are curious about, sharing patient information with a colleague because it is “interesting”, etc., is NOT Education or Training for purposes of this Policy, and any such use, access or disclosure of information under such circumstance is a violation of HIPAA and this Policy. 

Research– a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalized knowledge.  Generalized knowledge is knowledge that can be applied to populations outside the population served by the University.

Workforce – employees, clinical staff, volunteers, interns and other persons whose conduct, in the performance of work for Life University, is under the direct control of Life University, whether or not they are paid by Life University.

Policy Title

Use of PHI in Life University Classrooms, Clinics or Internal Web-Based Healthcare Education Policy

Policy Statement

Life University shall use and disclose Protected Health Information (PHI) to [teach and] train health care professionals in accordance with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Family Educational Rights and Privacy Act (FERPA), and Life University policies to maintain confidentiality of PHI and protect patient privacy.

Procedure(s)

Formal Training of Health Care Professionals

Formal training of health care professionals is a category of Health Care Operations as defined by HIPAA and is subject to the minimum necessary standard.

• Staff may share the minimum necessary PHI with students, residents, trainees and faculty supervising such individuals according to policy and/or pursuant to a clinical affiliation agreement between Life University and the affiliated institution/organization.
• Individuals receiving training and faculty supervising such individuals shall be considered members of the Workforce for purposes of HIPAA.
• In all educational settings (i.e. classroom, lab, clinic, training sessions), staff shall make reasonable efforts to limit the amount of PHI used/disclosed to the minimum necessary to conduct the training.  Disclosure of the entire medical record is prohibited unless the entire medical record is comprised of a single episode of care.  Examples include but are not limited to:

• In using radiologic images for educational purposes, it is necessary to remove PHI (e.g., patient name, medical record number, and dates(s) of service) that could lead to the patient identification.  If not possible to remove the PHI, it is necessary to cover or crop the information from viewing and reveal only the information relevant to learning.
• In case presentations or formal discussions for educational purposes but not related to the direct provision of patient care, it is necessary to limit the use of PHI to only that information relevant to learning about the disease, condition or health care status.

Use of the Electronic Health Record (EHR) for Education

Learners, faculty and staff may only access the electronic health record (EHR) of a patient for duties related to patient care and their formal education and the formal education of others.  The following guidelines for accessing the EHR apply:

• Access shall be limited to those patients whose care is assigned to the learner, team patients, care unit or associated teams/individuals only for purposes of providing care continuity, such as covering while the primary caregivers are not available.
• Access shall only be used for purposes related to direct patient care (e.g., review of pertinent history, review of health care data, treatment planning, treatment, follow-up of treatment, communication with other health professionals, preparation for educational and patient care sessions and documentation of findings) and the completion of educational assignments (e.g., case write-ups and presentations for internal educational purposes).
• Review of patients who are not under the direct care of the learner or team, but who have findings of high educational value as determined by the supervising faculty/administrator, shall be accessed only with guidance and supervision of the supervising faculty/administrator.
• Access is allowable for patients to whom the learner had previously provided care, within three (3) months of providing that care, for creating a poster, case study report, abstract or similar educational product.  Such access and use of information is limited only to the minimum necessary components of the patient record and pertaining only to those conditions for which the learner participated in the patient’s health care.

NOTE: Accessing the record of a patient for whom you are no longer providing care is permitted with noted limitations for training purposes; however, students should understand that accessing a patient you are no longer caring for is prohibited outside of the training environment.

• Learners and staff may not indiscriminately search through the EHR or associated applications looking for interesting cases to use for educational/training activities.
• Learners and faculty shall avoid accessing the PHI of another member of the Workforce without having prior established care relationship with the person to whom the PHI relates.

Use of PHI for Research in Education Generally

Faculty/staff should assist learners with case selections, project development, supervision/oversight, data collection, obtaining patient authorization as necessary, and Institutional Review Board (IRB) approval as needed.  See relevant sections below for additional guidance.

Case Report

Individual descriptive case histories, even if published and/or presented at national or regional meetings or otherwise intended for an audience by individuals who are not members of the Workforce, are generally not considered research provided the case is limited solely to a description of the clinical feature or findings and/or outcomes of the individual patient.  However, case series (generally involving more than three patients) where there is concomitant analysis and correlation of data as part of a systematic investigation are considered research and must be reviewed by the IRB.

Case Series

If cases are being sought for publication as a part of a case series or a clinical study needing chart reviews, faculty and department staff will assist students in creating lists of possible diagnoses of interest along with possible International Classification of Diseases (ICD) codes. Following IRB approval, those designated by the IRB as being appropriate, including students, will be allowed to access the charts with the understanding of the need for full confidentiality in the handling and appropriate de-identification of any stored data onto a secure and HIPAA-compliant server.  Individual cases may be reviewed prior to IRB consent only under the supervision of the clinician of record.

External Use of PHI for Educational Purposes

Providers/faculty/staff/interns/students or other members of the Workforce may not use PHI in case studies, community presentations, articles, industry conferences/lectures, posters, fliers or any other material or media that could be seen or accessed by individuals who are not a member of the Workforce unless:

• The Workforce member gets the individual’s signed, written permission of a HIPAA-compliant authorization form or the Life University Education Authorization Form.  The signed authorization form shall be maintained in the patient’s medical record; or
• The PHI is de-identified, as defined by HIPAA (see Life University’s De-Identification Policy). 
• Many images and scenarios may be identifiable even after all 18 identifiers are removed.   De-identification requires that neither the Workforce Member nor Life University has “actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information”.  Consider:
• How common is the condition/disease/scenario?  Vertebral subluxation is common and therefore lower risk, depending on the information included.  An image of an amputation resulting from a car accident is uncommon and, therefore, has a higher risk of being identified.
• How often would the condition/disease/scenario be seen at Life University clinics in a given year?
• How much publicity is associated with the condition/disease/scenario such that the name of the patient is common knowledge?  If the media has covered the story of a Life U rugby player with a spinal condition, presenting what otherwise may seem low risk is likely to lead to identification of the patient.
• Review the Life University policy titled De-Identification of PHI or contact the Director of Clinics, Dean of the respective College or the IRB for assistance in meeting the de-identification standard.
• Learners may disclose to specialty boards or official academic/professional units the minimum amount of patient information necessary related to care provided to patient(s) as required for accreditation, credentialing or certification.  Documentation of such information during training must be maintained in a secure manner.  For guidance, contact the Dean of the respective College.

Internal Use of PHI for Educational Purposes

• Case reports for training (viewed only by individuals who are members of Life University’s Workforce) shall adhere to one or more of the following as applicable:
• The minimum amount of information necessary shall be used:
• Use of a patient name, MRN and/or SSN is never considered the “minimum necessary” information and shall not be used without obtaining prior written patient authorization.
• De-identification should be used whenever possible (see the De-Identification of PHI for Educational Purposes policy).
• Patient’s or legal guardian’s written authorization is required to photograph or videotape a patient for training purposes.  The patient or the patient’s legal guardian will complete the Educational Authorization Form.  Then, only the minimum among of information shall be photographed/videotaped.

Other Notes

N/A