Community Behavioral Health Services - San Francisco Department ...

Ensure that Protected Health Information (PHI) is transmitted in a secure manner.For voice transmissions:a) Always confirm the voice mailbox as the intended recipient of PHI.b) Do not use voicemail to communicate PHI, unless deemed in the interest of the patient.c) Do not use voicemail to communicate PHI to the patient, unless the patient has signed a specificrequest or authorization.d) When using cell phones to disclose PHI, take care to call from areas where PHI cannot beinappropriately or unlawfully disclosed.For e-mail and fax transmissions:a) Always send PHI to confirmed electronic mail addresses or fax numbers only, not to distribution lists.b) For routine transmission of PHI via fax, program numbers into fax machine to minimize the potentialfor error. Check these numbers periodically to ensure that they are valid.c) Always include a confidentiality message in all electronic mail transmissions and fax cover sheets, suchas "This message and any attachments are solely for the intended recipient and may contain confidentialor privileged information. If you are not the intended recipient, any disclosure, copying, use, ordistribution of the information included in this message and any attachments is prohibited. If you havereceived this communication in error, please notify me by reply e-mail and immediately and permanentlydelete this message and any attachments. Thank you."d) Limit PHI that is sent via fax or to electronic mail addresses, to the minimum necessary to perform theintended task.e) If it is determined that an electronic mail address is unsecured, or if the security of the electronic mailaddress cannot be verified, transmit PHI in password-protected files only. Send passwords to access theprotected files, via a separate message.f) Use electronic mail to communicate with patients, but not to respond to requests for copies of medicalrecords.g) Whenever a patient needs a copy of his or her medical records, always obtain a signed writtenauthorization from the patient. After the provider determines that release of the information will notcause serious harm to the patient, a hard copy of the records may be released to the patient.For wireless and infrared transmission:a) Transmit PHI only from approved portable computing devices and access points.b) Actuate the portable devices in secure environments only.In case of inappropriate or insecure transmission, notify your supervisor immediately.Observe the Privacy Rule for PHI release to the mediDo not release information about mental health or substance abuse patients, including their presence in thefacility.17