Uses and disclosures, minimum necessary and verification policy

Granite City Family Dental · Policy set version 1.0 · Effective November 1, 2026

Authority: 45 CFR 164.502, 164.506, 164.510, 164.512, 164.514(d) and (h). Privacy Officer: Janelle Okafor, Office Manager.

1. Purpose and scope

This policy governs every use and disclosure of protected health information (PHI) by Granite City Family Dental and its workforce, in any form: electronic, paper and spoken. It applies to employees, providers, contractors, students and volunteers.

2. Permitted uses and disclosures without authorization

We may use and disclose PHI without the patient's written authorization for:

• Treatment — providing, coordinating or managing care, including consultation with and referral to other providers.
• Payment — obtaining payment for services, including claims, eligibility checks, billing statements and collections.
• Health care operations — quality review, training, licensing, business planning, and administration of the practice.

Minnesota Statutes 144.293 is stricter than federal law for releases outside our practice: most disclosures of health records to other providers or third parties require the patient's signed, dated consent unless a Minnesota exception applies (emergency; a related health care entity for current treatment; disclosures specifically authorized by law). Treatment disclosures that HIPAA would permit without consent still require Minnesota consent unless one of those exceptions applies. See the Minnesota Health Records Act supplement.

3. Required disclosures

We must disclose PHI to the individual (or personal representative) who requests access to or an accounting of their own information, and to the Secretary of Health and Human Services when required to investigate or determine our compliance.

4. Disclosures permitted by law for public interest purposes

Based on our practice, the following categories under 45 CFR 164.512 apply to us. Each disclosure is limited to what the law requires or permits and is recorded for the accounting of disclosures.

• Public health reporting (immunizations, communicable disease)
• Abuse, neglect or domestic violence reports
• Subpoenas and court orders
• Workers' compensation

Any request outside these categories is treated as non-routine (section 5).

5. Non-routine disclosures

Any request for PHI that is not a routine treatment, payment or operations disclosure (subpoenas, court orders, law enforcement requests, attorney requests, insurer audits, unusual third-party requests) is referred to Janelle Okafor, Privacy Officer before anything is released. The approver confirms the legal basis, confirms the requester's identity and authority (section 8), limits the release to the minimum necessary, and records the disclosure in the accounting-of-disclosures log kept in Both.

6. Opportunity to agree or object

We may share information with a family member, relative, close friend or other person the patient identifies as involved in their care or payment, and may notify such persons of the patient's location or condition, when the patient agrees, is given the opportunity to object and does not, or when we reasonably infer from the circumstances that the patient would not object. When the patient is not present or is incapacitated, the provider uses professional judgment and shares only what is directly relevant to the person's involvement.

7. Minimum necessary

When using or disclosing PHI, or requesting it from another covered entity, we make reasonable efforts to limit the information to the minimum necessary to accomplish the purpose. The standard does not apply to disclosures to or requests by a provider for treatment, to the individual, pursuant to an authorization, to HHS, or as required by law.

Role-based access

Each role's access to PHI is limited as follows. System roles are configured to match this table and reviewed quarterly.

Requests for an entire medical record are fulfilled only by the roles listed above with full-record access, and only when the entire record is specifically justified as necessary for the purpose. Routine, recurring disclosures (claims, referrals, lab orders) follow standard protocols that define the data elements sent. Non-routine requests are reviewed individually by Janelle Okafor, Privacy Officer.

8. Verification of identity and authority

Before disclosing PHI to anyone other than the patient in person, workforce members verify the identity of the requester and, where applicable, their authority to receive the information. Accepted methods:

• Government photo ID in person
• Date of birth plus address or phone on file (phone requests)
• Signed written request matching signature on file
• Guardianship or power of attorney papers

Telephone script. "Before I can discuss any information, I need to verify who I am speaking with. Can you give me your full name, date of birth and the address we have on file?" If the caller is not the patient, ask for the patient's written authorization or the legal basis for the request, and offer to call back at the number on file.

Public officials are verified by agency identification, a written request on agency letterhead, or a statement of legal authority. Professional judgment governs; when in doubt, the request is referred to the Privacy Officer.

9. Personal representatives, minors and deceased patients

A person with legal authority to make health care decisions for a patient (medical power of attorney, court-appointed guardian, parent of a minor) is treated as the patient for the purpose of exercising the patient's rights, after their authority is verified and copied to the chart. We may decline to treat a person as a personal representative when we reasonably believe the patient has been or may be subjected to abuse or neglect by that person.

Minors. Parents and guardians generally act for minor patients. Under Minnesota law, a minor who lawfully consented to their own care (for example certain reproductive, mental health or substance use services, or an emancipated or married minor) controls the records of that care, and we do not release those records to a parent without the minor's consent except as Minnesota law allows. Questions go to the Privacy Officer.

Deceased patients. PHI remains protected for 50 years after death. An executor, administrator or other person with authority under state law may act for the decedent. We may disclose relevant information to family members or others involved in the decedent's care or payment before death unless doing so is inconsistent with a known preference of the decedent.

10. De-identified information and limited data sets

We do not produce de-identified data sets or limited data sets without written approval of the Privacy Officer, who confirms the method (safe harbor removal of the 18 identifiers, or expert determination) and any required data use agreement. Patient information may not be entered into any online or artificial-intelligence tool that is not covered by a business associate agreement.

11. Psychotherapy notes

We do not maintain psychotherapy notes as defined in 45 CFR 164.501. If a provider begins keeping such notes, this policy is updated and the notes are stored separately from the medical record.

12. Incidental disclosures

Incidental uses and disclosures that occur as a by-product of a permitted use (a name called in a waiting room, a conversation overheard despite reasonable precautions) are permitted provided the minimum necessary standard and the safeguards in the Safeguards for PHI in All Forms policy are followed.

13. Documentation and sanctions

Non-routine disclosures, verification steps for unusual requests, and any denial are documented in the chart or the disclosure log and retained six years. Violations of this policy are subject to the Sanction Policy.

Approval

Approved by: Dr. Maria Lindqvist, Owner

Signature: ______________________________________ Date: ______________