Section 17: Verification of Patient Identification
Prior to any Disclosure of an Individual’s PHI (other than a Breach Notification Disclosure or a Disclosure in response to a threat to health or safety), the Callier Center shall verify, as reasonable under the circumstances, the identity of the person requesting the PHI and the authority of such person to have access to PHI. If the person’s identity and authority are confirmed and permissible, Disclosure is permitted.
General
a. Verification must be completed as required by this Policy before any Disclosure takes place.
b. Verification may be based upon the identification by the Privacy Officer or a person that is employed by the Center provided that the person has no personal involvement in the request or the outcome of the request of the PHI.
c. The Privacy Officer may approve any other method of verification provided that the Privacy Officer documents the approval and method of verification in a signed writing prior to the Use or Disclosure.
d. Documentation presented in support of verification will be presumed to be valid.
- In person – a state driver’s license, an employee identification badge issued by the University, a United States Passport or other photo identification issued by a local, state or federal governmental agency;
- In writing – a written document on appropriate government letterhead; or, a warrant, subpoena, order, or other legal process issued by a grand jury or a judicial or administrative tribunal shall be accepted at face value unless circumstances clearly place the validity of the document into question;
- By telephone – request patient’s first and last name, address, date of birth, and personal representative’s full name if applicable
- By facsimile – call entity to verify requests and obtain any missing information, require signature on official release
Verification of a Requesting Public Official
Verification of a person’s status as a public official identity may include, but is not limited to:
a. if responding to a telephone request, calling back the requestor through a number obtained from an official directory or the letterhead for a known place of business or receipt of a Facsimile containing a written statement on appropriate government letterhead;
b. if the request is in writing, the request is on the appropriate government letterhead;
c. if the request is in person, presentation of an agency identification badge or other official credential sufficient to identify the individual and the individual’s capacity; or
d. if the Disclosure is to a person acting on behalf of a public official (e.g., a non-profit agency contracting with a public health agency to collect and analyze data), a written statement on appropriate government letterhead that the person is acting under the government’s authority or other documentation of agency, such as a contract for services, memorandum of understanding, or purchase order, that establishes that the person is acting on behalf of the public official plus sufficient proof of the individual’s identity.
Verification of a Requesting Individual
Verification of a person’s status as a patient requesting his own individual PHI may include, but is not limited to:
a. presentation of a valid photo identification issued by a local, state or federal governmental agency such as a driver’s license or U.S. passport;
b. provision of three or more non-public informational items from a record kept by the Callier Center as to that Individual; and
c. recognition of an individual based on personal knowledge.
Written Documentation
Verification must be documented and the verification retained before any Use or Disclosure requiring verification is made:
a. in the case of a verification based on personal knowledge, a statement signed by the person describing the basis of his or her knowledge of the patient’s identity, the date and the person’s office and phone number at the Center;
b. in the case of a verification by a telephone call back to a caller, a notation of all names of persons involved in the call, the number used for the call back and the source of the number; or
c. in all cases involving physical documentation, if feasible, retention of the original, or if retention of the original is not feasible (such as in the case of a license or badge), a copy of any and all items or document presented for verification purposes.
HIPAA Regulatory Citation: 45 CFR § 164.514(h)
Effective: 09/01/2013
Revised: 05/19/2015
Reviewed: 10/21/2022, 03/24/2021, 08/13/2015
Heather Zimmerman, HIPAA Privacy Officer
UT Dallas Callier Center
