You work in a hospital. Someone from the records department calls you and says that Human Resources (HR) has requested an electronic file of patient data for the Intensive Care department. HR wants this information so they can do an analysis of the number patients and the seriousness of their diagnosis in order to ensure that they have a sufficient number of clinical staff on hand during the various shifts. They are requesting the following data fields:
Date of admission, date of discharge, primary diagnosis, comorbidities (other medical conditions), patient name, patient home address.
You look at the Notice of Privacy Practices used in the hospital and nowhere does it state that patient data may be used for clinical staffing reviews, but nowhere does is state that the hospital will not use data for that purpose.
1. For the first part of your analysis, I want you to look at the types of data fields requested. If you were to allow the transfer of data, would you permit all the requested data fields to be given to HR?
2. Do you allow the records department to provide any of the data to HR?