Use of PHI in Drexel University Classroom or Internal Web-based Medical Education
Drexel University Clinical Covered Entities
Privacy Program Policies and Procedures
Policy Title: Use of PHI in Drexel University Classroom or Internal Web-based Medical Education
Policy Number: IM-20
Effective Date: October 1, 2005; September 23, 2013
Last Revision: September 1, 2017
Responsible Officer: Vice President, Chief Compliance, Privacy and Internal Audit Officer
Table of Contents
This policy applies to all Covered Entities within Drexel University.
Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) contains regulations that restrict the use of protected health information (PHI). Use and disclosure of PHI during classroom and web-based educational activities must comply with HIPAA and this policy.
This policy does not apply to use of PHI during educational activities that occur in a clinical setting such as a hospital, physician's office or other medical facility.
However, other facility and College policies govern the use and disclosure of PHI in clinical settings. If the student is a student of Drexel University, such student's use and disclosure of PHI in clinical settings will be governed by the DU Privacy and Security Policies. If the student is acting as a business associate of Drexel University, the DU Business Associate Policies shall apply.
PHI: Protected Health Information is information that is individually identifiable to a patient that pertains to the patient's past, present or future physical or mental health or condition or the provision of health care to that patient or payment for the provision of health care to that patient.
Only Drexel University students, medical residents, physicians, visiting students and professors, faculty members and employees who have successfully completed the HIPAA training required for their entity and role may receive PHI in either live or recorded form.
- Each student is to protect patient privacy at all times in accordance with this Policy. Students must not include identifying information from the patient medical record on information used for classroom or academic use. Cases summarized and prepared for classroom use must not identify the name of the patient or any protected health information. All identifiers as defined in Policy IM-27 must be removed from any materials to be shared or discussed with peer groups or faculty outside the provision of clinical care at the clinical site. Students may create a numeric identifier for each patient to enable de-identified discussion in the classroom or academic setting, provided, however, that all reference to identifying information must be removed and a reference number assigned by the student and known only to the student for use in lieu of the patient name, in accordance with Policy IM-27. A key or index linking the name and number may be retained by the student to enable re-identification for the provision of clinical care in accordance with Policy IM-27.
- Use of live video of patients and/or bringing patients into the classroom, previously recorded videos of patients, or any other use of patient materials which discloses PHI in class room, lecture or web-based educational activities may occur only if the patient has completed and signed Drexel University Authorization for Use of Protected Health Information for Instructional Use attached to this policy (Form IM-20).
- A copy of the authorization form must be filed with the Office of Educational and Academic Affairs prior to use and/or disclosure of PHI in any educational venue. The authorization form is NOT required if the use and disclosure of protected health information takes place only in a hospital, physician office or other clinical setting for clinical care that is not recorded.
- Recorded video or audio tapes containing PHI may be posted on Drexel University web site only if:
- The patient has completed and signed the authorization form and the form has been filed with the Office of Educational and Academic Affairs if produced after April 14, 2003.
- The web site is password protected and restricted to Drexel University students, visiting students and professors, medical residents, faculty members and employees.
- All authorized users of the web site will be reminded of their legal, professional and ethical obligation to protect the confidentiality of individual patient's health information.
- All training materials that meet the requirements of this policy must include "Approved for DU Classroom or internal web-based medical education use" on the title page to enable identification of compliant materials.
- Videos containing PHI recorded prior to April 14, 2003 for educational use (when the HIPAA Privacy Rule took effect) may be used for educational purposes. These videos may also be posted on Drexel University web site, provided the web site is password protected and restricted as described in 4a, b, c and d above.
- Use of DU Classroom or Internal Web-based Medical Education content with PHI in any form of media beyond campus courses or DU password protected course web-sites must be reviewed and approved by the DU Privacy Officer and/or the Office of General Counsel. Classroom and educational materials authorized for such use are not openly transferable for use at professional meetings and conferences.
Back to Top