Public Website
Public forms and general website channels are for business inquiries. Patient-identifying information and clinical records should not be submitted through public inquiry forms.
HIPAA, PRIVACY & INFORMATION GOVERNANCE
01
02
03
Protected clinical information belongs in the authorized clinical workflow.
UM Physician Advisors separates public business communications from patient-specific clinical-review information. When protected health information is required for an authorized engagement, information exchange follows the applicable client workflow, governing agreement, privacy requirements, and appropriate safeguards.
INFORMATION-GOVERNANCE PRINCIPLE
Protect the patient. Use the approved channel. Limit information to the authorized purpose.
Contracted Clinical Workflow
Patient-specific review information is exchanged through client-approved channels established for the authorized engagement and review purpose.
Engagement-Specific Governance
Privacy, access, permitted uses, information exchange, retention, and related responsibilities are governed by the applicable relationship, agreements, and requirements.
TWO INFORMATION ENVIRONMENTS
Business inquiries and clinical-review operations follow different information pathways.
The public website supports business communication. Patient-specific clinical review begins only within the approved client workflow.
Business communication only
Use public website channels for consultation, contracting, service questions, and other non-patient-specific business communication.
- Do not submit PHI or patient-identifying information through public forms.
- Use business contact information for general inquiries.
- Move case-specific exchange to the approved client workflow.
Authorized patient-specific information exchange
When a contracted review requires protected health information, information is handled within the applicable client relationship and authorized workflow.
- Business Associate Agreements are used when required by the applicable relationship.
- Uses and disclosures follow the governing agreement and applicable requirements.
- Access and workflow safeguards are aligned to the authorized review purpose.
CLINICAL INFORMATION GOVERNANCE
Govern the information around the review—not just the review itself.
Information handling should be defined before patient-level review begins and remain aligned to the authorized purpose throughout the engagement.
Appropriate Secure Workflow
Patient-specific clinical information is exchanged through client-approved channels established for the review program—not through the public business-inquiry form.
Business Associate Framework
When UM Physician Advisors functions as a business associate, PHI is handled within the applicable HIPAA requirements and Business Associate Agreement.
Purpose-Appropriate Access
Information access and exchange should be limited to the authorized review purpose and aligned with applicable minimum-necessary requirements and exceptions.
Safeguards & Accountability
Clinical-information workflows should incorporate appropriate administrative, technical, and physical safeguards, with defined access and accountability responsibilities.
Incident & Escalation Responsibilities
The engagement should define applicable notification, escalation, investigation, and response responsibilities for privacy or security events.
Retention & Disposition
Record retention, return, destruction, and disposition expectations should be defined according to the governing agreement and applicable requirements.
INFORMATION-GOVERNANCE PRINCIPLE
Protect the patient. Use the approved channel. Apply the governing agreement and privacy requirements.
DOWNSTREAM INFORMATION GOVERNANCE
Vendor and subcontractor responsibilities should follow the authorized workflow.
If another party creates, receives, maintains, or transmits protected information as part of an authorized engagement, applicable downstream privacy, security, contractual, and Business Associate requirements should be addressed before that workflow is used.
Defined Role
Clarify what information the party may access, why access is required, and what responsibilities apply to that role.
Approved Workflow
Use only the systems, channels, and information-exchange pathways authorized for the engagement.
Contractual Alignment
Address applicable confidentiality, privacy, security, Business Associate, retention, and incident obligations in the governing arrangements.
MINIMUM NECESSARY & PURPOSE
Access should match the authorized review purpose.
Where the HIPAA minimum-necessary standard applies, reasonable efforts should limit PHI used, disclosed, or requested to what is necessary for the intended purpose, subject to applicable exceptions. Access should also be aligned to the individual’s authorized role and review responsibilities.
RELATED GOVERNANCE RESOURCES
Continue into the clinical-review governance framework.
Review the quality, compliance, coverage, patient-status, and medical-necessity frameworks that support physician review.
Need physician-review capacity within a defined information-governance workflow?
Discuss review scope, secure information exchange, coverage needs, and operational requirements for an authorized engagement.