Frequently, hospitals and other healthcare providers will want to conduct HIPAA medical surveys or questionnaires of patients, to determine whether patients were satisfied with the quality of care and services that they received. The HIPAA Privacy Rule generally permits hospitals to conduct such surveys.
Generally, covered entities may disclose protected health information (PHI) to facilitate healthcare operations, without first having to obtain a patient’s express written authorization. Under the HIPAA Privacy Rule, covered entity providers may conduct HIPAA medical surveys that constitute “quality assessment and improvement activities,” as part of their healthcare operations.
Surveys or questionnaires that are aimed at determining whether patients were satisfied with the level of care they received, are regarded as quality assessment and improvement activities. As such these surveys constitute healthcare operations, which can be facilitated through PHI disclosure.
However, such HIPAA medical surveys should not be construed as vehicles through which to free-roam over patient privacy. Indeed, before a hospital may engage in these activities, the hospital must indicate, in its Notice of Privacy Practices, that it may use identifiable information as part of its healthcare operations.
[…]
This is an excerpt.