Oregon POLST Registry Privacy for Hospice Transfer Partners: What You Need to Know

Authorized Access Rights

Hospice transfer partners may access the Oregon POLST Registry when it is necessary to coordinate transfers and honor a patient’s End-of-Life Care Orders. Access should be role-based, time-limited to the transfer window, and tied to documented Registry Access Authorization issued by your organization.

Limit use to treatment and care coordination. Marketing, research without approvals, or curiosity access is prohibited. Apply the minimum necessary standard so you view only what you need to safely transfer and treat the patient.

Who is authorized

• Licensed hospice clinicians (e.g., physicians, NPs, PAs, RNs) involved in the patient’s care and transfer.
• Designated transfer coordinators and intake staff who perform POLST lookups as part of an approved workflow.
• Supervisors or privacy officers conducting audits for Data Privacy Compliance and quality assurance.

Boundaries of access

• Use unique credentials; do not share logins or screenshots containing Confidential Health Information.
• Document why you accessed the record and how it informed transfer decisions.
• Immediately report suspected misuse for investigation and corrective action.

Verification and Identification Procedures

Before relying on a record, complete patient and document verification. Accurate identification prevents treatment based on the wrong person’s End-of-Life Care Orders.

Verify the patient

• Match at least two identifiers (e.g., full name and date of birth). When available, confirm an additional identifier such as address or last four of MRN.
• Confirm the sending and receiving organizations are referring to the same individual and episode of care.

POLST Form Verification

• Confirm you have the most recent POLST in the Registry; check the last updated date and any “replaced” or “revoked” flags.
• Review legibility and completeness: patient identifiers, sections indicating cardiopulmonary and medical interventions, signatures, and effective dates.
• Reconcile discrepancies by contacting the responsible clinician before transfer if time allows.

Verify user and channel

• Authenticate with your assigned credentials; enable multi-factor authentication where available.
• If information is communicated verbally, perform a call-back to a verified number to confirm identity and authority.

Confidentiality and Privacy Protections

The Registry contains Confidential Health Information that must be safeguarded at every step. Your policies should align with HIPAA and applicable Oregon Administrative Rules to prevent unauthorized use or disclosure.

Protect information across its lifecycle

• Access only on secured, managed devices; avoid public Wi‑Fi unless using a vetted VPN.
• Do not store POLST images in personal email, texts, or unapproved apps; use approved repositories with audit logging.
• Shred or securely delete any temporary printouts or downloads after the transfer tasks are complete and documented.

Operational safeguards

• Train staff annually on Data Privacy Compliance, incident reporting, and sanctions for misuse.
• Use role-based controls, automatic timeouts, and periodic access reviews to keep authorization current.
• De-identify data before using cases for quality improvement or education.

Patient Consent Requirements

Respect for patient direction is central to Oregon POLST Registry Privacy for Hospice Transfer Partners. Build clear Patient Consent Protocols into admissions and transfer workflows, and honor any limitations the patient or surrogate sets.

Obtaining and documenting consent

• Explain why the Registry is being queried and how it supports End-of-Life Care Orders during transfers.
• Capture consent from the patient or an authorized surrogate; record who consented, how (written, verbal), and the date/time.
• Note any restrictions (e.g., who may view the record) and communicate them to the receiving team.

Respecting preferences and changes

• Honor revocations and updates promptly; the most recent POLST governs care unless legally invalidated.
• In emergencies where consent cannot be obtained, follow your policy and applicable law, then document rationale and notify the patient or surrogate at the earliest opportunity.

Compliance with Oregon Regulations

Maintain policies that reflect Oregon Administrative Rules governing the creation, storage, and disclosure of POLST information, alongside HIPAA’s privacy and security requirements. Assign a privacy officer to monitor updates and coordinate workforce training.

Program-level compliance practices

• Adopt written procedures for Registry Access Authorization, POLST Form Verification, and incident response.
• Execute data-sharing agreements with transfer partners that specify permitted uses, safeguards, and breach notification duties.
• Conduct periodic risk analyses and audits, documenting corrective actions to sustain Data Privacy Compliance.

Secure Communication Practices for Transfers

Transfers often occur under time pressure. Protect privacy without slowing care by standardizing secure channels and checkpoints for Confidential Health Information.

Approved channels and safeguards

• Use encrypted messaging platforms or secure email portals; avoid standard SMS or consumer chat apps for POLST data.
• When faxing is necessary, confirm the number, use a confidential cover sheet, and request receipt verification.
• Verify recipient identity before sharing documents; apply “minimum necessary” and mark messages as confidential.

Process controls

• Embed a POLST verification step in the transfer checklist and document the outcome in the record.
• For after-hours transfers, use predefined on-call contacts and backup channels to prevent ad hoc, insecure workarounds.
• Log all disclosures related to the transfer, including what was sent, to whom, when, and by which method.

Utilization of POLST Registry in Hospice Care

Integrate the Registry into everyday hospice workflows so that End-of-Life Care Orders guide decisions without delay. Consistency reduces risk and improves alignment with patient goals.

Workflow integration

• At admission: confirm the presence of a POLST, review its content with the patient or surrogate, and verify Registry status.
• Pre-transfer: requery the Registry, perform POLST Form Verification, resolve conflicts, and package the current orders for the receiving site.
• Day of transfer: transmit the verified POLST via approved secure channels and confirm receipt before departure.
• Post-transfer: document confirmation from the receiving clinician and schedule follow-up if clarification is needed.

Quality and safety checks

• Track metrics such as lookup completion rate, match accuracy, and time-to-verification to drive improvements.
• Escalate any discrepancies between observed care and documented orders to clinical leadership immediately.

Conclusion

By aligning Registry Access Authorization with solid verification steps, strong privacy safeguards, and clear Patient Consent Protocols, hospice transfer partners can securely honor End-of-Life Care Orders. Consistent use of approved channels, documentation, and training ensures lasting Data Privacy Compliance under Oregon Administrative Rules.

FAQs.

What information is required to access the Oregon POLST Registry?

You need a legitimate treatment-related purpose, active Registry Access Authorization from your organization, and your unique credentials. For patient lookup, use at least two identifiers—typically full name and date of birth—and, when possible, a third identifier to confirm the correct record.

How do hospice transfer partners ensure patient privacy?

Apply the minimum necessary rule, use encrypted channels, and avoid storing POLST data in personal systems. Limit access to authorized roles, complete POLST Form Verification, log disclosures, and promptly report any suspected privacy incidents for remediation.

What are the legal protections for POLST Registry data?

POLST records are Confidential Health Information protected by HIPAA and relevant Oregon Administrative Rules. Your program must maintain policies, training, and technical safeguards, along with audit trails and breach response processes, to meet Data Privacy Compliance obligations.

How should hospice programs obtain patient consent for registry access?

Incorporate Patient Consent Protocols into intake and transfer workflows. Explain the purpose of the query, obtain consent from the patient or authorized surrogate, document who consented and when, and honor any restrictions or revocations. In emergencies, follow policy and applicable law, then notify and document accordingly.