Notice of Privacy Practices for Protected Health Information Policy and Procedure

POLICY

A Notice of Privacy Practices, compliant with the HIPAA Omnibus Final Rule, will be given to every adult patient/client. Copies of prior versions of the Notice must be retained for ten (10) years.

PROCEDURE

1. The Notice of Privacy Practices is the official description of:

1.1 How the ECS Housing and Clinical Services Department uses Protected Health Information (PHI);

1.2 When the ECS Housing and Clinical Services Department may disclose PHI;

1.3 The rights of the patient/client with respect to PHI; and

1.4 The ECS Housing and Clinical Services Department’s legal duties with regard to PHI.

The Notice of Privacy Practices will reflect the requirements contained in the HIPAA Omnibus Final Rule, as well as other state and federal laws that impact the ECS Housing and Clinical Services Department privacy practices.

2. The Notice of Privacy Practices must contain a statement indicating that the following uses and disclosures will be made only with an individual’s written authorization:

2.1 Uses and disclosures of psychotherapy notes that are not for permitted treatment, payment or health care operations;

2.2 Uses and disclosures of PHI for marketing purposes, including subsidized treatment communications; and

2.3 Disclosures that constitute a sale of PHI.

3. The Notice of Privacy Practices must contain a statement indicating that the ECS Housing and Clinical Services is required to notify the patient/client of any breach of his or her unsecured PHI.

4. If the ECS Housing and Clinical Services intends to send fundraising communications to the patient/client, the Notice of Privacy Practices must inform the patient/client of the same and that he/she has a right to opt out of such fundraising communications with each solicitation.

5. The Notice of Privacy Practices must provide that if a patient/client has paid for services out-of- pocket, the ECS Housing and Clinical Services Department must accommodate the patient’s/client’s request that the Department will not disclose PHI related solely to those services paid for out-of-pocket if the disclosure is to be made to a health plan for payment or health care operations.

6. The Notice of Privacy Practices is approved by the Privacy Officer. The Privacy Officer is responsible for revising the Notice of Privacy Practices to reflect any changes in practices regarding PHI. The Notice shall be written in plain language.

7. The Notice of Privacy Practices, or a summary of the same, is posted in a prominent location accessible to patients/clients. The complete Notice of Privacy Practices must be made readily available upon request to existing patients. The Notice is also available electronically here.

8. A copy of the Notice of Privacy Practices must be offered to the client/patient at the time of the first service delivery. EXCEPTION: If treatment is first rendered in an emergency, the Notice is given as soon as reasonably practicable after resolution of the emergency.

9. The staff member giving the Notice shall ask the client/patient to sign a written acknowledgement of receipt. If the patient/client refuses or is unable to sign, the circumstances will be documented on the acknowledgement form. The acknowledgement form will be retained in the patient’s/client’s record for ten (10) years to comply with Medicaid managed care regulations for adults.

10. The Notice will be promptly revised whenever there is a material change to uses or disclosures of information, the individual’s rights, the ECS Housing and Clinical Services Department of legal duties or other privacy practices stated in the Notice. The revised Notice will be made available at each service delivery site for continuing patients to take with them upon request and will be posted at the program site.

11. The Notice will indicate that clients must sign a release of information that meets the requirements of 42 CFR Part 2 and HIPAA for referral to outside services.