HIPAA Questions & Answers: open treatment areas & teaching clinics.

In effect since 2003, HIPAA regulations for the proper handling of your protected health information can still be confusing. The Frequently Asked Questions paper will clarify the most common concerns we’ve encountered. More information can be found at www.hhs.gov, select “Policies & Regulations” from the side menu.

Does the HIPAA Privacy Rule require hospitals and doctors’ offices to be retrofitted, to provide private rooms, and sound proof walls to avoid and possibility that a conversation is overheard?

No, the privacy roll does not require these types of structure changes to be made to facilities.

Covered entries must have in place appropriate at administrative, technical, and physical safeguard to protect the privacy of protect health information this standard requires that covered entities make reasonable efforts to prevent uses and disclosure not promoted by the rule. The department does not conceder facility restructuring to be a requirement under the standard.

For example, the privacy rule does not require the fallowing types of structure or system changes:
-Private rooms
-Sound proofing rooms

Covered entities must implement reasonable safeguard to limit incidental and avoid prohivited, uses and disclosures. The privacy rule does not require at all risk of protected health information disclosures be eliminated. Covered entities must review their own practices and determine what steps are reasonable examples of types of adjustments of modification to facilities or systems that may constitute reasonable safeguards are:

-Pharmacies could ask waiting costumers to stand a few feet back from a counter used for patient counseling.

-Area where multiple-staff communications routinely occur, use of cubicles, dividers, and shields current or similar barriers may constitute reasonable use cubicles or shield type dividers, rather then separate rooms or providers could add currents or screens to areas where discussions often occur between doctors and patients or among professionals treating the patients

Do the HIPAA privacy rules minimum necessary requirements prohibit medical residents, medical students nursing students, and other medical trainees from accessing patient medical information and in the course of their training?

No. The definition of health care operations in the privacy rule provides for conducting training programs in which students trainees or practitioners in areas of health care learn under supervisions to practice or improve their skills as health care providers.

Covered entities can shape their policies and procedures for minimum necessary uses and disclosures to permit medical trainees access to patients medical information, including entire medical records.

THIS NOTICE CONTAINS IMPORTANT INFORMATION ABOUT PACIFIC COLLEGE ACUPUNCTURE CENTER PRIVACY PRACTICES. THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CARE FULLY.

• What is this notice?

To run its program of community wellness, Alternative Healing Network (AHN) must collect, maintain and use nonpublic personal information on patients it provides service to. We consider this information private and confidential and have policies and procedures in place to protect the information against unlawful use and disclosure. This notice describes what type of information we collect, explains when and whom it may disclose it, and provides you with additional important information as to our legal duties and privacy practices. It also describes your rights to access and control your non-public personal information (NPI).

AHN is required to abide by the terms of this notice. However, we may modify the terms of this notice at any time, and the new notice will be effective for all NPI in our possession at the time of the change, and any created or received thereafter.

Information AHN collects uses and maintains on you is protected by Federal and state laws: the Health Insurance Portability and Accountability Act (HIPAA) and New York State Public Health Law. AHN does not disclose NPI to anyone, except with your authorization or otherwise as permitted by law.

If you believe your privacy rights under Health Insurance Portability and Accountability Act (HIPAA) have been violated you can submit a written complaint to the AHN Privacy Office at the address below. You may also complain to the Secretary for Health and Human Service if you believe your privacy rights have been violated. There will be no retaliation for filing a complaint.

• What is “non-public personal information” (NPI)?

Non-public personal information that identifies you as an individual and relates to your participation in treatment, your physical or mental health/condition, the provision of treatment or healthcare to you or payment to the AHN for the provision of the services provision of services provided to you.

• How does AHN protect NPI?

At AHN, we restrict access to NPI to members of our workforce (staff and trainees) who need to provide care or services to you or are engaged in important agency operations. We maintain physical and procedural safeguards to protect your information against unauthorized access and use. We also have established a Private Office that has overall responsibility for developing, education our workforce about and overseeing the implementation and enforcement of policies and procedures to safeguard your health information against inappropriate access, use and disclosure, consistent with applicable law.

• How does AHN use upon non-public personal information (NPI) and for what purposes?

Here are some examples of what we do with the information we collect and the reasons it might be used:

Treatment: We may use information about you to provide medical treatment and service to you. We may use and share NPI with our staff and trainees who are involved in providing care to you. For example, information obtained by our staff and trainees will be recorded in a treatment record and used to determine your course of treatment.

Payment: We may use disclose NPI so that treatment and services you receive may be billed to and payment collected from you or a third party. For example, we may complete and submit to your healthcare plan or insurance company and description of treatment provided to you. We also may use disclose your NPI to obtain payment from other third parties that may be responsible for the costs, such as family members.

Health Care Operations: We may also use and disclose NPI to perform health care operations. This is necessary to make sure that all of our patients receive quality care. For example, we may us NPI to review our treatment and services and to evaluate the performance of our staff and trainees. We may
also use and share NPI with the institute’s trainees and other personal for review and learning purposes.

• What uses and disclosures do not require your authorization?

We may use and disclose NPI without your authorization for the following purposes:

Business Associates: We may contract with outside individuals and organizations that perform business service for us, such as billing management consultants, accreditation organizations, quality assurance reviewers, accountants or attorney. In certain circumstance, we may need to share your information with a business associate so it can perform a service on our behalf. AHN will limit the disclosure of information to a business associate to the amount of information that is the minimum necessary for the business associate to perform services for us. In addition, we will have a written contact in place with the business associate to requiring it to protect the privacy of your information.

As Required by Law: We will disclose NPI when required to do so by federal, state or local law.

Public Health Activities/Risks: We may disclose NPI to public health authorities that are authorities that are authorized by law to collect information for the purpose of:

• Reporting child abuse or neglect;
• Preventing or controlling disease, injury or disability;
• Notifying a person regarding potential exposure to a communicable disease or condition;
• Reporting reactions to drugs or problems with products or devices;
• Notifying individuals if a product or device we may be using has been recalled;

-Notifying appropriate government agencies and authorities regarding the potential abuse or neglect of —
-An adult patient (including domestic violence);
Notifying your employer under limited circumstances related primarily to workplace injury or illness or medical surveillance.

Health Care Oversight Activities: We may disclose NPI to a health oversight agency for activities authorized by law. Oversight activities can include: investigations, inspections, audits, surveys, licensure and disciplinary actions; civil administrative and criminal procedures or actions; or other activities necessary for the government to monitor compliance with civil rights laws and the health care system in general.

Lawsuits and Disputes: We may use and disclose NPI in response to a court or administrative order, if you are involved in a lawsuit or similar proceeding. We also may disclose your NPI in response to a discovery request, subpoena, or other lawful process by another party involved in the dispute, but only if we have made an effort to inform you of the request or to obtain a court order protecting the information the party has requested.

Law Enforcement: We may disclose NPI if asked to do so by law enforcement official as part of law enforcement activities; in investigations of criminal conduct at the AHN or of victims of crime; in emergency situations to report a crime (including the location or victim(s) of the crime, or the description, Identity or location of the perpetrator); or when required to do so by law.

Serious Threat to Health or Safety: We may use and disclose your NPI when necessary to reduce or prevent a serious threat to your health and safety or the health and safety of another individual or the public. Under these circumstances, we will only make disclosures to a person or organization able to help prevent the threat.

Military: We may use and disclose NPI if you are a member of the United States or foreign military forces (including veterans) and if required by the appropriate military command authorities.

Protective Services for the President, National Security and Intelligence Activities: We may use and disclose NPI to federal officials for intelligence and national security activities authorized by law. We also may disclose your NPI to federal officials or foreign heads of state, or to conduct investigations.

Worker’s Compensation: We may release NPI for worker’s compensation or similar programs.

• What uses disclosures of NPI require your authorization?

Individuals Involved in Your Care or Payment for Your Care: We may release NPI to a friend or family member identified by you, that is helping you pay for your treatment or who assists in taking care of you.

• What are your rights governing the information that AHN collects, uses and maintains on you?

-The Right to Inspect and Copy: You have the right to inspect and obtain a copy of your NPI that we maintain and have in our possession, including treatment records and billing records. If you request copies, we will charge you a fee for the costs of copying, mailing, labor and supplies associated with your request. To inspect and copy your NPI, you must submit your request in writing to the address below.

Under certain circumstances we may deny your request to inspect and copy you NPI. If you are denied access to this information, you have the right to have that determination reviewed. A licensed health care professional chosen by AHN will review will not be the person who denied your request. AHN promises to comply with the outcome of the review.

-The Right to Amend or Connect NPI: If you feel that any NPI we have about you is not correct or incomplete, you may ask us to correct or amend the information you have the right to request an amendment for as long as the information is kept (seven years) by us. To request an amendment, your request must be made in writing to the address below. Additionally, you must provide a reason that supports your request.

AHN reserves the right to deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

Was not created by us;
Is not part of the medical information by us;
Is not part of the information which you would be permitted to inspect a copy; or
Is accurate and complete.

-The Right to an Accounting of Disclosures: An accounting of disclosures is a list of the disclosures we have made, if any of your NPI.

You have the right to request an accounting of disclosures made by us. This right applies to disclosures made by us. This right applies to disclosures for purposes other than those made to carry out treatment, payment and health care operations as described in this notice. It also excludes communication of NPI made to you or disclosures authorized by you.

Your request must be made in writing and state a time period that cannot be longer than six (6) years and cannot include dates before April 14, 2003. We may charge you for the costs of providing the list. We may charge you for the costs of providing the list. We will notify you of the costs are incurred.

-The Right to Receive Communications of NPI by Alternative Means or at Alternate Locations: You have the right to request that we communicate with you about your treatment and related issues in a particular manner or at a certain location. For example, you may ask that we contact you at work rather than at home. We will accommodate all reasonable requests made in writing.

-The Right to Request Restrictions: You have the right to request a restriction or limitation on the NPI we use or disclose about you for treatment, payment or health care operation as described in this notice.

You also have the right to request a limit on the treatment information we disclose about you to someone who is involved in your care or payment fir your care (like a family member of friend).

AHN is not required to agree to your request, however, if we do agree, we will comply with your request until we receive notice from you that you no longer want the restriction to apply.

Any request for a restriction on our use and disclosure of your NPI must be made in writing to the address below. Your request must describe in a clear and concise manner: ( a ) the information you wish restricted; ( b )whether you are requesting to limit our use, disclosure both; and ( c ) to whom you want the limits to apply.

-The Right to Provide an Authorization for Other Uses and Disclosures: We will obtain your written authorization for uses and disclosures that are not identified by this notice or permitted by applicable law. Any authorization you provide to us regarding the use and disclosure of you NPI may be revoked at any time in writing to the address below. After you revoke your authorization, we will no longer use or disclose your NPI for the purposes described in the authorization, except under the following circumstance:

We have taken action in reliance upon your authorization before we received your written revocation

The Right to Obtain a Paper Copy of This Notice: You have the right to obtain a paper copy of this notice of privacy at any time.