Individual HIPAA Rights. All staff of our office with access to protected health information shall follow the following polices:

Transcription

1 High Plains Educational Cooperative High Plains Educational Cooperative will assist and support the member districts in providing educational services which will maximize opportunities for all children to live, learn, and work in society. HPEC Mission Statement E Oklahoma Ulysses KS Individual HIPAA Rights Policy: Individual HIPAA Rights Approved by: Date: All staff of our office with access to protected health information shall follow the following polices: Alternate Communications: Accommodate a member's written request to receive communications involving Protected Health Information, as defined by HIPAA, at alternate locations or by alternate means. The request must be in writing and signed and dated by the member or their legal All reasonable requests shall be honored. If we feel the request is unreasonable or we are unable to fulfill the request we will notify the member immediately. Once we accept the request, all communications to the member involving PHI must be made to the alternate location or by the alternate means requested until modified by the member. Non-Routine Disclosures: We will accommodate a covered person s written request to obtain a history of nonroutine disclosures of their protected health information. This accounting will, at a minimum include the types of disclosures and information for each detailed under HIPAA. No additional accounting will be maintained by this office for valid authorizations (as defined within the HIPAA Privacy regulations) that have been received by this office. We will keep a copy of each valid authorization on file as evidence that no non-routine disclosures have been made by this office. If an authorization was received in relation to research disclosures we will meet the covered person s request for disclosure by providing a list of all protocols for which the member s PHI may have been disclosed for research pursuant to a waiver of authorization under the HIPAA Privacy regulations as well as the researcher s name and contact information. guardian, preferably using the History of Non-Routine Disclosures Request form. Every attempt will be made to satisfy the request within 30 days, but in no case will we exceed the legal requirement to complete the request within 60 days. Should this be required, we will notify the requestor in writing of the delay and the reason therefore, and complete the request in no longer than 30 additional days. The first request by an individual within a 12-month period shall be at no charge, additional requests shall carry a $0.25 per page duplication charge, plus applicable return receipt postage. The Privacy Officer or their representative shall notify the requesting individual of these charges in advance and provide them the opportunity to withdraw their request if they so choose. The report provided to satisfy the request shall use the format shown in the History of Non-Routine Disclosures Report, or contain all these data elements.

2 The Privacy Officer is responsible for ensuring that all requests are fulfilled in a timely manner in accordance with the law and this office s policies. Electronic Disclosures: If we maintain electronic medical records, we will accommodate a covered person s written request to obtain a history of disclosures of their electronic protected health information. guardian, preferably using the History of Disclosures of Electronic PHI Request Form. Every attempt will be made to satisfy the request within 30 days, but in no case will we exceed the legal requirement to complete the request within 60 days. Should this be required, we will notify the requestor in writing of the delay and the reason therefore, and complete the request in no longer than 30 additional days. The first request by an individual within a 12-month period shall be at no charge, additional requests shall carry a $0.25 per page duplication charge, plus applicable return receipt postage, if the request is for a paper copy. If the request is for an electronic copy, we shall only charge for the labor involved in preparing the request. The Privacy Officer or their representative shall notify the requesting individual of these charges in advance and provide them the opportunity to withdraw their request if they so choose. The report provided to satisfy the request shall use the format shown in the History of Non-Routine Disclosures Report, or contain all these data elements. The Privacy Officer is responsible for ensuring that all requests are fulfilled in a timely manner in accordance with the law and this office s policies. Records Access: We shall accommodate an individual s written request to see or copy his or her medical record. The request must be in writing and signed and dated by the covered individual or their personal representative. If the request is to see the record, the individual may have immediate access within the office, business operations permitting. We will provide a place to review the records away from others, but a staff member shall be present while the member is reviewing the record to ensure that the record remains intact and unaltered. If the request is for a copy of the record or a portion thereof, a copy shall be made available within five business days of receiving payment from the member. The copy may be picked up in person or mailed (return receipt requested) if requested in writing. If we maintain member medical records electronically, the copy may be requested in an electronic format, and transmitted directly to an entity or person designated by the member, provided that the directions for this choice are clear, conspicuopus, and specific. The cost of the copy is 25 cents per page plus return receipt requested postage charges (unless state law mandates differently regarding price or availability). If we maintain member medical records electronically and the request is for an electronic copy to be transmitted electronically, we shally only charge for the labor involved in preparing the request. We may deny such requests only if the life of either the covered person or another would be endangered by such disclosure. Follow all procedures of this office regarding processing records access requests. Records Amendment: Accommodate a covered person s written request to amend his or her medical record. The request must be in writing and signed and dated by the individual or their legal

3 A decision regarding allowing the amendment shall be made within 5 business days and, if a decision to deny the amendment is made, a written explanation shall be returned to the requesting person via US Mail no more than 2 business days following the decision. If the amendment is to be allowed, the record shall be amended within 5 business days and maintained as long as the record itself. The original request, including the decision to amend, shall be included as well. If a response to the amendment is added to the record, we will mail a copy of the response to the requesting person by US Mail within 2 business days of the response being placed in the file. Follow all procedures of this office regarding processing records access requests. Restriction of Records: We shall accommodate a covered person s written request to restrict some or all of the protected health information in his or her medical record. A decision regarding allowing the restriction shall be made within 5 business days and, if a decision to deny the restriction is made, a written explanation shall be returned to the requestor via US Mail no more than 2 business days following the decision. We may not deny a restriction if the request is made to restrict disclosure to the insurer for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment), in the protected health information pertains solely to a health care item or service for which the member has paid out of pocket in full. If the restriction is to be allowed, a notation as to this restriction shall be entered into the record within 5 business days and maintained as long as the record itself. The original request, including the decision to restrict, shall be included as well. If the restriction is allowed, we may not use or disclose protected health information in violation of this restriction, except in emergency situations or to public health, government or law enforcement officials with the proper documentation. If the requestor cancels this restriction a notation to this effect shall be added to the record. If this cancellation is in writing, this shall be included in the medical record as well. If the cancellation is oral, the time, date, and person taking the cancellation shall be noted in the medical record. Follow all procedures of this office regarding processing member records access requests. Member Grievance: The Privacy Officer is responsible for investigating all reported incidents of alleged violation of health information privacy, regardless of source or severity. All staff will encourage any individual who feels that their privacy has been violated to discuss the matter with our Privacy Officer. The Privacy Officer will maintain a Privacy Incident File, and produce a monthly report summarizing for management the status of each and every open file regarding alleged health information privacy violations, regardless of discovering source. The Privacy Incident File shall contain: 1. The completed Member Grievance Tracking form. 2. The written documentation of the alleged violation by the covered person, staff member or other reporting entity. 3. A Plan of Action, documenting the planned course of the investigation. 4. Complete documentation of the investigation, including transcripts of all interviews. 5. Documentation of all correspondence regarding the alleged violation, including all correspondence with legal counsel, such correspondence to be specifically marked as privileged communication.

4 6. Documentation of the decision regarding whether or not a violation actually occurred, and any resolution regarding the alleged violation, regardless of determination. The resolution may include (upon review and approval by senior management): o An apology o A description of a process change that will prevent reoccurrence o o An invitation to discuss the situation further Addresses of appropriate professional, state and federal offices to which the complaint may be escalated The Privacy Officer will log all complaints in the Privacy Incident File and if the complaint can be resolved informally also document the resolution. If the complaint cannot be resolved informally, the individual will be asked to provide a written complaint, signed and dated. We will follow up with the person filing the grievance until they are satisfied or the problem is escalated. If the problem is escalated, the order of escalation shall be: 1. The Privacy Officer 2. Fiduciary and/or officer of the sponsoring organization 3. Appropriate external professional, state or federal offices We will follow the current policy governing the Privacy Grievance Process and if a change is warranted, we will modify the policy documentation to reflect the change and communicate the changes to all affected staff. We will cooperate fully with any and all state, federal or professional investigating bodies. We will maintain documentation of all reported incidents for the time required by law (6 years following the last action). Preserving HIPAA Rights: We shall not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against a member for exercising any of their rights under HIPAA. These include: o The right to complain to the Department of Health and Human Services if they feel that their privacy rights had been violated. o The right to testify in an investigation, compliance review or other hearing. o Oppose any practice of the health plan that the individual feels is in violation of HIPAA regulations. We will not require individuals to waive their HIPAA as a condition of enrollment or eligibility for benefits. Notice of Privacy Practices: In order to notify and inform all of our members of their HIPAA rights and our responsibilities regarding their health information we shall maintain and distribute as appropriate a Notice of Privacy Practices. To that end we shall: Adopt and maintain on file the current Notice of Privacy Practices. For a single health plan use the Notice of Privacy Practices for health plans (Health Plan 01). If you are using an OHCA to create a single Notice of Privacy Practices for multiple plans, be sure to use the Notice of Privacy Practices for OHCAs (Health Plan 02). For Level 3 plans, we will prepare and mail paper copies of our current Notice of Privacy Practices to all current members, providing one per household. As each new member signs up for the health plan, they shall be provided with a copy of the NPP. Furthermore, we shall provide a then current copy of the NPP to all members at least every three years. Make available upon request paper copies of our current Notice of Privacy Practices.

5 Modify the Notice of Privacy Practices as needed, with approval of senior management. The Privacy Officer shall replace the file copy and, for Level 3 plans, re-distribute it within 60 days if a material change is made. If we are using an OHCA we will list the OHCA name in place of the health plan name on the notice. Also, we will list the individual plan names that make up the OHCA on the notice. Retain each version for not less than 6 years following the last use of that version. Violation of any of these policies can carry serious consequences for the health plan. Disciplinary actions for anyone violating this policy may include suspension without pay or termination.