NOTICE OF PRIVACY PRACTICES
Reference # 8-2-5
NOTICE OF PRIVACY PRACTICES
This Notice of Privacy Practices describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.
Client privacy is a priority. We will comply with the government’s requirement by law to maintain privacy of individually identifiable information relating to your health, health care, and payment for health care. (This information is “protected health information” and is referred to herein as “PHI.”) We are also required to provide patients with a Notice of Privacy Practices regarding PHI and to abide by its terms currently in effect. We are required to post this Notice in a prominent place within our facility. We will use or disclose your PHI only as permitted or required by applicable law. This Notice applies to your PHI in our possession, including the medical records generated by us. Please read this Notice of Privacy Practices thoroughly. It describes how we will use and disclose your PHI.
We are Permitted to Use or Disclose PHI for:
Treatment: We will use and disclose your PHI in the provision and coordination of health care to carry out treatment functions.
- We will disclose all or any portion of your PHI to your attending physician, consulting physician(s), nurses, medical students, YOC staff and other health care providers who have a legitimate need for such information in your care and continued treatment. We will disclose your medical information to people or entities outside our organization who will be involved in your medical care after you leave our facilities, such as family members and others who will provide services that are part of your care. We might disclose your PHI to other providers for your treatment, regardless of whether it pertains to the treatment you received at our office. We will use and disclose your PHI to inform you of, or recommend possible treatment options or alternatives that will be of interest to you. We will use and disclose PHI to contact you as a reminder that you have an appointment for treatment or medical care at our facility.
Payment: We will disclose PHI about you for the purposes of determining coverage, eligibility, funding, billing, claims management, medical data processing, stop loss/reinsurance and reimbursement.
- The PHI will be disclosed to an insurance company, third party administrator, health plan or other health care provider (or their duly authorized representatives) involved in the payment of your medical bill and will include copies or excerpts of your medical records which are necessary for payment of your account. It will also include sharing the necessary information to obtain pre-approval for payment for treatment from your health plan We will disclose PHI to collection agencies and other subcontractors engaged in obtaining payment for care We may also disclose your PHI to other providers or entities covered by privacy laws for the billing and payment purposes of those entities.
Health Care Operations: We will use and disclose your PHI during routine health care operations, including quality assurance, utilization review, medical review, internal auditing, accreditation, certification, licensing or credentialing activities of our organization, and for training programs we conduct for students or professionals learning under supervision. For instance, we will need to share your demographic information, diagnosis, treatment plan and health status for population based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, and contacting health care providers and patients with information about treatment alternatives, in order for us to operate our business in an efficient, safe and legal manner. We might also disclose your PHI to other entities covered by privacy laws for some of their health care operations, but only if they also have a relationship with you.
Other Uses and Disclosures:
In addition to treatment, payment and health care operations, we may also use your PHI for the following purposes:
Medical Research: We may disclose your PHI without your Authorization to medical researchers who request it for approved medical research projects; however, such disclosures must be cleared through a special approval process before any PHI is disclosed to the researchers. Researchers will be required to safeguard the PHI they receive. If you are participating in a research study that is involved with your treatment, we will ask you to sign an authorization that permits us to use or disclose your PHI as part of the research. In this case, we can require you to sign the authorization in order to continue receiving the research-related treatment.
Permitted Use or Disclosure with Opportunity to Agree or Object: Family/Friends: We will disclose PHI about you to a friend or family member who is involved in your treatment. We will also give information to someone who is involved with or who helps you pay for your care. You have a right to request that your PHI not be shared with some or all of your family or friends. We will only disclose information to those person(s) on the approved visitation list as dictated by the courts.
Directory Information: Unless you object, we may disclose directory information (i.e. name, location, general condition and, for clergy only, religious affiliation) to clergy and to persons who ask for you by name. Only those person(s) on the approved visitors list will be provided with information, unless directed by the courts.
Use or Disclosure Permitted by Public Policy or Law without your Authorization:
Law Enforcement Purposes: We will disclose your PHI for law enforcement purposes as required by law, such as responding to a court order or subpoena, identifying a criminal suspect or a missing person, or providing information about a crime victim or criminal conduct. Except for disclosures under court order, subpoena, or as otherwise required or permitted by law, the information disclosed to law enforcement officials will be limited to your contact information or physical characteristics.
Required by Law: We will disclose PHI about you when required by federal, state, or local law to make reports or other disclosures. We also will make disclosures for judicial and administrative proceedings such as lawsuits or other disputes in response to a court order or subpoena. We will disclose your medical information to government agencies concerning victims of abuse, neglect or domestic violence. We will report drug diversion and information related to fraudulent prescription activity to regulatory agencies. Specialized government functions will warrant the use and disclosure of PHI. These government functions will include military and veteran’s activities, national security and intelligence activities, and protective services for the President and others. We will make certain disclosures that are required in order to comply with workers’ compensation or similar programs.
Health or Safety: We may use and disclose PHI to avert a serious threat to health and safety of a person or the public. We may use and disclose PHI to Public Health Agencies for immunizations, communicable diseases, preventing or controlling disease, injury or disability; reporting births and deaths; and notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition. If we believe that a person is a victim of child or adult abuse or neglect, we are required by law to report certain information to public authorities. We will use and disclose PHI for activities related to the quality, safety or effectiveness of FDA-regulated products or activities, including collecting and reporting adverse events, tracking and facilitating product recalls, etc. and post marketing surveillance.
Health Oversight Activities: We may disclose your PHI to a health oversight agency for activities authorized by law. These oversight activities might include audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government benefit programs, and compliance with civil rights laws.
Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement officer, we will disclose your PHI to the correctional institution or law enforcement official. Except for disclosures to another provider for your treatment, the information disclosed will be limited to your contact information or physical characteristics. (This pertains to clients serviced in the Juvenile Detention Center only).
PHI of Deceased Persons: We may disclose PHI about a deceased person to coroners or medical examiners for their duties as authorized by law.
Disclosures of Records Containing Drug or Alcohol Abuse Information: Because of federal law, we will not release your medical information if it contains information about drug or alcohol abuse without your written permission, except in a very limited situations.
Disclosures of Medical Information of Minors: In general, a person who has legal authority to act on your behalf in making health care decisions will be treated as your personal representative and will have access to your PHI. Exceptions apply in certain circumstances, such as where abuse or neglect by the personal representative is involved. Under Indiana law, we cannot disclose the medical information of minors to non-custodial parents if a court order or decree is in place that prohibits the non-custodial parent from receiving such information. However, we must have documentation of the court order prior to denying the non-custodial parent such access.
Disclosures of Mental Health Records: If your records contain information regarding your mental health, we are restricted in the ways that we can use and disclose them. We can disclose such records without written permission only in the following situations:
- If the disclosure is made to you (unless it is determined by a physician that the release would endanger your life or physical safety or that of another person); Disclosures to our employees in certain circumstances; For payment purposes; For data collection for public health purposes, research (subject to privacy protections), and monitoring managed care providers if the disclosure is made to the division of mental health; For reports and testimony required by statutes pertaining to admissions, transfers, discharges, and guardianship proceedings; To a law enforcement agency in certain circumstances or to avert a serious threat to the health and safety of you or others; To a coroner or medical examiner; To satisfy reporting requirements and release of information requirements that are required by law; To another provider in an emergency or if needed to provide health care or mental health services to you; For legitimate business purposes; Under a court order; To the Secret Service if necessary to protect a person under Secret Service protection; and To the Statewide waiver ombudsman.
Incidental Uses and Disclosures: We may occasionally inadvertently use or disclose your PHI when such use or disclosure is incidental to another use or disclosure that is permitted or required by law. For example, while we have safeguards in place to protect against others overhearing our conversations that take place between doctors, nurses or other YOC personnel, there may be times that such conversations are in fact overheard. Please be assured, however, that we have appropriate safeguards in place to avoid such situations, and others, as much as possible.
Disclosure to You: We may disclose your PHI to you.
Limited Data Sets: We may use or disclose certain parts of your PHI, called a “limited data set,” for purposes of research, public health reasons or for our health care operations. We would disclose a limited data set only to third parties that have provided us with satisfactory assurances that they will use or disclose your PHI only for limited purposes.
Disclosures to the Secretary of Health and Human Services: We might be required by law to disclose your PHI to the Secretary of the Department of Health and Human Services, or his/her designee, in the case of a compliance review to determine whether we are complying with privacy laws.
De-Identified Information: We may use your PHI, or disclose it to a third party whom we have hired, to create information that does not identify you in any way. Once we have de-identified your information, it can be used or disclosed in any manner permitted by law.
Disclosures by Members of Our Workforce: Members of our workforce, including employees, volunteers, trainees, or independent contractors, may disclose your PHI to a health oversight agency, public health authority, health care accreditation organization or attorney hired by the workforce member, to report the workforce member’s belief that we have engaged in unlawful conduct or that our care or services could endanger a patient, workers or the public. In addition, if a workforce member is a crime victim, the member may disclose limited PHI about the suspected offender to a law enforcement official.
Other Uses and Disclosures of PHI: Other uses and disclosures of PHI not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you provide us authorization to use or disclose your PHI, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose PHI about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made under the authorization, and that we are required to retain our records of the care that we provided to you.
Your Health Information Rights: Although we must maintain all records concerning your treatment, you have the following rights concerning your PHI:
Right to Inspect and Copy: You have the right to access your PHI and to inspect and copy your PHI as long as we maintain it with certain exceptions, which may include psychotherapy notes information prepared for use in a civil, criminal or administrative action or proceeding, and information that may endanger the life or safety of you or others. We may charge a reasonable cost-based copying fee. You must make your requests to access and copy your PHI in writing to this facility. We will respond to your request within 30 days of its receipt. If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request. In any event, we will act on your request within 60 days of its receipt.
Right to Amend: You have the right to request amendment of your PHI for as long as we maintain it. However, we will deny your request for amendment if:
- We did not create the information; The information is not part of the designated record set; The information would not be available for your inspection (due to its condition or nature); or The information is accurate and complete. If we deny your request for changes in your PHI, we will notify you in writing with the reason for the denial. We will also inform you of your right to submit a written statement disagreeing with the denial that we will include when we disclose the information that you wanted changed. We may prepare a rebuttal to your statement of disagreement and will provide you with a copy of that rebuttal. You must make your request for amendment of your PHI in writing to this office, including your reason to support the requested amendment. We will respond to your request within 60 days of its receipt. If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request. In any event, we will act on your request within 90 days of its receipt.
Right to an Accounting: You have a right to receive an accounting of certain disclosures of your PHI that we made. For each disclosure, you will receive: The date of disclosure, the name of the receiving organization and address if known, a brief description of the PHI disclosed and a brief statement of the purpose of the disclosure or a copy of the written request of the information, if there was one. You must make your request for an accounting of disclosures of your PHI in writing to this office. You must include the time period of the accounting, which may not be longer than 6 years and cannot be for information disclosed prior to the date we were required to comply with the Health Insurance Portability and Accountability Act privacy regulations. We will respond to your request within 60 days from its receipt. If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request. In any event, we will act on your request within 90 days of its receipt. Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI:
- To carry out treatment, payment or health care operations functions; Restricting specific information to only specified family members, relatives, close personal friends or other individuals involved in your care; We will consider your request, but are not required to agree to the requested restrictions.
Right to Confidential Communications: You have the right to receive confidential communications of your PHI by alternative means or at alternative locations. For example, you may request that YOC only contact you at work or by mail. We will accommodate any reasonable request.
Right to Receive a Copy of this Notice: You have the right to receive a paper copy of this Notice of Privacy Practices.
Complaints: If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the Department of Health and Human Services. To file a complaint, please contact our Privacy Officer, at (765) 289-5437. All complaints to our organization must be submitted in writing directly to our Privacy Officer at the address shown below. We assure you that there will be no retaliation for filing a complaint.
Business Associates: We will use and disclose your PHI to business associates contracted to perform business functions on our behalf. Whenever we have an arrangement with another company that involves the use or disclosure of your PHI, that business associate will be required to keep your information confidential and use or disclose it only to perform the contracted services.
This Notice applies to our health care professionals; any member of a volunteer group we allow to help you; all employees, staff and other personnel, and any resident, student or trainee that we have allowed to train at this facility..
Additional Information: For further information regarding the issues covered by this Notice of Privacy Practice, please contact our Director of Compliance, Paula Anderson 3700 West Kilgore Avenue, Muncie, IN 47304 at (765) 289-5437.
Changes to this Notice: We will abide by the terms of the Notice currently in effect. We reserve the right to change the terms of our Notice and to make the new Notice provisions effective for all PHI that we maintain. We will provide you with the revised Notice at your first visit following the revision of the Notice. The new Notice will also be posted on our website, www.yocinc.org, and a copy will be mailed to you upon request.
Effective Date: This Notice is effective as of April 14, 2004. Revisions occurred February 27, 2008.