Notice of Privacy Practices
NOTICE OF PSYCHOLOGIST’S POLICIES & PRACTICES TO PROTECT THE PRIVACY OF YOUR HEALTH INFORMATION
This information is made available so that you are fully aware of how psychological and medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
I. Uses and Disclosures for Treatment, Payment, and Health Care Operations
I may use or disclose your protected health information (PHI) for treatment, payment, and health care operations purposes with your consent. To clarify these terms, here are some definitions:
•“PHI” refers to information in your health record that could identify you.
•“Treatment” is when I provide, coordinate, or manage your health care and other services related to your health care. An example of treatment would be when I consult with another health care provider, such as your family physician or another psychologist.
•“Payment” is when I obtain reimbursement for your healthcare. Examples of payment are when I disclose your PHI to your health insurer to obtain reimbursement for your health care or to determine eligibility or coverage.
• “Health Care Operations” are activities that relate to the performance and operation of my practice. Examples of health care operations are quality assessment and improvement activities, business-related matters such as audits and administrative services, and case management and care coordination.
• “Use” applies to only activities within my office such as sharing, employing, applying, utilizing, examining and analyzing information that identifies you.
• “Disclosure” applies to activities outside of my office such as releasing, transferring, or providing access to information about you to other parties.
II. Uses and Disclosures Requiring Authorization
I may use or disclose PHI for purposes outside of treatment, payment, or health care operations when your appropriate authorization is obtained. An “authorization” is written permission above and beyond the general consent that permits only specific disclosures. In those instances when I am asked for information for purposes outside of treatment, payment or health care operations, I will obtain an authorization from you before releasing this information. You may revoke all such authorizations (of PHI or Psychotherapy Notes) at any time, provided each revocation is in writing. You may not revoke an authorization to the extent that (1) I have relied on that authorization; or (2) if the authorization was obtained as a condition of obtaining insurance coverage, law provides the insurer the right to contest the claim under the policy.
III. Uses and Disclosures with Neither Consent nor Authorization
I may use or disclose PHI without your consent or authorization in the following circumstances:
• Child Abuse: If I have reason to believe that child abuse or neglect has occurred or that there exists a substantial risk that child abuse or neglect may occur in the reasonably foreseeable future, I must immediately report the matter to the appropriate authority.
• Adult and Domestic Abuse: If I, in the performance of my professional or official duties, know or have reason to believe that a dependent adult has been abused and is threatened with imminent abuse, I must promptly report the matter to the appropriate authority.
• Health Oversight Activities: If the Hawaii Board of Psychology is investigating my competency, license or practice, I may be required to disclose protected health information regarding you.
• Judicial and Administrative Proceedings: If you are involved in a lawsuit or a dispute, I may disclose PHI in response to a court or administrative order. I also may disclose PHI in response to a subpoena, discovery request, or other legal process from someone else involved in the dispute, but only if efforts have been made to tell you about the request or to get an order protecting the information requested. I may also use or disclose your PHI to defend myself in the event of a lawsuit.
• Serious Threat to Health or Safety: I may disclose protected health information regarding you where there is a clear and imminent danger to you or another individual or to society, and then only to appropriate professional workers or public authorities. If you are at risk, I may also contact family members or others who could assist in providing protection.
• Worker’s Compensation: If you have filed a worker’s compensation claim, I may be required to disclose PHI about any services I have provided to you and that are relevant to the claimed inquiry.
• Other Legal Purposes: If it is allowed under federal privacy rules and state confidentiality laws such as disclosures to law enforcement agencies, to a health oversight agency (such as the U.S. Department of Health and Human Services or a state department of health), to a coroner or medical examiner, for public health purposes relating to disease or FDA-regulated products, or for specialized government functions such as fitness for military duties, eligibility for VA benefits, and national security and intelligence.
IV. Patient’s Rights and Psychologist’s Duties
Patient’s Rights:
• Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of PHI. However, I am not required by federal regulation to agree to your request. If I do agree with your request, I will comply unless the information is needed to provide emergency treatment. To request restrictions, you must make your request in writing. Your request must state the specific restriction requested, whether you want to limit our use and/or disclosure; and to whom you want the restriction to apply.
• Right to Receive Confidential Communication by Alternative Means and at Alternative Locations: You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations. (For example, you may not want a family member to know that you are seeing me. On your request, I will send your bills to another address.)
• Right to an Accounting: You generally have the right to receive an accounting of disclosures of PHI. On your request, I will discuss with you the details of the accounting process (e.g., cost and timeline of process).
• Right to Inspect, Amend, or Copy: You have the right to inspect, receive, and copy PHI that may be used to make decisions about your care or payment for your care. I have up to 30 days to make your PHI available to you and I may charge you a reasonable fee for the costs of copying, mailing or other supplies associated with your request. You can only direct me in writing to submit your PHI to a third party not covered in this notice. I may not charge you a fee if you need the information for a claim for benefits under the Social Security Act or any other state or federal needs-based benefit program. I may deny your request in certain limited circumstances. If I do deny your request, you have the right to have the denial reviewed by a licensed healthcare professional who was not directly involved in the denial of your request, and I will comply with the outcome of the review.
• Right to Amend: If you feel that the PHI I have is incorrect or incomplete, you may ask me to amend the information. You have the right to request an amendment for as long as the information is kept by or for me. A request for amendment must be made in writing to my office and it must tell me the reason for your request. In certain cases, I may deny your request for an amendment. If I deny your request for an amendment, you have the right to file a statement of disagreement with me and I may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal.
• Right to a Paper Copy: You have the right to obtain a paper copy of the notice from me upon request, even if you have agreed to receive the notice electronically.
• Right to Restrict Disclosures When You Have Paid for Your Care Out-of-Pocket: You have the right to restrict certain disclosures of PHI to a health plan when you pay out-of-pocket in full for my services.
• Right to Be Notified if There is a Breach of Your Unsecured PHI: You have a right to be notified if: (a) there is a breach (a use or disclosure of your PHI in violation of the HIPAA Privacy Rule) involving your PHI; (b) that PHI has not been encrypted to government standards; and (c) my risk assessment fails to determine that there is a low probability that your PHI has been compromised.
• Right to Opt Out of Office Administration Procedures: Unless you object in writing, I may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, I may disclose such information as necessary if I determine that it is in your best interest based on my professional judgment. I may use and disclose PHI to contact you to remind you that you have an appointment for medical care, or to contact you to tell you about possible treatment options or alternatives or health related benefits and services that may be of interest to you. I may disclose PHI to my business associates who perform functions on my behalf or provide us with services if the PHI is necessary for those functions or services. For example, I may use another company to do our billing, or to provide transcription or consulting services for me. All of my business associates are obligated, under contract with me, to protect the privacy and ensure the security of your PHI.
Psychologist’s Duties:
• I am required by law to maintain the privacy of PHI and to provide you with a notice of my legal duties and privacy practices with respect to PHI.
• I reserve the right to change the privacy policies and practices described in this notice. Unless I notify you of such changes, however, I am required to abide by the terms currently in effect.
• If I revise my policies and procedures, I will post a notice of revision in my office and on my website.
V. Questions and Complaints
If you have questions about this notice, disagree with a decision I make about access to your records, or have other concerns about your privacy rights, you may contact me. If you believe that your privacy rights have been violated and wish to file a complaint, you may send your written complaint to me at the office. You may also send a written complaint to the Secretary of the U.S. Department of Health and Human Services. I can provide you with the appropriate address upon request. You have specific rights under the Privacy Rule. I will not retaliate against you for exercising your right to file a complaint.
VI. Effective Date, Restrictions, and Changes to Privacy Policy
This notice will go into effect on September 2013. I reserve the right to change this Notice. I reserve the right to make the changed Notice effective for PHI we already have as well as for any PHI we create or receive in the future. A copy of our current Notice is posted in my office and on my website.
VII. Breach Notification Addendum to Policies and Procedures
When I become aware of or suspect a breach, I will conduct a Risk Assessment. I will keep a written record of that Risk Assessment. Unless I determine that there is a low probability that PHI has been compromised, I will give notice of the breach. The risk assessment can be done by a business associate if it was involved in the breach. While the business associate will conduct a risk assessment of a breach of PHI in its control, I will provide any required notice to patients and HHS. After any breach, particularly one that requires notice, I will re-assess its privacy and security practices to determine what changes should be made to prevent the re-occurrence of such breaches.
This information is made available so that you are fully aware of how psychological and medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
I. Uses and Disclosures for Treatment, Payment, and Health Care Operations
I may use or disclose your protected health information (PHI) for treatment, payment, and health care operations purposes with your consent. To clarify these terms, here are some definitions:
•“PHI” refers to information in your health record that could identify you.
•“Treatment” is when I provide, coordinate, or manage your health care and other services related to your health care. An example of treatment would be when I consult with another health care provider, such as your family physician or another psychologist.
•“Payment” is when I obtain reimbursement for your healthcare. Examples of payment are when I disclose your PHI to your health insurer to obtain reimbursement for your health care or to determine eligibility or coverage.
• “Health Care Operations” are activities that relate to the performance and operation of my practice. Examples of health care operations are quality assessment and improvement activities, business-related matters such as audits and administrative services, and case management and care coordination.
• “Use” applies to only activities within my office such as sharing, employing, applying, utilizing, examining and analyzing information that identifies you.
• “Disclosure” applies to activities outside of my office such as releasing, transferring, or providing access to information about you to other parties.
II. Uses and Disclosures Requiring Authorization
I may use or disclose PHI for purposes outside of treatment, payment, or health care operations when your appropriate authorization is obtained. An “authorization” is written permission above and beyond the general consent that permits only specific disclosures. In those instances when I am asked for information for purposes outside of treatment, payment or health care operations, I will obtain an authorization from you before releasing this information. You may revoke all such authorizations (of PHI or Psychotherapy Notes) at any time, provided each revocation is in writing. You may not revoke an authorization to the extent that (1) I have relied on that authorization; or (2) if the authorization was obtained as a condition of obtaining insurance coverage, law provides the insurer the right to contest the claim under the policy.
III. Uses and Disclosures with Neither Consent nor Authorization
I may use or disclose PHI without your consent or authorization in the following circumstances:
• Child Abuse: If I have reason to believe that child abuse or neglect has occurred or that there exists a substantial risk that child abuse or neglect may occur in the reasonably foreseeable future, I must immediately report the matter to the appropriate authority.
• Adult and Domestic Abuse: If I, in the performance of my professional or official duties, know or have reason to believe that a dependent adult has been abused and is threatened with imminent abuse, I must promptly report the matter to the appropriate authority.
• Health Oversight Activities: If the Hawaii Board of Psychology is investigating my competency, license or practice, I may be required to disclose protected health information regarding you.
• Judicial and Administrative Proceedings: If you are involved in a lawsuit or a dispute, I may disclose PHI in response to a court or administrative order. I also may disclose PHI in response to a subpoena, discovery request, or other legal process from someone else involved in the dispute, but only if efforts have been made to tell you about the request or to get an order protecting the information requested. I may also use or disclose your PHI to defend myself in the event of a lawsuit.
• Serious Threat to Health or Safety: I may disclose protected health information regarding you where there is a clear and imminent danger to you or another individual or to society, and then only to appropriate professional workers or public authorities. If you are at risk, I may also contact family members or others who could assist in providing protection.
• Worker’s Compensation: If you have filed a worker’s compensation claim, I may be required to disclose PHI about any services I have provided to you and that are relevant to the claimed inquiry.
• Other Legal Purposes: If it is allowed under federal privacy rules and state confidentiality laws such as disclosures to law enforcement agencies, to a health oversight agency (such as the U.S. Department of Health and Human Services or a state department of health), to a coroner or medical examiner, for public health purposes relating to disease or FDA-regulated products, or for specialized government functions such as fitness for military duties, eligibility for VA benefits, and national security and intelligence.
IV. Patient’s Rights and Psychologist’s Duties
Patient’s Rights:
• Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of PHI. However, I am not required by federal regulation to agree to your request. If I do agree with your request, I will comply unless the information is needed to provide emergency treatment. To request restrictions, you must make your request in writing. Your request must state the specific restriction requested, whether you want to limit our use and/or disclosure; and to whom you want the restriction to apply.
• Right to Receive Confidential Communication by Alternative Means and at Alternative Locations: You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations. (For example, you may not want a family member to know that you are seeing me. On your request, I will send your bills to another address.)
• Right to an Accounting: You generally have the right to receive an accounting of disclosures of PHI. On your request, I will discuss with you the details of the accounting process (e.g., cost and timeline of process).
• Right to Inspect, Amend, or Copy: You have the right to inspect, receive, and copy PHI that may be used to make decisions about your care or payment for your care. I have up to 30 days to make your PHI available to you and I may charge you a reasonable fee for the costs of copying, mailing or other supplies associated with your request. You can only direct me in writing to submit your PHI to a third party not covered in this notice. I may not charge you a fee if you need the information for a claim for benefits under the Social Security Act or any other state or federal needs-based benefit program. I may deny your request in certain limited circumstances. If I do deny your request, you have the right to have the denial reviewed by a licensed healthcare professional who was not directly involved in the denial of your request, and I will comply with the outcome of the review.
• Right to Amend: If you feel that the PHI I have is incorrect or incomplete, you may ask me to amend the information. You have the right to request an amendment for as long as the information is kept by or for me. A request for amendment must be made in writing to my office and it must tell me the reason for your request. In certain cases, I may deny your request for an amendment. If I deny your request for an amendment, you have the right to file a statement of disagreement with me and I may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal.
• Right to a Paper Copy: You have the right to obtain a paper copy of the notice from me upon request, even if you have agreed to receive the notice electronically.
• Right to Restrict Disclosures When You Have Paid for Your Care Out-of-Pocket: You have the right to restrict certain disclosures of PHI to a health plan when you pay out-of-pocket in full for my services.
• Right to Be Notified if There is a Breach of Your Unsecured PHI: You have a right to be notified if: (a) there is a breach (a use or disclosure of your PHI in violation of the HIPAA Privacy Rule) involving your PHI; (b) that PHI has not been encrypted to government standards; and (c) my risk assessment fails to determine that there is a low probability that your PHI has been compromised.
• Right to Opt Out of Office Administration Procedures: Unless you object in writing, I may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, I may disclose such information as necessary if I determine that it is in your best interest based on my professional judgment. I may use and disclose PHI to contact you to remind you that you have an appointment for medical care, or to contact you to tell you about possible treatment options or alternatives or health related benefits and services that may be of interest to you. I may disclose PHI to my business associates who perform functions on my behalf or provide us with services if the PHI is necessary for those functions or services. For example, I may use another company to do our billing, or to provide transcription or consulting services for me. All of my business associates are obligated, under contract with me, to protect the privacy and ensure the security of your PHI.
Psychologist’s Duties:
• I am required by law to maintain the privacy of PHI and to provide you with a notice of my legal duties and privacy practices with respect to PHI.
• I reserve the right to change the privacy policies and practices described in this notice. Unless I notify you of such changes, however, I am required to abide by the terms currently in effect.
• If I revise my policies and procedures, I will post a notice of revision in my office and on my website.
V. Questions and Complaints
If you have questions about this notice, disagree with a decision I make about access to your records, or have other concerns about your privacy rights, you may contact me. If you believe that your privacy rights have been violated and wish to file a complaint, you may send your written complaint to me at the office. You may also send a written complaint to the Secretary of the U.S. Department of Health and Human Services. I can provide you with the appropriate address upon request. You have specific rights under the Privacy Rule. I will not retaliate against you for exercising your right to file a complaint.
VI. Effective Date, Restrictions, and Changes to Privacy Policy
This notice will go into effect on September 2013. I reserve the right to change this Notice. I reserve the right to make the changed Notice effective for PHI we already have as well as for any PHI we create or receive in the future. A copy of our current Notice is posted in my office and on my website.
VII. Breach Notification Addendum to Policies and Procedures
When I become aware of or suspect a breach, I will conduct a Risk Assessment. I will keep a written record of that Risk Assessment. Unless I determine that there is a low probability that PHI has been compromised, I will give notice of the breach. The risk assessment can be done by a business associate if it was involved in the breach. While the business associate will conduct a risk assessment of a breach of PHI in its control, I will provide any required notice to patients and HHS. After any breach, particularly one that requires notice, I will re-assess its privacy and security practices to determine what changes should be made to prevent the re-occurrence of such breaches.
notice_of_privacy_practices.pdf | |
File Size: | 184 kb |
File Type: |