• Abstract and Figures
• Public Full-text

HIPAA

POLICY

It is the policy of Bethany Christian Services that confidential client information will be protected in accordance with the Health Information Portability and Accountability Act of 1996 (HIPAA), Health Information Technology for Economic and Clinical Health Act (HITECH), professional ethics, and other accreditation and regulatory standards.

When BCS must use or disclose personal protected or personally identifying health information, staff will make all reasonable efforts to only use or disclose the minimum necessary to accomplish the intended purpose of the use or disclosure. Protected health information may be used for treatment, payment, or agency operations. This policy applies to all files and formats (i.e., hard copy, electronic, other digital media, etc.).

PROCEDURE

Uses and Disclosures for Treatment, Billing and Agency Operations Staff who have access to confidential information may use and disclose information as it relates to treatment, billing and operations without receiving consent, authorization or allowing the client an opportunity to object. This would include, but is not limited to, sharing information with auditors, contractors, licensing or accrediting personnel.

When designated staff must access confidential client information for treatment, billing or operations, the person will record the use on the Case Record Sign-Out Form located in the file.

Treatment describes both internal and external treatment and coordination of care. Internal coordination might involve such activities as communicating between programs serving the same client. Externally, this may include sharing information with a contracted agency that has authority to treat/coordinate care according to the law, the courts, or situations in which it is part of a contract or agreement and understood by the client.

Payment/billing refers to activities to obtain payment or reimbursement for services.

Agency Operations includes a variety of activities such as:  quality assessment/improvement (i.e., case management and care coordination);  competency evaluation (i.e., performance evaluation, credentialing, and accreditation);  completion of chart reviews, audits, or legal services (i.e., fraud and abuse identification and compliance programs);  insurance functions (i.e., underwriting and risk management);  business operations and planning (i.e., development, management, and administration); and  general business management and administrative activities (i.e., creating limited datasets, certain fundraising activities on behalf of BCS).

Release & Access of Information Policy Page 1 of 6 (Information and examples obtained from U.S. Department of Health and Human Services (2003). Retrieved from http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html) Clients have the right to request that BCS restrict the use or disclosure of their personal health information for treatment, billing, and operations. However, BCS is not required to agree to the request but will consider all reasonable requests.

Minimum Necessary To comply with the minimum necessary standard and protect client confidentiality, branch directors will identify the staff roles that require access to client information to carry out their duties. For each role, the branch director will identify the types of confidential information to which access is needed and any conditions for access. In addition, the branch director will make reasonable efforts to limit access of all staff to the degree and conditions based on their role.

Full administrative access to Bethany electronic database systems which contain client protected health information will be approved on an as-needed basis by the HIPAA Privacy Officer, in conjunction with the Senior Executive Team.

Branch directors, volunteers, interns, board members and employees may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose in the following circumstances:  When making disclosures to public officials such as for health oversight, to coroners, and so forth, if the public official represents that the information requested is the minimum necessary for the stated purpose;  When another covered entity requests the information;  When the information is requested by a professional who is a member of BCS’ workforce or is its business associate for the purpose of providing professional services to BCS, if the professional represents that the information requested is the minimum necessary for the stated purpose(s); and  When documentation/representations that comply with disclosures for research have been provided by the requester for research purposes.

For all uses, disclosures or requests to which the minimum necessary rule applies, BCS may not use, disclose or request an entire record, except when the entire record is justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure or request.

This requirement does not apply to the following disclosures:  Those made upon request by an individual, pursuant to an individual’s right of access, or as required by the Secretary of Department of Health and Human Services to enforce compliance;  Those required by law;  Those required for compliance with the privacy regulations; or  Those made by a covered health care provider to a covered health plan when the information is requested for audit and related purposes.

Uses and Disclosures Requiring Authorization Should staff be unclear about which information requires authorization, staff will discuss this with a supervisor, branch director, and/or director of operations.

Release & Access of Information Policy Page 2 of 6 Capacity to Authorize Release of Information or Access of Records: BCS requires a written, signed, current, valid authorization to release or access information as follows:

Client Category Required Signature Adult Client The client or a duly authorized representative such as a court appointed guardian or attorney. Proof of authorized representation required such as a notarized power of attorney. Deceased Client Executor or administrator of the estate. Proof of authorized representation required such as a court document as well as a death certificate. Unemancipated Minor Parent or legally appointed guardian or attorney. Proof of relationship is required. Emancipated Minor1 Same as adult client. Client in Psychiatric, Same as adult client. Drug or Alcohol Program Client with AIDS/HIV or Same as adult client. other Sexually Transmitted Disease

For authorization involving mental health, drug or alcohol use, AIDS/HIV or other sexually transmitted diseases, see State-specific laws.

Refusal to Honor Authorization: Staff will not honor a client’s authorization when they have a reasonable doubt/question as to the:  Identity of the person presenting the authorization;  Status of the individual as the duly appointed representative of a minor, a deceased, or an incompetent person;  Legal age or status as an emancipated minor;  Client’s capacity to understand the meaning of the authorization;  Authenticity of the client’s signature;  Current validity of the authorization; or  Lack of expiration date or an expired date on the release.

In such situations, the employee will involve the supervisor or branch director. Proof of identity may include a driver’s license or government issued ID. See Denial of Request for Information for more information. Disclosing Confidential Information that Requires an Authorization to Release The staff member will: a. Confirm there are no prohibitions or exceptions to releasing the information; b. Discuss this with their supervisor and/or branch director; c. Know their state’s confidentiality laws and follow them;

1 State laws define which minors are “emancipated”, that is able to act as an adult. Typical factors resulting in emancipation include: marriage, pregnancy, earning a living as an adult, and having moved out of the family home.

Release & Access of Information Policy Page 3 of 6 d. Review the necessity and legitimacy of the request when releasing it; and e. Obtain appropriate Authorization for Release and Access of Information Form for purposes that are not treatment, payment, or operations.

When a client requests access to their own record, the staff member will document in the case notes what information was shared with the client.

The staff member will prepare a cover letter detailing the items included and stamp all information confidential. Each disclosure going outside of BCS will contain the following notice: The attached information pertaining to [name of consumer] is confidential and legally privileged. Bethany Christian Services has provided it to [name of recipient] as authorized by the consumer. The recipient may not further disclose the information without the express consent of the consumer or as authorized by law.

Redacting Information: Information that is not related to the request, such as concerning someone other than the client or information that is not accessible under federal or state law, will be removed from the record prior to the release or access. Information not relevant to the client, that could be harmful to the client, or that identifies a confidential source will be redacted.

Redacting information involves making a copy of the document, blacking out this information (or using White-Out), and recopying the new blacked out document to share with the client. Copies with White-Out should never be given to a client.

Disclosures Not Requiring Consent, Authorization or Opportunity to Object The following types of disclosures by designated staff do not require consent, authorization or an opportunity for the client to object. These situations may require the use of legal counsel to clarify the proper response and obligation of BCS to release information such as:  Disclosures about victims of abuse, neglect, or domestic violence;  Disclosures and uses for judicial and administrative proceedings separate from proceedings coordinating treatment or care of a specific consumer;  Disclosures for law enforcement purposes (except in an emergency in which no time exists for legal review);  Uses and disclosures to avert a serious threat to health and safety (except in an emergency in which no time exists for legal review);  National security and intelligence activities; and  Correctional institutions and other law enforcement custodial institutions.

See Procedure for Disclosures not requiring consent, authorization or opportunity to object

Denying a Request See Denying a Request for Release and Access of Information.

Retention of Request The staff person responsible for the case will retain the original request, the authorization for release of information, and a copy of the cover letter in the client’s record for the appropriate retention period or for not less than six years from the date of release, whichever is longer.

Release & Access of Information Policy Page 4 of 6 Revocation of Authorization A client may revoke an authorization by informing the BCS office where services were provided. Upon receipt of the oral or written revocation, the staff person responsible for the case or their designee will initial and date the revocation or the case record note, and the release form being revoked. The revocation will become effective the date BCS staff receive it.

Monitoring Process & Quality Assurance Each branch office staff responsible for the case will maintain a disclosure log kept in the client’s file to track each release or access of information not related to treatment, billing or healthcare operations or those authorized by the consumer. The log will contain the following information:  Date department received the request or of the incident requiring a disclosure;  Name of client;  Name and status (i.e. public health official) of person receiving the information;  Authority for release (i.e. required by law);  Reason for release;  Information released;  Date released;  How information was sent; and  Fee charged (if applicable).

When reviewing the request to disclose, the supervisor will pay close attention to the following factors:  Validity of authorization;  Appropriateness of information abstracted in response to the request;  Retention of authorization, request, and transmitting cover letter requirements;  Procedures for telephone, electronic, and in-person requests; and  Proper processing of fees.

Right to Amend a Case Record Following the review of a record, a client has a right to amend the record. The individual must submit in writing any amendments s/he feels are necessary. The staff person responsible for maintaining the record will place the written amendment in the record. If the staff person agrees with the amendment, the staff person will modify the record to reflect the amendment. Staff have a right to disagree with the amendment, and may note their disagreement in the record.

In the case of amending records, proper documentation techniques should be utilized (i.e., no white out, single line strike through that is initialed by staff member). BCS staff cannot change documents that were not created by BCS staff.

Enforcement All branch directors and supervisors are responsible for enforcing this policy. Employees who violate this policy are subject to discipline up to and including termination in accordance with the Bethany Christian Services Sanction Policy.

COA: CR 2, ETH 5, RPM 1, 6, 7 & 8 Hague: 96.42 HIPAA 42 CFR Part 2

Approved: 6/20/2003 by TQM Committee: Amended 9/5/2003 Updated: 7/20/2011 by PQI Committee

Release & Access of Information Policy Page 5 of 6 REVISED/APPROVED: 3/8/2013 by Director of Quality Services Revised/Approved: 12/11/2014 by PQI Committee

Release & Access of Information Policy Page 6 of 6

Load more

  6

Copy Link