PRIVACY POLICY STATEMENT
FAMILY HEALTH CARE CENTER, LLC
19 CHURCH HILL RD- NEWTOWN, CT 06470
Purpose: The following privacy policy is adopted to ensure that Family Health Care Center, L.L.C.- FHCC,LLC- complies fully with all federal and state privacy protection laws and regulations. Protection of patient privacy is of paramount importance to this organization. Violations of any of these provisions will result in disciplinary action including termination of employment and possible referral for criminal prosecution.
Protected Health Information (PHI)as defined by HIPAA is included in the following list. Items with and * indicate information that may be required by FHCC, LLC in order to provide proper health care and to obtain reimbursement from health care plans. Therefore, all employees of FHCC, LLC are subject to this policy.
NAME*
ADDRESS INCLUDING ZIP CODE* Photographic images/x-rays
EMPLOYMENT INFORMATION* Account number
SOCIAL SECURITY NUMBER* Fax Number
DATE OF BIRTH* Internet (IP) Address
MEDICAL RECORD NUMBER* Vehicle/Device Serial Number
NAMES OF RELATIVES* Finger or Voice Prints
HEALTH PLAN NUMBER* Web URL
TELEPHONE NUMBER* Certificate/License Number
THE ENTIRE AND COMPLETE PATIENT’S FILE EITHER PAPER, ELECTRONIC (PPART)
OR BILLING INFORMATION (CI).
Effective Date: This policy is in effect as of April 14th, 2003
Expiration Date: This policy remains in effect until superceded or cancelled.
Policy Owner: Alexander E. Isgut, M.D. for question regarding this policy should be addressed to Administrator (Doraliza Isgut) or Assistant Administrator (Terry Scalora).
Assigning Privacy and Security Responsibilities
It is the policy of FHCC.LLC that specific individuals within our workforce are assigned the responsibility of implementing and maintaining HIPAA Privacy Policies. Furthermore, it is the policy of FHCC, LLC that these individuals will be provided sufficient resources and authority to fulfill their responsibilities. At a minimum it is the policy of FHCC, LLC that there will be one individual or job description designated as the Privacy Official.
Uses and Disclosures of Protected Health Information
It is the policy of FHCC, LLC that protected health information may not be used or disclosed except when at least one of the following conditions is true:
1. The individual who is the subject of the information (i.e. the “subject individual”) has authorized the use or disclosure.
2. The use or disclosure is for an individual’s treatment, payment or health care operations.
3. The individual who is the subject of the information does not object VERBALLY OR IN WRITING (must be documented on chart) to the disclosure and the disclosure is to friends or family members involved in the health care of the individual.
4. The disclosure is to the individual who is the subject of the information or to HHS for compliance-related purposes.
5. The use or disclosure is otherwise permitted or required by HIPAA.
Deceased Individuals
It is the policy of FHCC. LLC that privacy protections extend to information concerning deceased individuals.
Notice of Privacy Practices
It is the policy of FHCC, LLC that a notice of privacy practices must be provided to all patients at the earliest practicable time and posted in our office, that any revised notice be available to patients upon request and that all uses and disclosures of protected health information be done in accord with this organization’s notice of privacy practices.
Restriction Requests
It is the policy of FHCC, LLC that consideration must be given to all requests for restrictions on uses and disclosures of protected health information as stated in this organization’s notice of privacy practices. It is furthermore the policy of this organization that if a particular restriction is agreed to, then this organization is bound by that restriction.
Minimum Necessary Disclosure of Protected Health Information
It is the policy of FHCC, LLC that (except for disclosures to a health care provider made for treatment purposes, disclosures to the patient, disclosures pursuant to an authorization, or disclosures to the Secretary of DHHS for HIPAA compliance purposes) all uses and disclosures of protected health information must be limited to the minimum amount of information needed to accomplish the purpose of the use or disclosure. It is also the policy of this organization that all requests for protected health information (except requests made for treatment purposes) must be limited to the minimum amount of information needed to accomplish the purpose of the request.
Access to Protected Health Information by Workforce Members
It is the policy of FHCC, LLC that access to protected health information must be granted to each employee or contractor based on the assigned job functions of the employee or contractor only as necessary to accomplish the assigned job function.
Access to Protected Health Information by the Subject Individual
It is the policy of FHCC, LLC that, where required by state law or HIPAA, access to protected health information must be granted to the person who is the subject of such information within the timeframes required by state law or the HIPAA Privacy Rule. It is the policy of FHCC, LLC to inform the person requesting access of the location of protected health information if we do not physically possess such PHI but have knowledge of its location.
Amendment of Incomplete or Incorrect Protected Health Information
It is the policy of FHCC, LLC that all requests for amendment of protected health information maintained by this organization will be considered in a timely fashion. If such requests demonstrate that the information is actually incorrect or incomplete, this organization will allow amending language to be added to the appropriate document and this addition will be done in a timely fashion. It is not the policy of this organization to change, remove or strike through any original document. It is also the policy of this organization that notice of such corrections will be given to any person or organization with which the incorrect information has been shared who have relied or may rely on such information to the detriment of the patient.
Access by Personal Representatives
It is the policy of FHCC, LLC that access to protected health information must be granted to personal representatives of subject individuals as specified by subject individuals, unless there is reason to believe that the individual has been or may be subjected to domestic violence, abuse or neglect by the personal representative, or that treating the person as the individual’s personal representative may endanger the individual, and we determine that it is not in the individual’s best interests to treat the person as the individual’s personal representative.
Confidential Communications Channels
It is the policy of FHCC, LLC that confidential communications channels be used, as requested by subject individuals, to the extent possible. FHCC, LLC employees will use every caution in utilizing communications with Health Plans, patients and fellow employees. Means of communications include e-mails, fax machines, telephones, oral communications, mail delivery, stored documents and electronic patients files on the network, posted notices, letter, memos, notes both hand written or entered into the system and modem communication. Employees are advice to use caution when utilizing any means of communications that may involve client PHI.
Disclosure Accounting
It is the policy of FHCC, LLC that an accounting of all disclosures of protected health information to which an individual has a right to an receive an accounting be given to subject individuals whenever such an accounting is requested. Accounting of disclosure will go as far as 6 yrs from the date of the request.
Marketing Activities
It is the policy of this FHCC, LLC that any uses or disclosures of protected health information for marketing activities will be done only after a valid authorization is in effect.
Complaints
It is the policy of FHCC, LLC that all complaints relating to the privacy of health information be investigated and resolved in a timely fashion. Furthermore, it is the policy of this FHCC. LLC that all complaints will be addressed to Doraliza Isgut, Administrator, and/or Terry Scalora, Assistant Administrator, authorized to handle complaints who will be duly authorized to investigate complaints and implement resolutions if the complaint stems from a valid area of non compliance with the HIPAA Privacy Rule.
Prohibited Activities
It is the policy of FHCC, LLC that no employee or contractor may engage in any intimidating or retaliatory acts against persons who file complaints or otherwise exercise their rights under HIPAA regulations. It is also the policy of this organization that no employee or contractor may condition treatment, payment, enrollment or eligibility for benefits on the provision of an authorization to disclose protected health information, except in specifically permitted circumstances.
Responsibility
It is the policy of FHCC, LLC that the responsibility for designing and implementing procedures to implement this policy lies with the chief privacy officer (i.e. “CPO”).
Verification of Identity
It is the policy of FHCC, LLC that the identity and authority of all persons who request access to protected health information to present VALID IDENTIFICATION before such access is granted as required under the HIPAA Privacy Rule.
Mitigation
It is the policy of FHCC, LLC that the effects of any unauthorized use or disclosure of protected health information be mitigated to the extent possible.
Safeguards
It is the policy of this FHCC, LLC that appropriate administrative, technical and physical safeguards will be in place to reasonably safeguard protected health information from any intentional or unintentional use or disclosure that is in violation of the HIPAA Privacy Rule. These safeguards apply to information maintained in any form, including oral information, as applicable.
Business Associates
It is the policy of FHCC, LLC that business associates must be contractually bound to protect health information to the same degree as set forth in this policy. It is also the policy of this organization that business associates who violate their agreement will be dealt with first by an attempt to correct the problem, and if that fails by termination of the agreement and discontinuation of services by the business associate and/or notification to the Secretary of DHHS.
Training and Awareness
It is the policy of this FHCC, LLC that all members of our workforce have been trained by the compliance date on the policies and procedures governing protected health information and how FHCC, LLC complies with the HIPAA Privacy and Rule. It is also the policy of FHCC, LLC that new members of our workforce receive training on these matters within a reasonable time after they have joined the workforce and no later than 5 days into the training period. It is the policy of FHCC, LLC to provide training should any policy or procedure related to the HIPAA Privacy Rule materially change. This training will be provided within a reasonable time, and no more that 2 weeks after the policy or procedure materially changes. Furthermore, it is the policy of FHCC, LLC that training will be documented indicating participants, date and subject matter.
Sanctions
It is the policy of FHCC, LLC that sanctions will be in effect for any member of the workforce who intentionally or unintentionally violates any of these policies or any procedures related to the fulfillment of these policies.
Retention of Records
It is the policy of this FHCC, LLC that the HIPAA Privacy Rule records retention requirement of six years will be strictly adhered to. All records designated by HIPAA in this retention requirement will be maintained in a manner that allows for access within a reasonable period of time. This records retention time requirement may be extended at this organization’s discretion to meet with other governmental regulations or those requirements imposed by our professional liability carrier.
Cooperation with Privacy Oversight Authorities
It is the policy of FHCC, LLC that oversight agencies such as the Office for Civil Rights of the Department of Health and Human Services be given full support and cooperation in their efforts to ensure the protection of health information within this organization. It is also the policy of this organization to cooperate with privacy compliance reviews and investigations in accordance with the requirements of HIPAA and other applicable law.
|
|
||||||||||||||
|
||||||||||||||
|
||||||||||||||
