NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET
ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
It is important to read and understand this Notice of Privacy Practices before signing any Acknowledgment of Receipt of the Notice of Privacy Practices.
If you have any questions about this Notice or would like further information concerning your privacy rights, please contact our Compliance Officer.
I.PURPOSE OF THE NOTICE OF PRIVACY PRACTICES
This Notice of Privacy Practices (the “Notice”) is meant to inform you of the uses and disclosures of protected health information (PHI) that we may make. It also describes your rights to access and control your PHI and certain obligations we have regarding the use and disclosure of your protected health information.
Your “protected health information” is information about you created and received by us, including demographic information, that may reasonably identify you and that relates to your past, present, or future physical or mental health or condition, or payment for the provision of your health care.
The Privacy Rule, a federal law, gives you rights over your PHI and sets rules and limits as to who can look at and/or receive your PHI.
The Privacy Rule applies to all forms of individuals’ PHI, whether electronic, written or oral. The Security Rule is a federal law that requires security for PHI in electronic form. This Notice describes how we may use or disclose your PHI to carry out treatment, payment, or health care operations, as well as other purposes permitted or required by law.
We are required by law to maintain the privacy of your protected health information. We are also required by law to provide you with this Notice of our legal duties and privacy practices with respect to your protected health information, to notify you following Client
NOTICE OF PRIVACY PRACTICES
a breach of your unsecured protected health information, and to abide by the terms of the Notice that is currently in effect.
We reserve the right to change the terms of this Notice, at which time, the provisions of the newer Notice will be effective for all PHI that we maintain. If this Notice is revised at any time, we will provide all residents with a revised copy, in accordance with the Privacy Rule.
II.UNDERSTANDING YOUR HEALTH RECORD AND INFORMATION
Each time we provide care to you, a record is made containing health and financial information. Typically, this record contains information about your condition, the treatment we provide and payment for the treatment. We may use and/or disclose this information:
A. to plan your care and treatment
B. to communicate with other health professionals involved in your care
C. to document the care you receive
D. to educate health professionals
E. to provide information for medical research
F. to provide information to public health officials
G. to evaluate and improve the care we provide
H. to obtain payment for the care we provide
I. for administrative purposes
III. UNDERSTANDING WHAT IS IN YOUR RECORD AND HOW YOUR PHI IS USED HELPS YOU TO:
A. ensure it is accurate
B. better understand who may access your PHI
C. make more informed decisions when authorizing disclosure to others
IV. HOW WE MAY USE OR DISCLOSE
YOUR PROTECTED HEALTH INFORMATION
The following categories describe some of the different ways that we may use or disclose your PHI. Even if not specifically listed below, the CLIENT (the “Facility”) may use and disclose your PHI as permitted or required by law or as authorized by you. We will make reasonable efforts to limit access to your PHI to those persons or classes of persons, as appropriate, in our workforce who need access to carry out their duties. In addition, if required, we will make reasonable efforts to limit the PHI to the minimum amount necessary to accomplish the intended purpose of any use or disclosure and to the extent such use or disclosure is limited by law.
V. USES AND DISCLOSURES OF YOUR PHI THAT MAY BE MADE WITHOUT YOUR AUTHORIZATION OR OPPORTUNITY TO AGREE OR OBJECT
A. For Treatment—We may use and disclose your PHI to provide you with medical treatment and related services. For example, we may also use or disclose PHI about you in order to coordinate your care and provide you with medication, lab work, and x-rays. If we are permitted to do so, we may also disclose your PHI to individuals or facilities that will be involved with your care after you leave the Facility and for other treatment reasons. We may also use or disclose your PHI in an emergency situation.
B. For Payment—We may use and disclose your PHI so that we can bill and receive payment for the treatment and related services you receive. For billing and payment purposes, we may disclose your health information to your payment source, including an insurance or managed care company, Medicare, Medicaid or another third-party payor. For example, we may need to give your health plan information about the treatment you received so your health plan will pay us or reimburse us for the treatment, or we may contact your health plan to confirm your coverage or to request prior authorization for a proposed treatment.
C. For Health Care Operations— We may use and disclose your PHI for our day-to-day health care operations. This is necessary to ensure that you receive quality care. For example, we may use PHI for quality assessment and improvement activities and for developing and evaluating clinical protocols. We may also combine PHI about many residents to help determine what additional services we should offer, what services should be discontinued, and whether certain new treatments are effective. PHI about you may be used for business development and planning, cost management © 2019 Compliance Consulting Group, LLC CCG 00402a 2623 Hooper Avenue, Brick, New Jersey 087231 analyses, insurance claims management, risk management activities, and in developing and testing information systems and programs. We may also use and disclose information for professional review, performance evaluation, and for training programs. Other aspects of health care operations that may require use and disclosure of your PHI include accreditation, certification, licensing and credentialing activities, review and auditing, including compliance reviews, medical reviews, legal services, and compliance programs. Your PHI may be used and disclosed for the business management and general activities of our Company including resolution of internal grievances, customer service, and due diligence in connection with a sale or transfer of our Company. In limited circumstances, we may disclose your PHI to another health care provider subject to HIPAA for its own health care operations. We may remove information that identifies you so that the PHI may be used to study health care and health care delivery without learning your identity.
D. Business Associates—There may be some services provided by our business associates, such as a billing service, transcription company or legal or accounting consultants. We may disclose your PHI to our business associate so that they can perform the job we have asked them to do. To protect your health information, we require our business associates to enter into a written contract that requires them to appropriately safeguard your information.
E. Providers—Many services provided to you, as part of your care at the Facility are offered by participants in one of our organized health care arrangements. These participants may include a variety of providers such as physicians, therapists, psychologists, social workers, and suppliers. We may use and disclose PHI to contact you as a reminder that you have an appointment at a provider.
F. As Required by Law—We will disclose PHI about you when required to do so by federal, state, or local law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, if required by law, of any such uses or disclosures.
G. Public Health Activities—We may disclose your PHI to prevent a serious threat to your health and safety or the health and safety of the public or another person to a public health authority that is authorized by law to collect or receive such information, such as for the purpose of preventing or controlling disease, injury or disability; reporting births, deaths or other vital statistics; reporting child abuse or neglect; notifying individuals of recalls of products they may be using; notifying a person who may have been exposed to a disease or may be at risk of contracting or spreading a disease or condition.
H.Risk of Contracting a Communicable Disease—We may use or disclose PHI about you if you may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, so long as we are authorized by law to notify you as necessary in the conduct of a public health intervention or investigation.
I. To Avert a Serious Threat to Health or Safety—We may use and disclose your PHI when necessary to prevent a serious threat to your health or safety or the health or safety of the public or another person. Any disclosure, however, would be to someone able to help prevent the threat.
J. Coroners, Medical Examiners, Funeral Directors— We may disclose PHI to a coroner or medical examiner for identification purposes, determining the cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose medical information to funeral directors as necessary to carry out their duties, as authorized by law.
K. Organ and Tissue Donation— If you are an organ donor, we may disclose PHI to organizations that handle organ procurement to facilitate donation and transplantation.
L. Military and National Security—If required by law, if you are a member of the armed forces, we may (1) use and disclose your © 2019 Compliance Consulting Group, LLC 2623 Hooper Ave Brick, NJ 08723 PHI as required by military command authorities or the Department of Veterans Affairs;
(2) disclose your PHI to authorized federal officials for the conduct of lawful intelligence, counterintelligence, and other national security activities authorized by law
(3) disclose your PHI to authorized federal officials so they may provide protection to the President, other authorized persons, or foreign heads of state or conduct special investigations;
(4) use and disclose your PHI for the purpose of a determination by the Department of Veterans Affairs, and/or to foreign military authorities if you are a member of that foreign military service, of your eligibility for benefits.
M. Research Purposes—Your PHI may be used or disclosed for research purposes, but only if the use and disclosure of your information have been reviewed and approved by a special Privacy Board or Institutional Review Board, or if you provide authorization.
N. Workers’ Compensation—We may use or disclose your PHI as permitted by laws relating to workers’ compensation or related programs.
O. Health Oversight Activities— We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, accreditation, licensure, and disciplinary actions.
P. Reporting Abuse, Neglect, or Domestic Violence—We may disclose your PHI to an appropriate government agency if we believe you may have been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
Q. Criminal Activity—We may disclose your PHI if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to health or safety of you, another person or the public. We may also disclose PHI if it is necessary for law enforcement officials to identify or apprehend an individual.
R. Legal Proceedings—If you are involved in a lawsuit or a dispute, we may disclose PHI about you in response to a court or administrative order. We may also CCG 00402a2 disclose PHI about you in response to a subpoena, discovery request, or another lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
S. Law Enforcement—We may disclose PHI when requested by a law enforcement official:
T. In response to a court order, subpoena, warrant, summons or similar process, or otherwise as required by law;
a. To identify or locate a suspect, fugitive, material witness, or missing person;
b. To report gunshot wounds; c. To report emergencies or suspicious deaths;
d. About you, the victim of a crime if, under certain limited circumstances, we are unable to obtain your agreement;
e. About a death we believe may be the result of criminal conduct;
f. About criminal conduct at our Company;
g. In emergency circumstances to report a crime; the location of the crime or victims; and/or the identity, description or location of the person who committed the crime; and
h. Where there is a medical emergency (not on our Company’s premises) and it is likely that a crime has occurred.
U.National Security and Intelligence Activities—We may disclose PHI about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
V. Food and Drug Administration—We may disclose PHI to a person or company required by the Food and Drug Administration (“FDA”) for the purpose of quality, safety or effectiveness of FDA-regulated products or activities including, without limitation, to report adverse events, product defects or problems, or biologic product deviations; to track products; to enable product recalls; to make repairs or replacement; or to conduct post marketing surveillance, as required.
VI. USES AND DISCLOSURES THAT REQUIRE PROVIDING YOU THE OPPORTUNITY TO AGREE OR OBJECT
A. Treatment Alternatives and Other Health-Related Benefits and Services—We may use and disclose PHI to tell you about or recommend possible treatment options or alternatives and to tell you about health-related benefits, services, or medical education classes that may be of interest to you.
B. Fundraising Activities—We may use information about you to contact you in an effort to raise money for the Facility and its operations. For the same purpose, we may share your information with our institutionally related foundation. The information we use or share will be limited to your name, address, other contact information, age, gender, date of birth, dates that you received health care, department of service information, treating physician, outcome information, and health insurance status. You have the right to opt out of receiving such communications. A description of how to opt out of any fundraising communications will be included in any fundraising materials or communications that you receive. If you request that your information not be used or disclosed for fundraising purposes, we will make sure that you do not receive future fundraising communications. We may provide with you a method to opt back in to receive such communications.
C. Facility Directory—Except for individuals admitted to a hospital for psychiatric disabilities or to a substance abuse treatment program, unless you object, we may include limited information about you in our facility directory while you are a resident at the facility, including your name, location in the facility, your general condition (e.g. fair, stable, etc.) and your religious affiliation. The directory information, except for your religious affiliation, may be released to people who ask for you by name. Your information and religious affiliation may also be given to a member of the clergy, even if the clergy member does not ask for you by name.
D. Individuals Involved in Your Care or Payment of Your Care— Unless you object, we may disclose your PHI to a family member, a relative, a close friend or any other person you identify, if the information relates to the person’s involvement in your health care to notify the person of your location or general condition or payment related to your health care. In addition, we may disclose your PHI to a public or private entity authorized by law to assist in a disaster relief effort. If you are unable to agree or object to such a disclosure, we may disclose such information if we determine that it is in your best interest based on our professional judgment or if we reasonably infer that you would not object.
VII. USES AND DISCLOSURES OF PHI BASED UPON YOUR WRITTEN AUTHORIZATION
A. All other uses and disclosures of PHI not covered by this Notice or the laws that apply to us will be made only with your written authorization unless otherwise permitted or required by law. You may revoke your written authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your PHI for the reasons covered by your written authorization. Please understand that we are unable to take back any disclosures we have already made with your authorization.
B. Uses and Disclosures of psychotherapy notes— Psychotherapy notes are notes (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session. Psychotherapy notes exclude medication prescription and monitoring, counseling session starts and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and a summary of the following: diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date. Psychotherapy notes will not be used or disclosed without valid, written authorization, except in the following circumstances:
a. To carry out the following Treatment, Payment, or Health Care Operations:
© 2019 Compliance Consulting Group, LLC CCG 00402a 2623 Hooper Ave Brick, NJ 087233
b. Use by the originator of the psychotherapy notes for treatment;
c. Use or disclosure by the Facility for its own training programs in which students, trainees, or practitioners in mental health learn, under supervision, to practice or improve their skills in group, joint, family, or individual counseling; or
d. Use or disclosure by the Facility to defend itself in a legal action or other proceeding brought by the patient; and
e. Use or disclosure that is required by or permitted by the applicable regulations with respect to the oversight of the originator of the psychotherapy notes.
C. Use and Disclosure of Substance Abuse and HIV-Related Information—For disclosures concerning PHI relating to care for substance abuse or HIV-related testing and treatment, special restrictions apply. For example, we generally may not disclose this specially protected information in response to a subpoena, warrant, or another legal process unless you sign a special authorization, or a court orders the disclosure.
a. Substance abuse treatment information. If you are treated in a specialized substance abuse program, the confidentiality of alcohol and drug abuse patient records is protected by federal and state laws and regulations. Generally, we may not say to a person outside the program that you attend the program or disclose any information identifying you as an alcohol or drug abuser, unless:
b. You consent in writing;
i. The disclosure is allowed by a court order; or
ii. The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit or program evaluation.
iii. Marketing—A signed authorization is required for the use or disclosure of your PHI for a purpose that encourages you to purchase or use a product or services except for certain limited circumstances, such as when the marketing communication is face-to-face or when marketing includes the distribution of a promotional gift of nominal value provided by the Facility. An authorization is not required to describe a health-related product or service provided by use; to make communications to you regarding your treatment; or to direct or recommend alternative treatments, therapies, providers, or settings of care for you.
D. Disclosures that Constitute Salem of PHI—A signed authorization is required for the use or disclosure of your PHI in the event that the Facility directly or indirectly receives remuneration for such use or disclosure, except under certain circumstances as allowed by federal or state law. For example, authorization is not needed if the purpose of the use or disclosure is for your treatment, public health activities, or providing you with a copy of your PHI.
VIII. WHEN WE MAY NOT USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION
A. Except as described in this Notice, or as permitted by state or federal law, we will not use or disclose your PHI without your written authorization.
B. Your written authorization will specify particular uses or disclosures that you choose to allow. Under certain limited circumstances, the Facility may condition treatment on the provision of an authorization, such as for research related to treatment. If you do authorize us to use or disclose your PHI for reasons other than treatment, payment, or health care operations, you may revoke your authorization in writing at any time by contacting the Facility’s Compliance Officer. If you revoke your authorization, we will no longer use or disclose your PHI for the purposes covered by the authorization, except where we have already relied on the authorization.
IX. YOUR HEALTH INFORMATION RIGHTS REGARDING YOUR PHI
A. You have the following rights with respect to your PHI. The following briefly describes how you may exercise these rights.
B. Right to Request Restrictions of Your PHI— You have the right to request a © 2019 Compliance Consulting Group, LLC 2623 Hooper Ave Brick, NJ 08723 restriction or limitation on the PHI we use or disclose about you, including information used or disclosed for the purposes of treatment, payment, or health care operations. You may also request that your PHI not be disclosed to family members or friends who may be involved in your care.
C. You may request a restriction on the use or disclosure of your PHI by submitting a written request to the Facility stating (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply.
D. We are not required to agree to your requested restriction unless it involves the disclosure of PHI to a health plan for purposes of carrying out payment or health care operations that pertain solely to a health care item or service for which the Facility has been paid out of pocket in full by you or a third party (other than the health plan) on your behalf.
E. If we do agree to accept your requested restriction, we will comply with your request except as needed to provide you with emergency treatment. If restricted PHI is disclosed to a health care provider for emergency treatment, we will request that such health care provider not further use or disclose the information. In addition, you and the Facility may terminate the restriction if the other party is notified in writing of the termination.
X. RIGHT TO RECEIVE CONFIDENTIALLY COMMUNICATIONS AND/OR ALTERNATE COMMUNICATIONS— You have the right to request a Reasonable accommodation regarding how you receive communications of PHI. You have the right to request an alternative means of communication or an alternative location where you would like to receive communications. For example, you may ask that we only contact you via mail to a post office box. We will not request an explanation from you as to the basis for the request. You must submit your request in writing to CCG 00402a 4 our office. We will not ask you the reason for your request. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests.
XI. RIGHT TO ACCESS, INSPECT, AND COPY YOUR PHI—You have the right to access, inspect, and obtain a copy of your PHI that is used to make decisions about your care for as long as the PHI is maintained by the Facility. You may not be permitted to inspect or copy the following: psychotherapy notes, or information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding. If we maintain your information electronically in a designated record set, then you have the right to request an electronic copy of such information. To access, inspect, and copy your PHI that may be used to make decisions about you, you must submit your request in writing to the Facility. If you request a copy of the information, we may charge a fee for the costs of preparing, copying, mailing, or other supplies associated with your request. We may deny, in whole or in part, your request to access, inspect, and copy your PHI under certain limited circumstances. If we deny your request, we will provide you with a written explanation of the reason for the denial. You may have the right to have this denial reviewed by an independent health care professional designated by us to act as a reviewing official. This individual will not have participated in the original decision to deny your request. You may also have the right to request a review of our denial of access through a court of law. All requirements, court costs, and attorneys’ fees associated with a review of the denial by a court are your responsibility. You should seek legal advice if you are interested in pursuing such rights.
XII. RIGHT TO AMEND YOUR PHI—You have the right to request an amendment to your PHI for as long as the information is maintained by or for the Facility. Your request must be made in writing to the Facility and must state the reason for the requested amendment. We may deny your request for an amendment if the request is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that: (1) was not created by us, unless the person or entity that created the information is no longer available to make the amendment; (2) is not part of the PHI kept by or for the Facility; or (3) is accurate and complete.
A. If we deny your request for amendment, we will give you a written denial including the reasons for the denial and the right to submit a written statement disagreeing with the denial. We may rebut your statement of disagreement. If you do not wish to submit a written statement disagreeing with the denial, you may request that your request for amendment and your denial be disclosed with any future disclosure of your relevant information.
XIII. RIGHT TO RECEIVE AN ACCOUNTING OF DISCLOSURES OF PHI—You have the right to receive an accounting of certain disclosures of your PHI by the Facility or by others on our behalf. To request an accounting of disclosures, you must submit a request in writing, stating a time period that is within six (6) years from the date of your request. The first accounting provided within a twelve-month period will be free. We may charge you a reasonable, cost-based fee for each future request for an accounting within a single twelve- month period. However, you will be given the opportunity to withdraw or modify your request for an accounting of disclosures in order to avoid or reduce the fee. In the event, the Facility maintains an electronic health record, an accounting of disclosures from the electronic health record related to treatment, payment or health care operations will be made only for the three (3)-year period preceding the request.
XIV. RIGHT TO BE NOTIFIED FOLLOWING A BREACH OF UNSECURED PHI—If there is a breach to your PHI, you will be notified within a reasonable amount of time, as required by law.
XV. RIGHT TO A REVISED COPY OF THIS NOTICE—You have the right to receive a copy of this Notice upon request when it is revised on or after the effective date of its revision. Additionally, the revised Notice will be posted in a clear and prominent location.
XVI. RIGHT TO OBTAIN A PAPER COPY OF NOTICE—You have the right to obtain a paper copy of this Notice, even if you have agreed to receive this Notice electronically. You may request a copy of this Notice at any time by contacting CLENT. In addition, you have the right to receive a copy of this Notice when the Facility seeks additional consent.
XVII. RIGHT TO COMPLAIN—You may file a complaint with us or the Secretary of Health and Human Services if you believe your privacy rights have been violated by us. You may also file a complaint with us by notifying our Compliance Officer in writing of your complaint. You will not be penalized or retaliated against for filing a complaint and we will make every reasonable effort to resolve your complaint with you.
© 2019 Compliance Consulting Group, LLC CCG 00402a 2623 Hooper Ave Brick, NJ 087235
ACKNOWLEDGEMENT OF RECEIPT OF NOTICE OF PRIVACY PRACTICE
Resident Name: ____________________________________________________________
I have been given a copy of the Facility’s Notice of Privacy Practices (“Notice”), which describes how my PHI is used and shared. I understand that the Facility has the right to change this Notice at any time. I may obtain a current copy by contacting the Facility, or by visiting their website, if any.
My signature below acknowledges that I have been provided with a copy of the Notice of
Signature of Resident or Personal Representative
Personal Representative’s Title (e.g., Guardian, Executor of Estate, Health Care Power of Attorney)
For Facility Use Only: Complete this section if you are unable to obtain a signature.
1.If the Resident or personal representative is unable or unwilling to sign this Acknowledgement, or the Acknowledgement is not signed for any other reason, state
Describe the steps taken to obtain the resident’s or personal representative’s signature on the Acknowledgement:
File original in resident’s Business Office Record
© 2019 Compliance Consulting Group, LLC CCG 00402a 2623 Hooper Ave Brick, NJ 087236