Information About our Notice of Privacy Practices
At One Sky Community Services, the confidentiality of your personal information is a priority. As of April 14, 2003 the Privacy Standards of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) are effective. These standards tell us how we must handle “Protected Health Information” (PHI) when we provide health care treatment, seek payment and engage in activities we need to do to conduct business, such as quality assurance. According to the standards, our services are considered to be health care treatment. The standards also outline your rights with regard to your PHI. We follow whichever is stricter of federal and state guidelines.
According to HIPAA, we may use your information to tell you about benefits and services, to communicate with other care providers, family or friends involved in your care, and to communicate with associates who carry out treatment, payment, or health care operations on our behalf. These associates must follow our strict privacy rules. We may also contact you for fundraising, but you can tell us not to. There are other limited times when we are permitted or required to disclose your PHI without your signed permission. These situations include public health activities, if required by law. All uses and disclosures other than those de-scribed above may be done only with your signed authorization, which may be revoked at any time.
You have the right to request that we restrict how we use your information. We may not be able to comply with all requests. You also have the right to tell us how you want us to contact you, to see and copy your information and to request additions or corrections, and to receive an accounting of how we disclosed your information, except for disclosures for treatment, payment, and operations which do not require such an accounting.
We are required to provide you with a written notice about your rights under HIPAA and about how we will use and disclose your PHI. That Notice is enclosed. Also enclosed, on yellow paper, is an acknowledgement that you have received this notice. Please sign, date and return this to us in the enclosed self-addressed stamped envelope.
Rest assured, we will continue to practice confidentiality in areas that HIPAA does not cover, for example seeking your written approval before using your name or picture in a publication. If you would like more information about the Notice or about HIPAA you may talk with your contact at One Sky, such as your Intake Coordinator, Family Support Coordinator, Service Co-ordinator, Community Coordinator or with our HIPAA Contact Person, Tina Holmes, or our HIPAA Privacy Officer, Cathy King. Information is also available at http://www.csni.org which contains links to other sites such as the Office of Civil Rights which administers the HIPAA rule.
This Notice describes how health information about you may be used and how you can get access to it. Please review carefully.
I. Introduction. This Notice of Privacy Practices describes how we may use and disclose your protected health information to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. It also de-scribes your rights to access and control your protected health information. “Protected health information” is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services.
II. Your Health Information Rights. While the actual records that we maintain about you belong to us, the information con-tained in our records belongs to you. Under the federal Privacy Rules (42 CFR Part 160 and Part 164) you have the right to:
- obtain a paper copy of this Notice of Privacy Practices upon request
- nspect and obtain a copy of your health record
- amend your health record
- obtain an accounting of certain disclosures of your health information
- receive confidential communications of your health information by alternative means or at alternative locations
- revoke your authorization to use or disclose health information except to the extent that action has already been taken
- request a restriction on certain uses and disclosures of your information as provided by 45 CFR 164.522. Note, however, that we are not required to agree to a restriction that you may request. If we believe it is in your best interest to permit use and disclosure of your health information, we will notify you that your request for restriction will not be honored. If we agree to the requested restriction, we may not use or disclose your health information in violation of that restriction unless it is needed to provide emergency treatment.
III. Our Responsibilities. This organization is required to:
- maintain the privacy of your health information
- provide you with a notice as to our legal duties and privacy practices with respect to information we collect and maintain about you
- abide by the terms of this notice
- notify you if we are unable to agree to a requested restriction
- accommodate reasonable requests you may have to communicate health information by alternative means or at alternative locations.
We reserve the right to change our practices and to make the new provisions effective for all protected health information we maintain. Should our information practices change, we will post a revised Notice in a prominent place in our office and on our website.
We will not use or disclose your health information without your authorization, except as described in this notice.
IV. Examples of How We Will Use or Disclose Your Protected Health Information. Your protected health information may be used and disclosed by members of our staff and others outside of our office that are involved in your care and treatment for the purpose of providing services to you. Your protected health information may also be used and disclosed to enable us to be paid for the services we render to you.
Following are examples of the types of uses and disclosures of your protected health care information that we are permitted to make. These examples are not meant to be exhaustive, but to describe the types of uses and disclosures that may be made by our office.
Treatment: We will use and disclose your protected health information to provide, coordinate, or manage your care, including your health care and any related services. This includes the coordination or management of your health care with a third party that has already obtained your permission to have access to your protected health information. For example, we would disclose your protected health information, as necessary, to service providers such as providers of early supports and serv-ices, or residential/day services, or physicians who may be treating you. Also, for example, we may use or disclose your pro-tected health information, as necessary, to facilitate appointment or change of a guardian or other legal representative.
Payment: Your protected health information will be used, as needed, to obtain payment for services that we provide to you. This may include certain activities that your health plan may undertake before it approves or pays for the services we recommend for you. For example, some health plans must make a determination that you are eligible for reimbursement for particular services before we can provide them to you and we must provide them with protected health information to enable them to made such a determination.
Healthcare Operations: We may use or disclose, as needed, your protected health information in order to support our own business activities. These activities include, but are not limited to, quality assessment activities, training and supervision of staff members, licensing, certification and conducting or arranging for other business activities. We may also disclose your protected health information to the NH Department of Health and Human Services or other agencies of the State of New Hampshire to comply with our contract with the State of New Hampshire and, if applicable, to determine your eligibility for publicly funded services.
We will share your protected health information with third party “business associates” that perform various activities that are essential to the operations of our organization. Whenever we have an arrangement between our organization and a business associate, we will limit the amount of protected health information that we provide to the minimum necessary to accomplish the particular task and we will have a written contract that contains terms that will protect the privacy of your protected health in-formation.
We may use or disclose your protected health information, as necessary, to provide you with appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you.
We may also use your health information to contact you in connection with limited marketing or fundraising communications for our agency that are permitted under the federal privacy rules. Any fundraising communication addressed to you will contain instructions describing how you may opt out of receiving such communications in the future.
V. Uses and Disclosures That We May Make Unless You Object. In the following situations, we may disclose your protected health information if you do not object.
Notification. We may use or disclose information to notify or assist in notifying a family member or friend of your location and general condition.
Communications. Staff members may disclose to a family member, other relative, or close personal friend, health in-formation relevant to that person’s involvement in your care or payment related to your care.
If you are present for, or otherwise available prior to, a notification or communication with family or another caregiver, and you have the capacity to make health care decisions, we may make the disclosure if you agree; or if we provide you with the opportunity to object and you do not object; or we reasonably infer from the circumstances that you do not object. If you are not present for the notification or disclosure, or the opportunity to agree or object cannot be provided because of your incapacity or an emergency circumstance, we may determine whether the disclosure is in your best interest and, if so, we may disclose to the designated person only that information that is directly relevant to the person’s involvement with your health care.
VI. Uses and Disclosures Not Requiring Your Authorization. The federal privacy rules provide that we may use or disclose your protected health information without your authorization in the following circumstances:
Food and Drug Administration (FDA): We may disclose to the FDA health information relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.
Workers compensation: We may disclose health information to the extent authorized by and to the extent necessary to comply with laws relating to workers compensation or other similar programs established by law.
Public health: As required by law, we may disclose your health information to public health or legal authorities charged with preventing or controlling disease, injury, or disability.
Correctional institution: Should you be an inmate of a correctional institution or a resident of another form of court-ordered placement (for example, if you are involuntarily committed to the developmentally disabled system), we may disclose to the institution or agents thereof health information necessary for your health and the health and safety of other individuals.
Law enforcement: We may disclose health information for law enforcement purposes as required by law or in response to a valid search warrant or court order.
Criminal Activity: We may disclose your protected health information if we believe that it constitutes evidence of criminal conduct that occurred on our premises. We may also disclose your protected health information if we are required by applicable state law to report suspected child abuse or neglect or abuse of incapacitated adults or an injury that we believe may have been the result of an illegal act. We may also disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual.
Legal Proceedings: We may disclose protected health information in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), and, in certain situations, in response to a subpoena, discovery request or other lawful process.
Relating to Decedents: We may disclose protected health information regarding an individual’s death to coroners, medical examiners or funeral directors consistent with applicable law.
As Required By Law: We may use or disclose your protected health information to the extent that the use or disclosure is required by state or federal law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. For example, we must make disclosures when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of the federal Privacy Rules.
VII. Uses and Disclosures of Protected Health Information Based upon Your Written Authorization
Other uses and disclosures of your protected health information will be made only with your written authorization, unless other-wise permitted or required by law as described in this Notice. You may revoke this authorization, at any time, in writing, except to the extent that we have already relied upon your authorization in making a disclosure.
VIII. For More Information or to Report Complaints
If you wish to exercise any of the rights listed in Section II of this Notice, or if you have questions and would like additional information you may contact our Contact Person, Tina Holmes, or our Privacy Officer, Cathy King, either in writing or by phone at (603) 436-6111.
If you believe that your privacy rights have been violated, you may file a complaint with our HIPAA Complaint Officer or our Privacy Officer or with the Secretary of the United States Department of Health and Human Services. We will not retaliate against you for filing a complaint.
This notice was published on April 11, 2003 and becomes effective on April 14, 2003.
Approved by CSNI HIPAA Task Group January 23, 2003