November

HIPAA

Policy Title: HIPAA

Policy Number: 010

Date first Implemented: 29 September 2023

Date of Latest Revision: 17 October 2024

Standards and Compliance Reference: 9 CSR 45-5.010(3) ©2.K.

Attachments/Reference Document: 9 CSR 45-5.010(3) ©2.K. Confidentiality Policy

Purpose of Policy:

This policy serves to explain the rules around the privacy of medical/health records and our legal duties regarding how to protect the privacy of medical/health records that we create or receive. Generally, we are required by law to ensure that medical/health information that identifies an individual is kept private. We are required by law to follow the Health Insurance Portability & Accountability Act (HIPAA).

Scope of Policy:

This policy applies to all employees of Pulaski County Group Home as well as to visitors, contractors and temporary staff.

Policy Statement:

This Policy will explain:

• How we may use and disclose medical/health information;

• Our obligations related to the use and disclosure of medical/health information; and

• Consumer rights related to any medical/health information that we have about them.

This policy applies to the medical/health records that are generated in or by PCGH. The terms “medical” and “medical/health” in this policy mean information about consumer physical or mental conditions which make them eligible for our services, or which arise while we are serving them. For example, this may include psychological tests, psychiatric assessments, or medical or social assessments.

We may, but we are not required to, obtain consent for the use or disclosure of protected health information for treatment, payment or health care operations. We are required to obtain authorization for the use or disclosure of information for other specific purposes or reasons. We have listed some of the types of uses or disclosures later in this policy.

If a consumer or guardian has any questions about the content of this policy, or if they need to contact someone at PCGH about any of the information contained within, they are encouraged to call the Executive Director or Assistant Director at 573-736-5603.

In addition to PCGH departments, employees, staff and other facility personnel, the following people will also follow the practices described in this policy:

• Any health care professional who is authorized to enter information in medical/health records;

•Any member of a volunteer group allowed to help PCGH consumers; and

•All providers that the Department of Mental Health (DMH) contracts with to provide direct treatment services to our consumers.

In addition, individuals and providers may share medical information with each other about consumers they serve in common for the purpose of treatment, payment or health care operations, as those terms are described later in this policy.

Procedure(s):

HOW WE MAY USE AND DISCLOSE MEDICAL INFORMATION

The following categories describe different ways that we use and disclose medical/health information. For each category of uses or disclosures we will explain what we mean and provide some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

Use and Disclosure of Medical Information

We can use or disclose medical/health information regarding treatment, payment for services or for facility operations and we will make a good faith effort to have consumers and guardians acknowledge receipt of a copy of HIPAA.

Treatment:

We may use medical/health information (protected health information, or PHI) to provide treatment or services. We may disclose medical/health information to qualified mental health professionals; qualified developmental disabilities professionals (QDDP); to qualified counselors; to technicians, medical students or residents, or other facility personnel, volunteers or interns who are involved in providing services for PCGH consumers; or to interpreters needed in order to make treatment accessible. For example, treatment team members will internally discuss medical/health information in order to develop and carry out a plan for services. Different departments of the facility may also share medical/health information in order to coordinate the different things needed, such as prescriptions, medical tests, special dietary needs, respite care, personal assistance, day programs, etc. We also may disclose medical/health information to people outside the facility who may be involved in consumers’ medical care after they leave the facility, such as community health/mental health/developmental disability/substance abuse providers or others who provide care services, but only the minimum necessary amount of information will be used or disclosed to carry this out. Please note that the definition of treatment does allow PCGH to share PHI when necessary to consult with other providers, or when necessary to make referrals to another provider.

Payment:

We may use and disclose medical/health information so that the treatments and services received may be billed to and payment may be collected from consumers, guardians, an insurance company or a third party. For example, we may need to provide insurance plan information about psychiatric treatment or habilitation services received so the insurance plan, or any applicable Medicaid or Medicare funds, will pay for the services. We may also tell insurance plans or other payors about an anticipated treatment or service in order to obtain prior approval or to determine whether the service is covered.

Health Care Operations:

We may use and disclose medical/health information for PCGH operations. These uses and disclosures are necessary to run the agency and make sure that all of our consumers receive quality care. For example, we may use medical/health information for quality improvement to review our treatment and services and to evaluate the performance of our staff. We may also combine medical/health information about many consumers to decide what additional services the agency should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to doctors, nurses, technicians, medical students and residents, and other facility personnel as listed above for review and learning purposes. We may also combine the medical/health information we have with medical/health information from other facilities to compare how we are doing and see where we can make improvements in the care and services we offer. It may also be necessary to obtain or exchange your information with the Department of Elementary and Secondary Education, the Department of Social Services, Vocational Rehabilitation, the Office of State Courts Administrator, or other Missouri state agencies or interagency initiatives, such as the Juvenile Information Governance Commission, or System of Care initiative. Or, we may remove identifiable information from this set of medical information so others may use it to study health care and health care delivery without learning the identity of specific consumers. This may be in the form of providing information to our regional advisory councils or state advisory councils or planning councils.

Other Uses and Disclosures of Medical/Health Information That Do Not Require Consent or Authorization:

We can use or disclose medical/health information without consent or authorization when: (1) there is an emergency or when we are required by law to provide treatment; (2) we are required by law to use or disclose certain information; or (3) there are substantial communication barriers to obtaining consent.

We can also use or disclose medical/health information without consent or authorization for the following purposes:

1. Appointment Reminders: We may use and disclose medical/health information to confirm and receive appointment reminders.

2. Treatment Alternatives and Health-Related Benefits and Services: We may use and disclose medical information to recommend possible treatment options or alternatives or health-related benefits or services that may be of interest to you.

3. Individuals Involved in Disaster Relief: Should a disaster occur, we may disclose medical information to any agency assisting in a disaster relief effort so that families can be notified about consumers’ condition, status and location.

4. Research: Under certain circumstances, medical/health information may be disclosed for research purposes when a waiver of authorization has been approved by an Institutional Review Board or Privacy Committee. For example, a research project may involve comparing the health and recovery of all consumers who received one medication to those who received another for the same condition. All research projects, however, are subject to a special approval process under Missouri law. This process evaluates a proposed research project and its use of medical information, trying to balance the research needs with consumers' need for privacy of their medical/health information. Before we use or disclose medical/health information for research, the project will have been approved through this research approval process. We may, however, disclose medical/health information to people preparing to conduct a research project, for example, to help them look for consumers with specific medical needs, so long as the medical information they review does not leave the facility. We may also use or disclose health information without consent when disclosing information related to a research project when a waiver of authorization has been approved by the Professional Review Committee or a university sponsored Institutional Review Board.

5. As Required By Law: We will disclose medical/health information when required to do so by federal, state or local law.

6. To Avert a Serious Threat to Health or Safety: We may use and disclose medical/health information when necessary to prevent a serious threat to the health and safety of consumers, the public, or any other person. However, any such disclosure would only be to someone able to help prevent the threat.

SPECIAL SITUATIONS

1. Organ and Tissue Donation: If a consumer is an organ donor, we may release medical/health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

2. Military and Veterans: If a consumer is a member of the armed forces, we may release medical/health information as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority.

3. Workers' Compensation: When disclosure is necessary to comply with Workers’ Compensation laws or purposes, we may release medical/health information for workers' compensation or similar programs. These programs provide benefits for work- related injuries or illness.

4. Public Health Risks: We may disclose medical/health information for public health activities. These activities generally include the following: to prevent or control disease, injury or disability; to report births and deaths; to report child abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; to notify the appropriate government authority if we believe a consumer has been the victim of abuse, neglect or domestic violence. We will only make this disclosure with consent or when required or authorized by law.

5. Health Oversight Activities: We may disclose medical/health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws. Lawsuits and Disputes: If a consumer is involved in a lawsuit or a dispute, we may disclose medical/health information in response to a court or administrative order.

6. Law Enforcement: We may release medical/health information if asked to do so by a law enforcement official; however, if the material is protected by 42 CFR Part 2 (a federal law protecting the confidentiality of drug and alcohol abuse treatment records), a court order is required. We may also release limited medical/health information to law enforcement in the following situations: (1) about a consumer who may be a victim of a crime if, under certain limited circumstances, we are unable to obtain the consumer’s agreement; (2) about a death we believe may be the result of criminal conduct; (3) about criminal conduct at an agency location; (4) about a consumer where a consumer commits or threatens to commit a crime on the premises or against program staff (in which case we may release the consumer’s name, address, and last known whereabouts); (5) in emergency circumstances, to report a crime, the location of the crime or victims, and the identity, description and/or location of the person who committed the crime; and (6) when the consumer is a forensic client and we are required to share with law enforcement by Missouri statute.

7. Coroners, Medical Examiners and Funeral Directors: We may release medical/health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release medical/health information about consumers to funeral directors as necessary to carry out their duties.

8. National Security and Intelligence Activities: We may release medical information about to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

9. Protective Services for the President and Others: We may disclose medical information to authorized federal officials so they may conduct special investigations or provide protection to the President and other authorized persons or foreign heads of state.

10. Inmates: If a consumer is an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical/health information to the correctional institution or law enforcement official if the release is necessary (1) for the institution to provide health care; (2) to protect the health and safety of consumers or of others; or (3) for the safety and security of the correctional institution.

11. Emergency or Disaster Events: In the interest of public safety and planning for community needs in an emergency or disaster event, we may disclose general information to emergency managers, fire, law enforcement, public health authorities, emergency medical services such as ambulance districts, utilities and other public works officials regarding:

a. The numbers and locations of PCGH clients

b. Any special needs identified for purposes of rescue such as sensory, cognitive and mobility impairments.

c. Special assistance and supports needed to effectively meet needs such as communication devices, specialized equipment for evacuation, etc;

d. Necessary information to order necessary treatment or prophylaxis supplies and medications in the event of a public health emergency.

e. Emergency notification contacts to expedite contact with families, legal guardians or representatives or others regarding need for evacuation or emergency medical care;

f. Any special needs that justify prioritization of utility restoration such as but not limited to dependence on respirator or other medical equipment, phone for emergency contact, etc.; or

g. Any other information that is deemed necessary to protect the health, safety and well-being of PCGH consumers.

CONSUMER RIGHTS REGARDING MEDICAL/HEALTH INFORMATION

Consumers have the following rights regarding medical information we maintain:

Right of Access to Information: Consumers have the right to inspect and copy their medical/health information with the exception of psychotherapy notes and information compiled in anticipation of litigation. To inspect and copy medical/health information, consumers or their legal guardian must submit their request in writing to the Executive Director. If a copy of the information is requested, we may charge a fee for the costs of copying, mailing or other supplies associated with the request. We may deny requests to inspect and copy in certain limited circumstances. If a consumer is denied access to medical/health information because of a threat or harm issue, they may request that the denial be reviewed by PCGH Board of Directors. We will comply with the outcome of the review. Consumers may request electronic copies of medical/health information or request electronic copies be forwarded to a third party.

Right to Request an Amendment: If medical/health information we have about a consumer is believed to be incorrect or incomplete, they may ask us to amend the information. They have the right to request an amendment for as long as the information is kept by or for PCGH. Requests for an amendment must be made in writing and submitted to the Executive Director. A reason must be provided to support the request for an amendment. We may deny a request if it is not in writing or if it does not include a reason supporting the request. In addition, we may deny a request if we are asked to amend information that:

• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;

• Is not part of the medical information kept by or for PCGH;

• Is not part of the information which a consumer or their legal guardian would be permitted to inspect and copy; or

• Is accurate and complete.

Right to Request Restrictions: Consumers have the right to request a restriction or limitation on the medical/health information we use or disclose about them for treatment, payment or health care operations. For example, one could ask that we not use or disclose information about their family history to a particular community provider. We are not required to agree to the request. If we do agree, we will comply with the request unless the information is needed to provide emergency treatment. To request a restriction on the use or disclosure of medical/health information for treatment, payment or health care operations, consumers or their legal guardian must make a request in writing to the Executive Director. In that request, they must tell us (1) what information they want to limit; (2) whether they want to limit our use, disclosure or both; and (3) to whom they want the limits to apply (for example, disclosures to a spouse). Consumers have the right to request a restriction of disclosures for services they have paid for in full. PCGH is not responsible for notifying any other healthcare providers, associated with their care, of this restriction.

Right to Request Confidential Communications: Consumers have the right to request that we communicate with them about medical matters in a certain way or at a certain location. For example, they can ask that we only contact them at work or by mail. To request confidential communications, one must make a request in writing to the Executive Director. The request must specify how or where they wish to be contacted. We will not ask the reason for this request and will accommodate all reasonable requests.

Right to Notification of a Breach of Information: If a consumer’s information is disclosed improperly by PCGH, they will be notified in writing.

If a consumer or their legal guardian wishes to exercise any of these rights, contact the Executive Director.

CHANGES TO THIS NOTICE

We reserve the right to change this policy. We may make the revised policy effective for medical/health information we already have as well as any information we receive in the future. We will post a copy of the current notice in the facility. It will contain on the first page, the effective date.

COMPLAINTS

If a consumer or their legal guardian believes their privacy rights have been violated, they may file a complaint with the facility by contacting the Executive Director. They can submit a complaint in any written format. However, it is recommended that you use the OCR Health Information Privacy Complaint Form, which can be found on Office of Civil Right’s web site. The following information in a written complaint:

■ If you are filing a complaint on someone’s behalf, also provide the name of the person on whose behalf you are filing.

■ Name, full address and phone of the person, agency or organization you believe violated your (or someone else's) health information privacy rights or committed another violation of the Privacy Rule.

■ Briefly describe what happened. How, why, and when you believe your (or someone else’s) health information privacy rights were violated, or the Privacy Rule otherwise was violated.

■ Any other relevant information.

■Please sign your name and date your letter.

The following information is optional:

■ Do you need special accommodations for us to communicate with you about this complaint?

■ If we cannot reach you directly, is there someone else we can contact to help us reach you?

■ Have you filed your complaint somewhere else?

The Privacy Rule, developed under authority of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), prohibits the alleged violating party from taking retaliatory action against anyone for filing a complaint with the Office for Civil Rights. You should notify Rolla Regional Office immediately in the event of any retaliatory action.

OTHER USES OR DISCLOSURES OF MEDICAL/HEALTH INFORMATION.

Uses or disclosures not covered in this policy will not be made without written authorization. If one has provided us written authorization to use or disclose information, they can change their mind and revoke authorizations at any time, as long as it is in writing. If an authorization is revoked, we will no longer use or disclose the information. However, we will not be able to take back any disclosures that we have made pursuant to previous authorization.

Monitoring and Continued Compliance:

Pulaski County Group Home will monitor the effectiveness of this policy on an ongoing basis. Violations, and failure to adhere to the policy will result in disciplinary actions, including but not limited to suspension and termination of employment.

Please watch this video for more information: https://video.search.yahoo.com/yhs/search;_ylt=AwrEr1xl3zFpEQIATO4PxQt.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BpdnM-?hspart=fc&hsimp=yhs-90&type=fc_AC22890F0FA_s69_g_e_d_n1_c999&param1=7&param2=eJwtjstqwzAURH9FywQk%2BV7Jku1o1eDkA0pXFXfhOqoj%2FMQPXPr1xSXMZhjOwGniwzt6LxHAaK09p8E7Qs%2Fp2D2n2jsqisJzipN3pHOJOpMIKJXn1ITRO9oWz2mrvKN%2B%2FI1dVyVGAjvtcXiM%2B8KGlSFIcGyPg00d%2B7HpmVXT1IU9fLVxTYzOpLbs1D7XvuOsi21gTajb8czq5zz2IcFUSTjCluq7muPrclgt8WW6LWH%2B76WBwqIBUaqrEYi3u3jThRIaS2UgT%2FF6ux98fcAKlBGAAtMPBRdlLyqTNjeffzfaUM8%3D&p=group+home+hipaa&fr=yhs-fc-90#id=1&vid=c6ce861f72097e28c562cec2b9fdf3dc&action=view