HIPAA NOTICE OF PRIVACY PRACTICES DOWNLOAD HIPAA NOTICE HERE
Behavioral Compass, LLC
*Please note that our ZOOM meetings are HIPAA compliant. A Business Associate Agreement from ZOOM is on file in our office. If you would like a copy, please email firstname.lastname@example.org. We are happy to answer any questions.
HIPAA – HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT
What is HIPAA?
“HIPAA” stands for the Health Insurance Portability and Accountability Act of 1996. While HIPAA addresses many topics, it also resulted in rules pertaining to the privacy and security of health information. When this document refers to HIPAA, it means those rules. At Behavioral Compass, everyone has a duty to safeguard patient information in any medium. Also, HIPAA gives patients certain rights, which will be discussed below. Finally, HIPAA requires us to maintain a number of policies and procedures related to patient rights and the use of patient information.
What do we have to protect?
We have to protect a certain type of patient information, known as “protected health information” or PHI. How can we use protected health information (PHI)? Patient information can be used or shared only with the written permission of the patient or guardian, except in limited circumstances. Generally, we may use patient information without the permission of parents or legal guardians to treat the patient, bill insurance, or to use in certain internal operations (such as quality assurance), or if we are required to disclose it by law. Otherwise, we likely need to have a parent or legal guardian’s permission or consent known as an Authorization before we can use patient information. There are only three instances when information may be shared. They relate to what is referred to as “TPO.” a. Treatment – providing care to patients b. Payment – getting paid for caring for patients c. Operations – normal business activities such as quality improvement, training, customer services and resolution of grievances.
Under the Federal Health Insurance Portability and Accountability Act (HIPPA), you have the right to request restrictions on how we use or disclose your personal information for treatment, payment, or health care operations. You also have the right to request restrictions on disclosures to family members or others involved in your health care or the paying of your care.
ACCESS TO YOUR PERSONAL HEALTH INFO:
You have the right to inspect and or obtain a copy of your personal health information we maintain in your designated medical records. You must sign a release of medical records consent form to obtain these records.
FAMILY, FRIENDS, AND PERSONAL REPRESENTATIVES:
With your written consent we may disclose to family members, close personal friends, or another person you identify your personal health information relevant to their involvement with your care or paying for your care. If you are unavailable, incapacitated, or involved in an emergency situation, and we determine that a limited disclosure is in your best physical interest, we may disclose your personal health information without your written consent. We may also disclose your personal health information to the public or private entities to assist in disaster relief efforts.
OTHER USES AND DISCLOSURES:
We are permitted or required by law to use or disclose your personal health information, without your authorization, in the following circumstances. · For public health activities (reporting of disease, injury, birth, death, or suspicion of child abuse, neglect or domestic violence) · To government authority if we believe an individual is a victim of abuse, neglect or domestic violence. · For health oversight activities (for example, audits, inspections, licensure actions or civil, administrative or criminal proceedings or actions) · For judicial or administrative proceedings (for example pursuant to a court order, subpoena or discovery request) · For law enforcement purposes (i.e. reporting wounds or injuries or for identifying or locating suspects, witnesses or missing persons) · To avert a serious threat to health or safety under certain circumstances · For military activities if you are a member of the armed forces or an inmate or individual confined to a correctional institution · For compliance with worker’s compensation claims
We will adhere to all state and federal laws or regulations that provide protections to your privacy. We will only disclose AIDS/HIV related info, genetic testing info and info pertaining to your mental condition or any substance abuse problems as permitted by law.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU OR YOUR CHILD MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. WE KEEP A RECORD OF THE HEALTH CARE SERVICES WE PROVIDE YOU. YOU MAY ASK US TO SEE AND COPY THAT RECORD. YOU MAY ALSO ASK US TO CORRECT THAT RECORD. WE WILL NOT DISCLOSE YOUR RECORD TO OTHERS UNLESS YOU DIRECT US TO DO SO OR UNLESS THE LAW AUTHORIZES OR COMPELS US TO DO SO. YOU MAY SEE YOUR RECORD OR GET MORE INFORMATION ABOUT IT BY CONTACTING BEHAVIORAL COMPASS AT THE ADDRESS LISTED IN SECTION IV BELOW.
BEHAVIORAL COMPASS is dedicated to maintaining the privacy of our Clients’ individually identifiable health information (also called protected health information, or PHI). In conducting our business, we will create records regarding the Client and the treatment and services we provide. We are required by law to maintain the confidentiality of health information that identifies Clients. We also are required by law to provide this notice of our legal duties and the privacy practices that we maintain in our practice concerning Client’s PHI. By federal and state law, we must follow the terms of the Notice of Privacy Practices that we have in effect at the time.
We realize that these laws are complicated, but we must provide you with the following important information:
How we may use and disclose a Client’s PHI / Privacy rights in PHI / Our obligations concerning the use and disclosure of PHI
The terms of this notice apply to all records containing a Client’s PHI that are created or retained by BEHAVIORAL COMPASS. We reserve the right to revise or amend this Notice of Privacy Practices. Any revision or amendment to this notice will be effective for all our records created or maintained in the past, and for any records that we may create or maintain in the future. You may request a copy of our most current Notice at any time.
- HOW BEHAVIORAL COMPASS WILL USE AND DISCLOSE PHI. BEHAVIORAL COMPASS may use and disclose a Client’s PHI for many different reasons. Some of the uses or disclosures will require your prior written authorization; others, however, will not. Below you will find the different categories of our uses and disclosures, with some examples.
Uses and Disclosures Related to Treatment, Payment, or Health Care Operations Do Not Require Prior Written Consent. BEHAVIORAL COMPASS may use and disclose a Client’s PHI without consent for the following reasons:
For treatment. BEHAVIORAL COMPASS may disclose PHI to physicians, psychiatrists, psychologists, behavior interventionists and other licensed health care providers who provide a Client with health care services or are otherwise involved in his or her care. Example: If a psychiatrist is treating a Client, BEHAVIORAL COMPASS may disclose PHI to her/him in order to coordinate services.
For health care operations. BEHAVIORAL COMPASS may also provide PHI to company attorneys, accountants, consultants, and others to make sure that BEHAVIORAL COMPASS is in compliance with applicable laws.
To obtain payment for treatment. BEHAVIORAL COMPASS may use and disclose PHI to bill and collect payment for the treatment and services BEHAVIORAL COMPASS provided.
Example: We might send PHI to the Client’s insurance company in order to get payment for the services that BEHAVIORAL COMPASS has provided. BEHAVIORAL COMPASS could also provide PHI to business associates that provide services for BEHAVIORAL COMPASS.
Certain Other Uses and Disclosures Do Not Require Consent. BEHAVIORAL COMPASS may use and/or disclose PHI without consent or authorization for the following reasons:
Required By Law. When disclosure is (a) required by federal, state, or local law; judicial, board, or administrative proceedings; or, law enforcement; (b) compelled by a party to a proceeding before a court, arbitration panel or an administrative agency pursuant to its lawful authority; (c) required by a search warrant lawfully issued to a governmental law enforcement agency; or (d) compelled by the patient or the patient’s representative pursuant to state or federal statutes of regulations, such as the Privacy Rule that requires this Notice.
To avoid harm. When disclosure: (a) to law enforcement personnel or persons may be able to prevent or mitigate a serious threat to the health or safety of a person or the public; (b) is compelled or permitted by the fact that the Client is in such mental or emotional condition as to be dangerous to him or herself or the person or property of others, and if BEHAVIORAL COMPASS determines that disclosure is necessary to prevent the threatened danger; (c) is mandated by state child abuse and neglect reporting laws (for example, if we have a reasonable suspicion of child abuse or neglect); (d) is mandated by state elder/dependent abuse reporting law (for example, if we have a reasonable suspicion of elder abuse or dependent adult abuse); and (e) if disclosure is compelled or permitted by the fact that you or your child tells us of a serious/imminent threat of physical violence against a reasonably identifiable victim or victims.
For public health activities. When disclosure is for: (a) maintaining vital records, such as births and deaths; (b) preventing or controlling disease, injury or disability, (c) notifying a person regarding potential exposure to a communicable disease; (d) notifying a person regarding a potential risk for spreading or contracting a disease or condition; (d) reporting reactions to drugs or problems with products or devices; or (e) notifying individuals if a product or device they may be using has been recalled.
For health oversight activities. BEHAVIORAL COMPASS may disclose PHI to a health oversight agency for activities authorized by law. Oversight activities can include, for example, investigations, inspections, audits, surveys, licensure and disciplinary actions; civil, administrative and criminal procedures or actions; or other activities necessary for the government to monitor government programs, compliance with civil rights laws and the health care system in general.
For specific government functions. Examples: BEHAVIORAL COMPASS may disclose PHI of military personnel and veterans under certain circumstances.
For Workers’ Compensation purposes. BEHAVIORAL COMPASS may provide PHI in order to comply with Workers’ Compensation laws.
Appointment reminders and health related benefits or services. BEHAVIORAL COMPASS is permitted to contact you, without prior authorization, to provide appointment reminders or information about alternative or other health-related benefits and services that may be of interest.
Certain Uses and Disclosures Require You to Have the Opportunity to Object.
Disclosures to family, friends, or others. BEHAVIORAL COMPASS may provide PHI to a family member, friend, or other individual who you indicate is involved in the Client’s care or responsible for the payment of health care, unless you object in whole or in part. Retroactive consent may be obtained in emergency situations.
Other Uses and Disclosures Require Your Prior Written Authorization. The following uses and disclosures will only be made if BEHAVIORAL COMPASS has obtained written authorization from the Client or the Client’s parent or guardian: uses and disclosures for marketing purposes; most uses and disclosures of consultation notes; and other uses and disclosures not described in this Notice.
Consultation Notes: BEHAVIORAL COMPASS keeps “consultation notes”, also referred to as progress notes. Any use or disclosure of such notes requires your authorization unless the use or disclosure is:
For our use in treating you.
For our use in defending our company in legal proceedings instituted by you.
For use by the Secretary of Health and Human Services to investigate our compliance with HIPAA.
Required by law, and the use or disclosure is limited to the requirements of such law.
Required by law for certain health oversight activities pertaining to the originator of the consultation notes.
Required by a coroner who is performing duties authorized by law.
Required to help avert a serious threat to the health and safety of others.
BEHAVIORAL COMPASS will not release your information for fundraising purposes.
- RIGHTS REGARDING PHI. These are your rights with respect to PHI:
The Right to See and Get Copies of PHI. In general, you have the right to see PHI that is in BEHAVIORAL COMPASS’s possession, or to get copies of it; however, you must request it in writing. BEHAVIORAL COMPASS will provide access to the PHI within five (5) days of receipt of the written request. Under certain circumstances, BEHAVIORAL COMPASS may deny your request, but BEHAVIORAL COMPASS will give you, in writing, the reasons for the denial. BEHAVIORAL COMPASS will also explain your right to have the denial reviewed. If you ask for copies of PHI, BEHAVIORAL COMPASS will charge you a reasonable fee, not to exceed $0.25 per page. BEHAVIORAL COMPASS will provide copies of PHI within fifteen (15) days of receipt of the request. BEHAVIORAL COMPASS may elect to provide you with a summary or explanation of the PHI, but only if you agree to it, as well as to the cost, in advance.
The Right to Request Limits on Uses and Disclosures of PHI. You have the right to ask that BEHAVIORAL COMPASS limit how it uses and discloses PHI. While BEHAVIORAL COMPASS will consider your request, BEHAVIORAL COMPASS is not legally bound to agree. If BEHAVIORAL COMPASS does agree to your request, BEHAVIORAL COMPASS will put those limits in writing and abide by them except in emergency situations. You do not have the right to limit the uses and disclosures that BEHAVIORAL COMPASS is legally required or permitted to make. You have the right to restrict BEHAVIORAL COMPASS’s disclosure of PHI to health plans if you (or a third party on your behalf) has paid for the services out of pocket and in full.
The Right to Choose How BEHAVIORAL COMPASS Sends PHI to You. It is your right to ask that PHI be sent to you at an alternate address (for example, sending information to your work address rather than your home address) or by an alternate method (for example, via email instead of by regular mail). BEHAVIORAL COMPASS is obliged to agree to your request providing that BEHAVIORAL COMPASS can give you the PHI, in the format you requested, as long as the format is readily producible.
The Right to Get a List of the Disclosures BEHAVIORAL COMPASS Has Made. You are entitled to a list of disclosures of PHI that BEHAVIORAL COMPASS has made. The list will not include uses or disclosures to which you have already consented, i.e., those for treatment, payment, or health care operations, sent directly to you, or to your family; neither will the list include disclosures made for national security purposes, to corrections or law enforcement personnel.. Disclosure records will be held for six years. BEHAVIORAL COMPASS will respond to your request for an accounting of disclosures within 60 days of receiving your request. The list BEHAVIORAL COMPASS gives you will include disclosures made in the previous six unless you indicate a shorter period. The list will include the date of the disclosure, to whom PHI was disclosed (including their address, if known), a description of the information disclosed, and the reason for the disclosure. BEHAVIORAL COMPASS will provide the list to you at no cost, unless you make more than one request in the same year, in which case BEHAVIORAL COMPASS will charge you a reasonable sum based on a set fee for each additional request.
The Right to Amend Your PHI. If you believe that there is some error in your PHI or that important information has been omitted, it is your right to request that BEHAVIORAL COMPASS correct the existing information or add the missing information. Your request and the reason for the request must be made in writing. You will receive a response within ten (10) days of my receipt of your request. BEHAVIORAL COMPASS may deny your request, in writing, if BEHAVIORAL COMPASS finds that: the PHI is (a) correct and complete, (b) forbidden to be disclosed, (c) not part of my records, or (d) written by someone other than BEHAVIORAL COMPASS. The denial must be in writing and must state the reasons for the denial. It must also explain your right to file a written statement objecting to the denial. If you do not file a written objection, you still have the right to ask that your request and my denial be attached to any future disclosures of your PHI. If BEHAVIORAL COMPASS approves your request, BEHAVIORAL COMPASS will make the change(s) to your PHI. Additionally, BEHAVIORAL COMPASS will tell you that the changes have been made, and BEHAVIORAL COMPASS will advise all others who need to know about the change(s) to your PHI.
The Right to Receive Breach Notification. You have a right to receive notice in the event that your PHI is acquired, accessed, used, or disclosed in a manner not permitted by law which compromises the security or privacy of the PHI. This includes your right to be notified following a data breach. The Right to Get This Notice by Email. You have the right to get this notice by email or to obtain a paper copy.
III. HOW TO COMPLAIN ABOUT BEHAVIORAL COMPASS PRIVACY PRACTICES. If, in your opinion, BEHAVIORAL COMPASS may have violated the Client’s privacy rights, or if you object to a decision BEHAVIORAL COMPASS made about access to PHI, you are entitled to file a complaint with the person listed in Section IV below. You may also send a written complaint to the Secretary of the Department of Health and Human Services at 200 Independence Avenue S.W. Washington, D.C. 20201. If you file a complaint about BEHAVIORAL COMPASS’s privacy practices, BEHAVIORAL COMPASS will take no retaliatory action against you.
- PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO COMPLAIN ABOUT BEHAVIORAL COMPASS’S PRIVACY PRACTICES. If you have any questions about this notice, please contact us at: BEHAVIORAL COMPASS, PO Box 31053, Clarksville, TN 37040; email@example.com.
- EFFECTIVE DATE OF THIS NOTICE OF PRIVACY PRACTICES. This Notice of Privacy Practice is updated as of July 20, 2022. BEHAVIORAL COMPASS may change the terms of this Notice at any time. BEHAVIORAL COMPASS may, at its discretion, make the new terms effective for all PHI in our possession, including any PHI created or received before the new Notice is issued.