NOTICE OF PRIVACY PRACTICES
(Heath Information Portability and Accountability Act)
I. THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
II. IT IS BSP’s LEGAL DUTY TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (PHI)
By law BSP is required to insure that your child and your PHI are kept private. The PHI constitutes information created or noted by BSP that can be used to identify you or your child. It contains data about your child’s past, present, or future health or condition and the provision of health care services to you child. BSP is required to provide you with this Notice about our privacy procedures. This Notice must explain when, why, and how BSP would use and/or disclose your or your child’s PHI. Use of PHI means when BSP shares, utilizes, examines, or analyzes information within our practice; PHI is disclosed when BSP releases, transfers, gives, or otherwise reveals it to a third party outside our practice. With some exceptions, BSP may not use or disclose more of your child’s PHI than is necessary to accomplish the purpose for which the use or disclosure is made; however, BSP is always legally required to follow the privacy practices described in this Notice.
Please note that BSP reserves the right to change the terms of this Notice and our privacy policies at any time. Any changes will apply to PHI already on file with BSP. Before BSP makes any important changes to our policies, BSP will immediately change this Notice and post a new copy of it in our office. You may also request a copy of this Notice from me.
III. HOW BSP WILL USE AND DISCLOSE YOUR PHI
BSP will use and disclose your PHI for many different reasons. Some of the uses or disclosures will require your prior written authorization; others, however, will not. Below you will find the different categories of my uses and disclosures, with some examples.
A. Uses and Disclosures Related to Treatment, Payment, or Health Care Operations Do Not Require Your Prior Written Consent.
BSP may use and disclose your child’s PHI without your consent for the following reasons:
- For treatment. BSP may disclose your child’s PHI to Regional Center personnel, Case Managers affiliated with your insurance provider,* and other health care professionals who provide your child health care services or are otherwise part of your child’s Interdisciplinary Team. Example: If a psychiatrist is treating your child, BSP may disclose your PHI to her/him in order to coordinate your care.
*Once initial release to contact Insurance Provider is signed by parent
- For supervisory operations. BSP may disclose your PHI to facilitate the efficient and correct operation of our practice. Examples: Quality control – BSP might use your PHI in the evaluation of the quality of parent training and consultative services or direct intervention services that you have received or to evaluate the performance of BSP staff who provided you with these services. BSP may also provide your PHI to our attorneys, accountants, consultants, and others to make sure that BSP is compliance with applicable laws.
- To obtain payment for treatment. BSP may use and disclose your child’s PHI to bill and collect payment for the treatment and services that is provided to you and your child. Example: BSP will send a summary of the services you received by our agency to the funding agency for payment. BSP could also provide your PHI to business associates, such as a bookkeeper.
B. Certain Other Uses and Disclosures Do Not Require Your Consent. BSP may use and/or disclose your or your child’s PHI without your consent or authorization for the following reasons:
- When disclosure is required by federal, state, or local law; judicial, board, or administrative proceedings; or, law enforcement. Example: BSP may make a disclosure to the appropriate officials when a law requires BSP to report information to government agencies, law enforcement personnel and/or in an administrative proceeding.
- If disclosure is compelled by a party to a proceeding before a court of an administrative agency pursuant to its lawful authority.
- If disclosure is compelled by the patient or the patient’s representative pursuant to California Health and Safety Codes or to corresponding federal statutes of regulations, such as the Privacy Rule that requires this Notice.
- To avoid harm. BSP may provide PHI to law enforcement personnel or persons able to prevent or mitigate a serious threat to the health or safety of a person or the public.
- If disclosure is compelled or permitted by the fact that you or your child are in such mental or emotional condition as to be dangerous to yourself or the person or property of others, and if BSP determines that disclosure is necessary to prevent the threatened danger.
- If disclosure is mandated by the California Child Abuse and Neglect Reporting law. For example, if BSP staff have a reasonable suspicion of child abuse or neglect. Please see Mandated Reporting Guidelines.
- If disclosure is mandated by the California Elder/Dependent Adult Abuse Reporting law. For example, if BSP staff have a reasonable suspicion of elder abuse or dependent adult abuse.
- If disclosure is compelled or permitted by the fact that the client informs BSP Staff of his/her serious/imminent threat of physical violence against a reasonably identifiable victim or victims. Disclosure is also compelled if a third party (e.g. significant other; parent) communicates to BSP staff the client’s serious threat of physical violence against a reasonably identifiable victim or victims.
- When disclosure is mandated by Title 17 and Department of Developmental Services regarding the occurrence of significant life events or health and safety issues. A “Special Incident Report (SIR) will be generated. Additional reporting requirements by our local Regional Center include reporting of “Other Events and Observations” which includes behaviors atypical for a client; and those behaviors which may jeopardize the safety of the client and others.
- For health oversight activities. Example: BSP may be required to provide information to assist the government in the course of an investigation or inspection of a health care organization or provider.
- If an arbitrator or arbitration panel compels disclosure, when arbitration is lawfully requested by either party, pursuant to subpoena duces tectum (e.g., a subpoena for mental health records) or any other provision authorizing disclosure in a proceeding before an arbitrator or arbitration panel.
- If disclosure is required or permitted to a health oversight agency for oversight activities authorized by law. Example: When compelled by U.S. Secretary of Health and Human Services to investigate or assess my compliance with HIPAA regulations.
- If disclosure is required by a search warrant lawfully issued to a governmental law enforcement agenc
- For specific government functions. BSP may disclose PHI in the interests of national security.
- If disclosure is otherwise specifically required by law.
C. Certain Uses and Disclosures Require You to Have the Opportunity to Object.
- Disclosures to family, friends, or others. BSP may provide your PHI to a family member, friend, or other individual who you indicate is involved in your child’s care or responsible for the payment for your child’s health care, unless you object in whole or in part. Retroactive consent may be obtained in emergency situations.
D. Other Uses and Disclosures Require Your Prior Written Authorization. In any other situation not described in Sections IIIA, IIIB, and IIIC above, BSP will request your written authorization before using or disclosing any of your PHI. Even if you have signed an authorization to disclose your PHI, you may later revoke that authorization, in writing, to stop any future uses and disclosures (assuming that BSP has not taken any action subsequent to the original authorization) of your PHI by BSP.
IV. WHAT RIGHTS YOU HAVE REGARDING YOUR PHI
These are your rights with respect to your PHI:
A. The Right to See and Get Copies of Your PHI. In general, you have the right to see your child’s PHI that is in our possession, or to get copies of it; however, you must request it in writing. We will provide the PHI five days after receiving the written request. Under certain circumstances, BSP may deny your request, but if BSP does, BSP will indicate in writing, the reasons for the denial. BSP will also explain your right to have our denial reviewed.
If you ask for copies of your PHI, BSP will charge you not more than $0.10 per page (after first 25 pages). BSP may see fit to provide you with a summary or explanation of the PHI, but only if you agree to it, as well as to the cost, in advance.
B. The Right to Request Limits on Uses and Disclosures of Your PHI. You have the right to ask that BSP limit how we use and disclose your child’s PHI. While BSP will consider your request, BSP is not legally bound to agree. If BSP does agree to your request, BSP will put those limits in writing and abide by them except in emergency situations. You do not have the right to limit the uses and disclosures that BSP is legally required or permitted to make.
C. The Right to Get a List of the Disclosures BSP Has Made. You are entitled to a list of disclosures of your child’s PHI that BSP has made. The list will not include uses or disclosures to which you have already consented, i.e., those for treatment, payment, or health care operations, sent directly to you, or to your family; neither will the list include disclosures made for national security purposes, to corrections or law enforcement personnel, or disclosures made before April 15, 2003. After April 15, 2003, disclosure records will be held for six years.
BSP will respond to your request for an accounting of disclosures within 60 days of receiving your request. The list BSP gives you will include disclosures made in the previous six years unless you indicate a shorter period. The list will include the date of the disclosure, to whom PHI was disclosed (including their address, if known), a description of the information disclosed, and the reason for the disclosure. BSP will provide the list to you at no cost, unless you make more than one request in the same year, in which case BSP will charge you a reasonable sum based on a set fee for each additional request.
D. The Right to Amend Your PHI. If you believe that there is some error in your child’s PHI or that important information has been omitted, it is your right to request that BSP correct the existing information or add the missing information. Your request and the reason for the request must be made in writing.
You will receive a response within 60 days of our receipt of your request. BSP may deny your request, in writing, if BSP finds that: the PHI is (a) correct and complete, (b) forbidden to be disclosed, (c) not part of our records, or (d) written by someone other than BSP. Our denial must be in writing and must state the reasons for the denial. It must also explain your right to file a written statement objecting to the denial. If you do not file a written objection, you still have the right to ask that your request and our denial be attached to any future disclosures of your PHI. If BSP approves your request, BSP will make the change(s) to your PHI. Additionally, BSP will tell you that the changes have been made, and BSP will advise all others who need to know about the change(s) to your PHI.
E. The Right to Choose How I Send Your PHI to You. It is your right to ask that your child’s PHI be sent to you at an alternate address (for example, sending information to your work address rather than your home address) or by an alternate method (for example, via email instead of by regular mail). BSP is obliged to agree to your request providing that BSP can give you the PHI, in the format you requested, without undue inconvenience. BSP may not require an explanation from you as to the basis of your request as a condition of providing communications on a confidential basis.
F. The Right to Get This Notice by Email: You have the right to get this notice by email. You have the right to request a paper copy of it, as well.
V. HOW TO COMPLAIN ABOUT OUR PRIVACY PRACTICES
If, in your opinion, BSP may have violated your privacy rights, or if you object to a decision BSP made about access to your child’s PHI, you are entitled to file a complaint with the person listed in Section VI below. You may also send a written complaint to the Secretary of the Department of Health and Human Services at 200 Independence Avenue S.W. Washington, D.C. 20201. If you file a complaint about our privacy practices, BSP will take no retaliatory action against you.
VI. PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO COMPLAIN ABOUT OUR PRIVACY PRACTICES
If you have any questions about this notice or any complaints about our privacy practices, or would like to know how to file a complaint with the Secretary of the Department of Health and Human Services, please contact Melissa Sweitzer, Executive Director at: 12443 Lewis Street, Suite 201, Garden Grove, CA 92840 (714) 748-4440. (Email – MelissaS@behaviorpartner.com )
VII. NOTIFICATIONS OF BREACHES
In the case of a breach, BSP is required to notify each affected individual whose unsecured PHI has been compromised. Even if such a breach was caused by a business associate, BSP is ultimately responsible for providing the notification directly or via the business associate. If the breach involves more than 500 persons, OCR must be notified in accordance with instructions posted on its website. BSP bears the ultimate burden of proof to demonstrate that all notifications were given or that the impermissible use or disclosure of PHI did not constitute a breach and must maintain supporting documentation, including documentation pertaining to the risk assessment.
VIII. PHI AFTER DEATH
Generally, PHI excludes any health information of a person who has been deceased for more than 50 years after the date of death. BSP may disclose deceased individuals’ PHI to non-family members, as well as family members, who were involved in the care or payment for healthcare of the decedent prior to death; however, the disclosure must be limited to PHI relevant to such care or payment and cannot be inconsistent with any prior expressed preference of the deceased individual.
IX. Individuals’ Right to Restrict Disclosures; Right of Access
To implement the 2013 HITECH Act, the Privacy Rule is amended. BSP is required to restrict the disclosure of PHI about you, the patient, to a health plan, upon request, if the disclosure is for the purpose of carrying out payment or healthcare operations and is not otherwise required by law.
The PHI must pertain solely to a healthcare item or service for which you have paid the covered entity in full. (OCR clarifies that the adopted provisions do not require that covered healthcare providers create separate medical records or otherwise segregate PHI subject to a restrict healthcare item or service; rather, providers need to employ a method to flag or note restrictions of PHI to ensure that such PHI is not inadvertently sent or made accessible to a health plan.)
The 2013 Amendments also adopt the proposal in the interim rule requiring BSP to provide you, the patient, a copy of PHI to any individual patient requesting it in electronic form. The electronic format must be provided to you if it is readily producible. OCR clarifies that BSP must provide you only with an electronic copy of their PHI, not direct access to their electronic health record systems. The 2013 Amendments also give you the right to direct BSP to transmit an electronic copy of PHI to an entity or person designated by you. Furthermore, the amendments restrict the fees that BSP may charge you for handling and reproduction of PHI, which must be reasonable, cost-based and identify separately the labor for copying PHI (if any). Finally, the 2013 Amendments modify the timeliness requirement for right of access, from up to 90 days currently permitted to 30 days, with a one-time extension of 30 additional days.
X. NOTICE OF PRIVACY PRACTICES
BSP ’s Notice of Privacy Practices must contain a statement indicating that most uses and disclosures of progress/case notes, marketing disclosures and sale of PHI do require prior authorization by you, and you have the right to be notified in case of a breach of unsecured PHI.
XI. EFFECTIVE DATE OF THIS NOTICE
This notice went into effect on January 30, 2013.