HIPAA

Notice of HIPAA Privacy Policies and Practices

This notice includes information about how your confidential information may be used and disclosed by me, so please read it carefully and be sure to discuss any questions or concerns with me.

DEFINITIONS: These are technical definitions in accordance with the federal Health Insurance Portability & Accountability Act (HIPAA) Privacy Rule that you will need to know to understand this document.

Protected Health Information (PHI) - PHI is (with certain exceptions) individually- identifiable health information regarding the patient.

Psychotherapy Notes - Notes recorded (in any medium) by a therapist documenting or analyzing the contents of a conversation with a patient or patients during a private counseling session or a group, joint, or family session. These notes are separated from the rest of the patient’s medical or mental health records and are given a greater degree of protection than PHI.

Use - Sharing, employment, application, utilization, examination, or analysis of individually-identifiable health information within an entity (e.g., the therapist’s office).

Disclosure - Release of, transfer of, provision of access to, or divulging in any other manner, information outside the entity holding the information.

Treatment - Provision, coordination, or management of health care and related services by one or more health care providers. This can include the coordination or management of health care by a health care provider with a third party, consultation between health care providers relating to a patient, or the referral of a patient for health care from one health care provider to another.

Payment - When the therapist obtains reimbursement for the provision of health care. For example, obtaining third-party reimbursement or the determinations of eligibility or coverage (including coordination of benefits or the determination of cost- sharing amounts).

Health Care Operations - Activities that relate to the performance or operation of the therapist’s practice. Examples include conducting quality assessment and improvement activities, including outcomes evaluations and development of clinical guidelines; protocol development, case management and care coordination; business-related matters such as administrative services; and related functions that do not include treatment.

I. General Policies Regarding Privacy of PHI: In my practice, I follow policies and procedures in compliance with both federal regulations of the HIPAA Privacy Rule, and Oregon State Law.

• I do not use or disclose PHI in violation of the HIPAA Privacy Rule or Oregon State Law, I use and disclose PHI as permitted or required by the HIPAA Privacy Rule, Oregon State Law, or other laws,

• When permitted, I make a reasonable effort to limit disclosure of PHI to the minimum necessary to accomplish the intended purpose of the disclosure.

II. Uses and Disclosures Requiring Your Consent: I may use or disclose your PHI for treatment, payment, and health care operations purposes by obtaining your consent (given by signing the Informed Consent for Therapy form).

• The exception to this is that I may disclose PHI to your health insurer if your insurance policy provides that, by accepting the benefits of the policy, subscribers/enrollees are deemed to have consented to the examination of their medical records for purposes of utilization review, quality assurance, and peer review by the insurer or its designee. However, I may not disclose Psychotherapy Notes to the insurer without a Privacy Rule Authorization.

• In addition, other health professionals sharing the electronic medical records system used by Transitions Professional Center may have access to your records.

III. Uses and Disclosures Requiring a Privacy Rule Authorization

• For uses and disclosures other than treatment, payment, or health care operations (e.g., to your employer, attorney, or school), I must obtain a patient authorization.

• No authorization is required, however, for those uses and disclosures permitted or required by law (described below in Section IV)

• Any use or disclosure of Psychotherapy Notes requires an authorization meeting both Privacy Rule and Oregon State Law requirements.

• A patient may revoke the authorization at any time, unless action has been taken in reliance on the authorization.

IV. Uses and Disclosures with neither Consent nor Authorization: I may be required to disclose PHI without your consent or authorization in the circumstances described below. When possible I will inform you before such disclosure.

• Child Abuse: If your records are requested in relation to a child abuse investigation, I may be compelled to release them to the appropriate authorities. If I receive information about child abuse, I may be required to make an oral report to the Department of Health and Human Services.

• Adult Abuse: If your records are requested in relation to an investigation of abuse of a vulnerable adult such as an elderly or disabled individual, I may be compelled to release them to the appropriate authorities. If I receive information about abuse to a vulnerable adult, I may be required to make an oral report to the Department of Health and Human Services.

• Government Oversight: In some circumstances, I may be required to disclose information to a public health authority, coroner or medical examiner, an agency for the military, national security, Veterans Affairs, or a law enforcement official.

• Judicial or Administrative Proceedings: If you are involved in court proceedings and a request is made for information about your evaluation, diagnosis, or treatment, and the records thereof, such information is privileged under state law and must not be released without your written authorization or a court order. This privilege does not apply if you are being evaluated for a third party or if the evaluation is court-ordered.

• Serious Threat to Health or Safety: I may disclose confidential information when I judge that such disclosure is necessary to protect against a clear and substantial risk of imminent serious harm by you to yourself or another person. I shall limit the disclosure of the otherwise confidential information to only those persons and only that content which would be consistent with the standards of the profession when addressing these problems. I will, when possible, first obtain your consent for such disclosure. I may also use or disclose PHI that I have previously agreed to restrict if the restricted PHI is needed to provide you with emergency treatment.

• Worker’s Compensation: If you file a Worker’s Compensation claim, this constitutes authorization for me to release your relevant mental health records to involved parties and officials. This would include a past history of complaints or treatment of a similar condition.

V. Patients’ Rights: Below is an outline of your rights regarding privacy of PHI and Psychotherapy Notes.

• Right to Request Restrictions: You have the right to request restrictions on the uses or disclosures of your PHI. To carry out treatment, payment, or health care operations, I am not required to accept the requested restrictions, and may terminate my agreement to not disclose at a later time.

• Right to Receive Confidential Communications by Alternative Means and at Alternative Locations: You have the right to request and to receive confidential communications from me of PHI by alternative means and at alternative locations. (For example, you may not want a family member to know you are seeing me; upon your request, I will send your bills to another address.)

• Right to Inspect and Copy: You have the right to inspect and/or obtain a copy of your PHI and psychotherapy notes in my records for as long as the PHI is maintained in the record. I may deny your request to access your PHI or Psychotherapy Notes under certain circumstances. In those cases, you may have this decision reviewed by another licensed mental health provider. Upon your request, I will discuss the details of the request, denial, and review process.

• Right to Amend: You have the right to request an amendment of your PHI for as long as the PHI is maintained in the record. If I accept the request, I am required to amend the PHI or record as agreed and to make a reasonable effort to inform and to provide the amendment to (1) persons identified by you as having received the PHI and who need the amendment, and (2) persons who have received the PHI that is the subject of the amendment and who may have relied or who could foreseeably rely on such information to your detriment.

• Right to an Accounting: You have the right to receive an accounting of my disclosures of your PHI made in the six years prior to your request. Exceptions include disclosures to carry out treatment, payment, and health care operations; to you of PHI about you; to correctional institutions or law enforcement officials; to government officials regarding national security or intelligence; or if it would impede the activities of a health oversight or law enforcement official.

• Right to a Paper Copy: You have the right to obtain a copy of this notice.

VI. Administrative Issues: Safeguards and Complaints: I am the designated privacy officer for my professional practice.

• I have in place appropriate administrative, technical, and physical safeguards in accordance with HIPAA.

• I meet the documentation requirements of the HIPAA Privacy Rule and the HIPAA Security Rule.

• I have entered into written agreements with those providing healthcare operations on my behalf, that they will safeguard the privacy of PHI my patients in accordance with this notice. I rely on these business associates to abide by the contract and will take reasonable steps to remedy any breaches of which I become aware.

• The privacy of my patients’ PHI is critically important for my relationship with my patients and for my practice. I provide a process for my patients to make complaints concerning my adherence to the requirements of HIPAA.

• I will not intimidate, coerce, discriminate against, or take retaliatory action against any patient for exercising their rights under the HIPAA Privacy Rule or for filing a complaint.

• I will not require patients to waive their rights provided by the HIPAA Privacy Rule or right to file a Department of Health and Human Services compliance complaint as a condition of receiving treatment.