Effective Date: This policy is in effect as of December 1st, 2010 It is the policy of this Physician Practice that we will adopt, maintain and comply with our Notice of Privacy Practices, which shall be consistent with HIPAA and California law.
Notice of Privacy Practices
It is the policy of this Physician Practice that a notice of privacy practices must be published, that this notice be provided to all subject individuals at the first patient encounter if possible, and that all uses and disclosures of protected health information be done in accord with this organization’s notice of privacy practices. It is the policy of this Physician Practice to post the most current notice of privacy practices in our “waiting room” area, and to have copies available for distribution at our reception desk.
Assigning Privacy and Security Responsibilities
It is the policy of this Physician Practice that specific individuals within our workforce are assigned the responsibility of implementing and maintaining the HIPAA Privacy and Security Rules’ requirements.
Furthermore, it is the policy of this Physician Practice that these individuals will be provided sufficient resources and authority to fulfill their responsibilities. At a minimum it is the policy of this Physician Practice that there will be one individual or job description designated as the Privacy Official.
It is the policy of this Physician Practice that privacy protections extend to information concerning deceased individuals.
Minimum Necessary Use and Disclosure of Protected Health Information
It is the policy of this Physician Practice that for all routine and recurring uses and disclosures of protected health information (PHI) (except for uses or disclosures made 1) for treatment purposes, 2) to or as authorized by the patient or 3) as required by law for HIPAA compliance) such uses and disclosures of PHI must be limited to the minimum amount of information needed to accomplish the purpose of the use or disclosure. It is also the policy of this Physician Practice that non-routine uses and disclosures will be handled pursuant to established criteria. It is also the policy of this organization that all requests for PHI (except as specified above) must be limited to the minimum amount of information needed to accomplish the purpose of the request, and where practicable, to the limited data set.
It is the policy of this Physician Practice that any uses or disclosures of protected health information for marketing activities will be done only after a valid authorization is in effect except as permitted by law. It is the policy of this organization to consider any communication intended to induce the purchase or use of a product or service where an arrangement exists with a third party for such inducement in exchange for direct or indirect remuneration, or where this organization encourages purchase or use of a product or service directly to patients to constitute “marketing”.
This organization does not consider the communication of alternate forms of treatment, or the use of products and services in treatment, or a face- to-face communication made by us to the patient, or a promotional gift of nominal value given to the patient to be marketing, unless direct or indirect remuneration is received from a third party. Similarly, this organization does not consider communication to our patients who are health plan enrollees in conjunction with our provision, coordination, or management of their health care and related services, including our coordination or management of their health care with a third party, our consultation with other health care providers relating to their care, or if we refer them for health care to be marketing, but only to the extent these communications describe:
1) a provider’s participation in the health plan’s network,
2) the extent of their covered benefits, or 3) concerning the availability of more cost-effective pharmaceuticals.
This organization may make remunerated communications tailored to individual patients with chronic and seriously debilitating or life-threatening conditions provided we are making the communication in conjunction with our provision, coordination, or management of their health care and related services, including our coordination or management of their health care with a third party, our consultation with other health care providers relating to their care, or if we refer them for health care.
If we makes these types of communications to patients who have a chronic and seriously debilitating or life-threatening condition, we will disclose in at least 14-point type the fact that the communication is remunerated, the name of the party remunerating us, and the fact the patient may opt out of future remunerated communications by calling a toll free number. This organization will stop any further remunerated communications within 30 days of receiving an opt-out request.
Mental Health Records
It is the policy of this Physician Practice to require an authorization for any use or disclosure of
psychotherapy notes, as defined in the HIPAA regulations, except for treatment, payment or health care
operations as follows:
A. Use by originator for treatment;
B. Use for training physicians or other mental health professionals as authorized by the regulations;
C. Use or disclosure in defense of a legal action brought by the individual whose records are at issue;
D. Use or disclosures as required by law, or as authorized by law to enable health oversight agencies to oversee the originator of the psychotherapy notes.
It is the policy of this Physician Practice that all complaints relating to the protection of health information be investigated and resolved in a timely fashion. Furthermore, it is the policy of this Physician Practice that all complaints will be addressed to [name or job title of person authorized to handle complaints]