1. The HIPAA privacy and security rules. This policy shall be construed to be consistent with the requirements of the HIPAA privacy rules (45 CFR § 164.501 et seq.) and security rules (45 CFR § 164.301 et seq.) as they shall be amended.  The regulations, FAQs, and other helpful information concerning the HIPAA rules are found at the Office of Civil Rights website, http://www.hhs.gov/ocr/privacy/index.html.  Practice personnel should be familiar with the requirements of the regulations and should review the referenced regulations when responding to specific situations.
2. Practice’s current Notice of Privacy Practices. A copy of the Notice of Privacy Practices is incorporated into these policies.  The Notice of Privacy Practices summarizes our privacy practices and policies.  Practice personnel are expected to know and comply with the Notice of Privacy Practices.

1. Treatment. Practice personnel may use or disclose protected health information to treat the patient.  For example, practice personnel may use or disclose information to evaluate the patient; to schedule appointments; to obtain information needed to treat the patient; make referrals; etc.  In addition, Practice personnel may disclose information to other health care providers so that the other providers may properly treat the patient.  (See 45 CFR § 164.506).
2. Payment. Practice personnel may use or disclose protected health information to obtain payment for services rendered to the patient.  For example, practice personnel may contact third party payors to obtain pre-authorization or submit claims; perform billing functions; send a claim to collections; etc.  (See 45 CFR § 164.506).
3. Health Care Operations. Practice personnel may use or disclose protected health information for certain health care operations.  For example, the information may be used for case review; quality improvement; credentialing; employee training; patient relations; business analysis; etc.  (See 45 CFR § 164.506).
4. To Family or Others Involved in Care or Payment. Practice personnel may disclose protected health information to family members, close friends, or others involved in the care of the patient or the payment for such health care if:  (1) the patient is present and does not object to the disclosure, and the practitioner believes disclosure is in the patient’s best interests; or (2) the patient is not present, but the disclosure is in the patient’s best interest and is consistent with the patient’s prior expressed wishes.  Practice personnel should only disclose information relevant to the person’s involvement in the patient’s health care.  (See 45 CFR § 164.510).
5. Personal Representatives. In the case of minors, deceased patients, or other patients who lack capacity, Practice personnel may disclose information to the parent, guardian, or other personal representative with authority to make health care decisions for the patient under Idaho law.  (See IC § 39-4504).  Non-custodial parents are generally entitled to access information about their children.  (See IC § 32-717A).  Practice personnel may decline to disclose information to the personal representative if they believe it would not be in the patient’s best interest to disclose the information.  (See 45 CFR § 164.502(g)).
6. To Avert Serious Threat. Practice personnel may disclose information if necessary to avert serious and imminent harm to the patient or others.  The disclosure may only be made to someone with the ability to avert the harm, e.g., the police.  (See 45 CFR § 164.512(j)).
7. Disclosures Required by Law. Practice personnel may disclose information to the extent another law requires disclosure, e.g., to report abuse, treatment of the victim of a crime or gunshot wounds, certain communicable diseases, threats to others, etc.  Any disclosure should be limited to the extent required by that other law.  (See 45 CFR § 164.512(a), (c)).
8. Subpoenas and Court Orders. Practice personnel may disclose information pursuant to a court order, warrant or subpoena, but only if certain conditions are satisfied.  Practice personnel should immediately contact the Privacy Officer if they are presented with a court order, subpoena, or request from a lawyer or prosecutor.  The Privacy Officer should review 45 CFR § 164.512(e) before responding to the order, warrant, subpoena or request.
9. Workers Compensation. Practice personnel may disclose information to parties in a workers compensation case to the extent such information is relevant to the injuries at issue in the case.  (See 45 CFR § 164.512(l)).
10. Police, Regulators, and Other Government Officials. Practice personnel may disclose information to the police or other government officials if certain conditions are satisfied.  Practice personnel should immediately contact the Privacy Officer if they receive requests from government officials.  The Privacy Officer should review 45 CFR § 164.512(b), (c)-(g), (k) before responding to such requests to ensure compliance with the regulations.
11. Client/Patient Satisfaction Surveys. Practice personnel may conduct client/patient satisfaction surveys to understand how services can be improved for patients and their families or friends.  For example: A client or patient may receive a survey from a patient satisfaction research organization, asking for comment on the services provided.
12. Client/Patient E-mail and Phone Number Use.  If you choose to provide us with your e-mail address or phone number to receive text messages, we will assume that you permit us to use your e-mail and/or phone number to communicate with you.  You should understand that there are certain risks associated with the use of e-mail over an unsecure network.  For example, there is some risk that it could be intercepted or misdirected and seen by others, or stored on portable electronic devices that have no security.  Please notify us if you do not want us to use e-mail or texts to communicate with you.  Additionally, you should understand that use of e-mail or text is not intended to be a substitute for professional medical advice, diagnosis or treatment.  E-mail or text communications should never be used in a medical emergency; instead, you should contact your provider directly.

1. Routine Disclosure of Protected Health Information.  The “minimum necessary standard” does not apply to disclosures to other health care providers for purposes of treating the patient.  The minimum necessary standard generally applies to all other routine disclosures of information, including disclosures to third party payors to secure payment; disclosures to business associates; etc.  Practice personnel should not request the disclosure of the entire medical record unless they require the entire medical record for legitimate uses.
2. Non-Routine Disclosures of Protected Health Information.  All non-routine disclosures or requests for protected health information shall be reviewed by the Privacy Officer on a case-by-case basis, including but not limited to requests from law enforcement, government officials, per subpoenas, etc.

1. Practice managers and owners shall have access to any information as reasonably necessary to facilitate the effective and efficient operations of Practice.
2. Practitioners and other clinical personnel shall have access to any protected health information relevant to patients being treated by the practitioner or clinical personnel.
3. Billing personnel shall have access to any protected health information necessary to allow such personnel to bill for services rendered by the Practice, including financial information.  Billing personnel should not normally access patients’ medical records unless and to the extent necessary to properly bill for the service rendered.
4. Administrative personnel (e.g., receptionists, assistants, etc.) shall have access to only the protected health information that is reasonably necessary to allow the administrative personnel to fulfill their duties on behalf of Practice.  Administrative personnel should not normally access patients’ medical records unless and to the extent necessary to allow them to properly fulfill their administrative duties.
5. Business associates of the Practice who assists Practice with administration, treatment, payment, and operations of the Practice shall have access to protected health information that is reasonably necessary to allow the business associate to fulfill their duties on behalf of Practice.  Practice must have a “business associate agreement” with business associates before the business associate may access protected health information as described below.  Business associates’ access shall be conditioned on and subject to the business associate agreement and the HIPAA privacy and security rules.

The unauthorized access of information outside the scope of such person’s duties will subject Practice personnel to appropriate sanctions as provided below.  (See 45 CFR § 164.514(d)).

1. Copy to Patient. Practice personnel shall provide a copy of Practice’s current Notice of Privacy Practices to the patient or personal representative no later than the first date of treatment.  Practice personnel shall take reasonable action to obtain the patient’s or personal representative’s written acknowledgment that they have received a copy of the Notice.  If the patient will not sign the acknowledgement, Practice personnel shall document the circumstance in the Patient’s record.
2. Changes. The Privacy Officer shall be responsible for updating the Notice of Privacy Practices to conform to changes in Practice’s privacy practices or changes in the law.  Changes in the Notice shall apply retroactively.

1. Review and Obtain Copies of Records. The patient or personal representative may inspect and obtain a copy of protected health information that Practice may use to make decisions about the patient’s care or payment for the care (e.g., medical records and patient bills, but not psychotherapy notes, internal reviews, etc.).  The Practice generally has 30 days to respond to a request.  The Practice may charge a reasonable cost-based fee for providing the records.  The Practice may deny the request under limited circumstances, e.g., if the patient seeks psychotherapy notes; information prepared for legal proceedings; or if disclosure may result in substantial harm to the patient or others.  If the practice denies the request, it will advise the patient of the basis for the denial in writing.  Practice personnel should discuss the scope of any request with the patient to ensure that the requested records are properly identified.  (See 45 CFR § 164.524).
2. Amend Health Records. The patient or personal representative may request that the patient’s protected health information be amended.  The patient or personal representative must provide a written explanation for the request.  The Privacy Officer is responsible for reviewing and coordinating any response to a request for amendment.  The Practice generally has 60 days to respond to a request.  The Practice may deny the request if it did not create the record unless the originator is no longer available; if the patient did not have a right to access the record; or if the Practice determines that the record is accurate and complete.  If the Practice denies the request, the Privacy Officer will notify the patient or personal representative of the basis for the denial in writing.  The patient or personal representative has the right to submit a statement disagreeing with the Practice’s decision and to have the statement attached to the record.  Any amendment to the record becomes a part of the record.  If other providers may have relied on an incorrect record, the Practice must notify them of the amendment.  (See 45 CFR § 164.526).
3. Request Restrictions on Use or Disclosure of Information. Patients or personal representatives have the right to right to request restrictions on the use or disclosure of protected health information for purposes of treatment, payment or health care operations; however, the Practice is not required to agree to such restrictions.  The Practice generally does not agree to such restrictions.  Only the Privacy Officer may agree to such additional uses or disclosures.  If the Practice agrees to such a restriction, it will comply with the restriction unless an emergency or the law prevents the Practice from complying with the restriction, or until the restriction is terminated.  (See 45 CFR § 164.522(a)).
4. Communicate By Alternative Means. To ensure privacy, patients or personal representatives may request that the Practice communicate with them by alternative means (e.g., by e-mail, by phone, by sealed envelope without a return address, etc.) or at alternative locations (e.g., send all information to work).  Practice personnel may not ask the patient to explain the reason for the request.  The practice will accommodate reasonable requests.  (See 45 CFR § 164.522(b)).
5. Account for Certain Disclosures. The patient or personal representative may receive an accounting of certain disclosures by the Practice of the patient’s information.  Such disclosures are tracked in the Accounting Log described in section 8, above.  The Practice generally has 60 days to respond to the request.  The patient or personal representative may receive the first accounting within a 12-month period free of charge; after that, the Practice may charge a reasonable cost-based fee for all subsequent requests during that 12-month period.  (See 45 CFR § 528).

The limits and process for exercising and responding to a patient’s or personal representative’s exercise of rights are more fully described in the HIPAA privacy rules, 45 C.F.R. § 164.522 et seq.  Practice personnel should consult with the Privacy Officer in responding to a patient’s request.

1. Practice personnel should avoid leaving patient records or other information in open areas where unauthorized persons may see or access the information.
2. Practice personnel should avoid discussing patient information in areas where others may overhear.
3. Practice personnel should take reasonable steps to ensure that letters, faxes, e-mails, and other communications are sent to and received by the correct party, e.g., by confirming or checking the applicable number or address.
4. Practice personnel should secure computers, PDAs, and patient records, and avoid creating situations in which unauthorized persons would be able to access computers, records, etc.
5. Practice may require employees, janitors, vendors, volunteers and others to execute confidentiality agreements.

Notwithstanding the foregoing, Practice personnel are only required to utilize safeguards that are reasonable under the circumstances.  Practice personnel should use reasonable judgment to ensure that privacy concerns do not interfere with effective patient care.