NOTICE OF PRIVACY PRACTICES
In 1996 the Federal Government passed a law (HIPAA) covering your health information. This notice is a requirement of that law. This notice explains how we use your health information at the Squirrel Hill Health Center (SHHC). Below is a summary of the notice.
As part of the HIPAA laws you have the right to:
- Review your health record
- Ask for amendments to be made to your health record
- Add a note of your own to your health record
- Ask for a listing of who we gave your health record information to, other than those organizations or people listed in the notice even if they got it by accident
- Receive notification in the event of a breach affecting your privacy
- Have us contact you at a number or address that you provide us
- Ask us not to contact you about new programs that we might offer
- Ask us not to solicit you for any fundraising that we may undertake
As part of the HIPAA laws the SHHC must do the following:
- Protect your health record from anyone not authorized to see the record
- Post a copy of this notice, provide you with a copy of this notice and let you know if and when we make any changes to this notice
- Notify you if your personal health information has been compromised
- Do what this notice says we will do in regards to your health record
- Train all our staff about how to handle your health record, keeping it private
- Not use or give out your health information without your written consent for anything other than what is outlined in this notice
You have the right to file a complaint against the SHHC if you feel that we have used your health record in a manner other than what is outlined in this notice and that we have violated your privacy without your consent.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Understanding Your Personal Health Record Information
Each time you visit the health center, your provider or health care professional makes a record of your visit. Typically, this record contains your health history, current symptoms, examination and test results, diagnoses, treatment, and a plan for future care or treatment.
This information, often referred to as your medical record, serves as a:
- Basis for planning your care and treatment.
- Means of communication among the many health professionals who contribute to your care.
- Legal document describing the care you received.
- Means by which you or a third-party payer can verify that you actually received the services that we billed for.
- A tool in medical education.
- A source of information for public health officials charged with improving the health of the regions they serve.
- A tool to assess the appropriateness and quality of care you received.
- A tool to improve the quality of healthcare and achieve better patient outcomes.
Understanding what is in your health records and how your health information is used helps you to:
- Ensure its accuracy and completeness.
- Understand who, what, where, why, and how others may access your health information.
- Make informed decision about authorizing disclosures to others.
- Better understand the health information rights detailed below.
Your Rights Under the Federal HIPAA Privacy Standard
Although your health records are the physical property of the Squirrel Hill Health Center (SHHC), you have certain rights with regard to the information contained therein.
You have the right to:
- Request restriction on uses and disclosures of your health information for other than treatment, payment, and health care operations (TPO, see below). “Health care operations” is defined as activities that are necessary to carry out the operations of the health center, an example of these would be quality assurance audits and provider peer chart reviews. The right to request restriction does not extend to uses or disclosures permitted or required under subsection §§ 164.502(a)(2)(i) (disclosures of your information to you); subsection §§ 164.510(a) (for facility directories, such as your provider’s schedule; but note, you have the right to object to such cases); or subsection §§ 164.512 (uses and disclosures required by law, such as mandatory communicable disease reporting), in these cases, you do not have the right to request restriction. The Consent you have signed allowing us to use and disclose your individually identifiable health information provides you the ability to request a restriction. We do not, however, have to agree to the restriction. If we do grant the restriction, however, we will adhere to it unless you request otherwise or we give you advance notice. You may also ask us to communicate with you by alternate means and, if the method of communication is reasonable, we must grant the alternate communication request (we currently do not advocate the use of unsecured email communication). Again see the Consent
- Request restriction on disclosure of PHI to health plans for items/services for which you have paid in-full out of pocket. We must abide by your request not to disclose this type of information unless for treatment purposes or if the disclosure is required by law.
- Obtain a copy of this notice of information practices and provide us with a signed receipt of receiving this notice. Although we have posted a copy in prominent locations throughout our facilities and on our website, you have the right to a paper copy upon request.
- Inspect and copy your health information upon request, and receive a response within 30 days (with one 30 day extension), in a format that is readily reproducible, including electronic formats. Again, your right is not absolute. In certain situations, such as if access would cause harm, we can deny access. You do not have a right of access to the following:
- Mental Health or Psychotherapy notes. Such notes comprise those that are recorded in any medium by a health care professional who is a mental health professional documenting or analyzing a conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of your medical record.
- However, SHHC may not disclose mental health or psychotherapy notes without your authorization.
- Information compiled in reasonable anticipation of or for use in civil, criminal, or administrative actions or proceedings.
- PHI (protected health information) that is subject to the Clinical Laboratory Improvement Amendments of 1988 (“CLIA”), 42 U.S.C. § 263a, to the extent that the provision of access to the individual would be prohibited by law.
- Information was obtained from someone other than a health care professional under the promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.
- In other situations, the provider may deny you access but, if the provider does, the provider must provide you with a review of the decision denying access. These “reviewable” grounds for denial include:
- Licensed healthcare professional has determined, in the exercise of professional judgment, that the access is reasonably likely to endanger the life or physical safety of the individual or another person.
- PHI makes reference to another person (other than a healthcare provider) and a licensed healthcare provider has determined, in the exercise of professional judgment, that the access is reasonably likely to cause harm to such other person.
- The request is made by the individual’s personal representative and a licensed healthcare professional has determined, in the exercise of professional judgment, that providing access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.
For these reviewable grounds, another licensed professional must review the decision of the provider denying access within 60 days. If we deny you access, we will explain why and what your rights are, including how to seek review. If we grant access, we will tell you what, if anything, you have to do to get access.
We reserve the right to charge a reasonable, cost-based fee for making copies.
- Request to amend or correct your health information. We do not have to grant the request if:
- We did not create the record. If, as in the case of a consultation report from another provider, we did not create the record, we cannot know whether it is accurate or not. Thus, in such cases you must seek, amendment or correction from the provider that created the record. If they amend or correct the record, we will put the corrected record in our records.
- The records are not available to you as discussed above.
- The record is accurate and complete.
If we deny your request for amending or correcting your record, we will notify you as to why. We will explain how you can attach a statement of disagreement to your record (which we may rebut), and how you can complain.
If we grant your request to amend or correct your record, the amendment or correction will become part of your permanent record and we will identify within our system those who will need the amendment or correct and distribute it accordingly. If there are others you feel need a copy of the amendment or correction, that are outside our system, with your authorization we will provide it to them.
- Obtain an accounting of “non-routine” uses and disclosures (those other than for Treatment, Payment, and Healthcare Operations [TPO] to individuals of protected health information. We do not need to provide an accounting for:
- The facility directory or to person involved in the individual’s care or other notification purposes as provided in § 164.510 (uses and disclosures requiring an opportunity for the individual to agree or to object, including notification to family members, personal representatives, or other persons responsible for the care of the individual, of the individual’s location, general condition, or death).
- For national security or intelligence purposes under § 164.512(k)(2) (disclosures not requiring consent, authorization, or opportunity to object, see chapter 16)
- To correctional institutions or law enforcement officials under § 164.512(k)(5) (disclosures not requiring consent, authorization, or an opportunity to object).
- Disclosures that happened prior to April 14, 2003.
- We must provide the accounting within 60 days. The accounting will include:
- Date of disclosure.
- Name and address of the organization or person who received the protected health information (PHI).
- Brief description of the information disclosed.
- Brief statement of the purpose of the disclosure that reasonably informs you of the basis for the disclosure, or, in lieu of such statement, a copy of your written authorization, or a copy of the written request for disclosure.
The first accounting in any 12 month period is free. Thereafter, we reserve the right to charge a reasonable, cost based fee.
- Revoke your consent or authorization to use or disclose protected health information (PHI) except to the extent that we have already taken action in reliance on the consent or authorization.
SHHC must obtain your authorization before the following may occur:
- Use or disclosure of PHI pertaining to psychotherapy notes
- Use or disclosure of PHI for marketing or fundraising purposes
- Any disclosures which constitute sale of PHI