 |
|
 |
|||||||||||
|
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)
POLICIES AND PROCEDURE MANUAL A. INTRODUCTION This policies and procedures manual is based on the Health Insurance Portability and Accountability Act (HIPAA) that was signed into law in 1996. At its inception, HIPAA called for the creation of national standards and requirements for the electronic transmission of health information and forms. In conjunction with HIPAA’s new standards for the transmission of health information, the Department of Health and Human Services (HHS), anticipating concerns about the privacy of electronic communication, developed a separate Privacy Rule related to client records. GMUPC is in compliance with the HIPAA Privacy Rule (compliance date: 04/14/03). Along with HIPAA, Therapists must follow certain standards with regard to client information. B. DEFINITIONS There are technical definitions that are a part of the Privacy Rule. Knowledge of these definitions will help understand the application of the Privacy Rule to the GMUPC chart protocol. They are as follows: Protected Health Information (PHI): PHI is (with certain exceptions) individually identifiable health information regarding the client. Based on our current chart structure this would include the Contact sheet, Intake sheet, Intake Summary, Progress Notes, Discharge Summary, Authorization for Services, correspondence, Psychological Evaluation reports, etc. Importantly for purposes of the Privacy Rule, PHI includes information about the session, the modalities and frequencies of treatment provided, results of clinical measures and tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date. These types of information typically constitute GMUPC intake, progress, and discharge reports or summaries. Psychotherapy Notes: Psychotherapy notes are considered a special subset of PHI and the Privacy Rule provides a higher level of protection for these notes. Psychotherapy notes mean notes recorded (in any medium) by the Therapist documenting or analyzing the contents of a conversation with a client(s) during an individual, group, joint, or family session and are separated from the client’s GMUPC chart. These types of notes are typically referred to as “process notes”. It is strongly recommended that a Therapist refrain from Psychotherapy Notes and follow the protocol for PHI-type progress notes described in the previous paragraph. Use: Use means the sharing, employment, application, utilization, examination, or analysis of individually identifiable health information within the GMUPC. Disclosure: Disclosure means the release, transfer, provision of access to, or divulging in any other manner, of information outside the GMUPC. Consent: Consent is a written description, explanation, and permission regarding necessary aspects of healthcare including treatment, record keeping, fees, and transmission of information. Authorization: Authorization is written permission above and beyond general consent that addresses only specific disclosures for a limited period. Covered Entities: Other health care providers including health plans (e.g., Medicaid), health care clearinghouses, and business associates (e.g., Cashier’s office of GMU). C. USES AND DISCLOSURES OF PHI REQUIRING CONSENT The Therapist must obtain client consent before disclosing PHI for treatment, payment, and healthcare operations. This consent referred to as the Notice of Privacy Practices (see Appendix A) must be obtained prior to the conducting the initial session. In most cases, the client will read it and sign an Acknowledgement of Receipt (see Appendix B) prior to the Therapist meeting with the client. Further description of treatment, payment, and healthcare operations is provided below: 1. Treatment: Treatment means the provision, coordination, or management of health care and related services by the Therapist and Supervisor, including the coordination or management of health care by the Therapist and Supervisor within the practicum team setting; consultation between the Therapist and Supervisor relating to a client; the coordination or management of health care by the Therapist and Supervisor with a third party; or the referral of a client for health care from the GMUPC to another health care provider. 2. Payment: Payment means when the GMUPC obtains reimbursement for the provision of health care or the client receives reimbursement from his/her insurance company for services provided by the GMUPC yet paid directly to the GMUPC by the client. 3. Health care operations: Health care operations mean activities that relate to the performance or operation of the GMUPC. The following are examples of health care operations: conducting quality assessment and improvement activities, including chart reviews, outcomes evaluations, and development of clinical guidelines, (provided that the obtaining of generalized knowledge is not the primary purpose of any studies resulting from such activities); population-based activities relating to improving health; protocol development, case management and care coordination; business related matters such as administrative services; contacting of health care providers and clients with information about treatment alternatives; and related functions that do not include treatment. This consent is referred to as the Notice of GMUPC Privacy Practices (see Appendix A) and the client must sign an Acknowledgement of Receipt (see Appendix B) prior to the first session. D. MINIMUM NECESSARY REQUIREMENT REGARDING PHI When using, disclosing, or requesting PHI, the Therapist must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. This requirement also applies to covered entities that request the client’s records and require such entities meet the standard, as required by law. The minimum necessary requirement does not apply to disclosures for treatment purposes or when the Therapist shares information with a client. The requirement does not apply for uses and disclosures when client authorization is given. It does not apply for uses and disclosures as required by law or to uses and disclosures that are required for compliance with the Privacy Rule. When a third party requests copies of records, their request must: (i) Be in writing, dated and signed by the requester; (ii) identify the nature of the information requested; (iii) include evidence of the authority of the requester to receive such copies and identification of the person to whom the information is to be disclosed. Within fifteen days of receipt of the request, the Therapist must do one of the following: (i) Furnish the requested copies to any requester authorized to receive them. (ii) Inform the requester if the information does not exist or cannot be found. (iii) If the Therapist does not maintain a record of the information, so inform the requester and provide the name and address, if known, of the provider who maintains the record. (iv) Deny the request on the grounds that the requester has not established his or her authority to receive such records or proof of his or her identity, or deny the request as otherwise provided by law. For routine requests of PHI by an outside party the following guidelines for the minimum necessary requirement are provided. In order of priority, the Therapist provides a: (i) Copy of the Discharge Information Form. (ii) Discharge Summary. (iii) Written summary of dates of service, purpose of treatment, treatment modality, diagnosis, and progress to date (iv) A copy of Intake Report. The Therapist should consult with their Supervisor and/or Clinic Director prior to release of any PHI in order to best ensure compliance with the minimum necessary requirement. The Therapist must review with their Supervisor and/or Clinic Director regarding all non-routine (e.g., court orders) requests for PHI and clearly document the review. All disclosures of PHI to an outside party must be documented in the client’s chart as to when, to whom, address of outside party, description of information disclosed, and for what purpose the information was disclosed. The Therapist should employ the Accounting for Disclosures Form (see Appendix C) for such documentation. When a Therapist requests PHI from outside agencies or resources, the request must: (i) Be in writing, dated and signed by the Client and a witness. (ii) Identify the exact nature of the information requested. (iii) State the purpose of the needed information. The Therapist should limit their request for PHI to the minimum necessary information needed to accomplish the intended purpose of the disclosure of PHI. The Therapist should consult their Supervisor and/or Clinic Director to ensure compliance with the minimum necessary requirement regarding Therapist’s requests for PHI. The Therapist should use the GMUPC Authorization for Release of Information form (see Appendix D). The Therapist and GMUPC staff may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary, for the stated purpose, if the PHI is requested by another covered entity, by a public official (who represents that the information requested is the minimum necessary), or by a researcher with appropriate documentation. The Therapist and GMUPC staff may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose, if another member of the GMUPC staff or University affiliated department (e.g., Accounts Receivable, Internal Audit and Management, Legal Counsel, etc.) requests the PHI. The Therapist or GMUPC staff member should not use, disclose, or request an entire medical/health/psychological record, except when the entire record is justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure, or request. For purposes of their duties and to ensure reasonable operation of clinic procedures, the Clinic Director and GMUPC support staff have access to all PHI of all clients. The student Therapists and Clinical Supervisors have access to PHI of their assigned clients and are required to seek permission to review PHI of other GMUPC clients. E. USES AND DISCLOSURES OF PHI WITHOUT CONSENT Although state law does not require consent for the particular disclosures listed below, it is GMUPC policy that the Therapist obtains client consent for such disclosures. As such, this consent is a part of the general consent contained in the GMUPC Consent for Services agreement. The consent for Notice of GMUPC Privacy Practices is not required in the following circumstances: 1. Where necessary in connection with the client’s care by the Therapist and Supervisor. 2. Where disclosure is reasonably necessary to establish or collect the fee. 3. When a client has requested the GMUPC to submit information to a third-party payor (e.g., an insurer) for the client to receive reimbursement for payment under an insurance policy covering the client, the client is deemed to have consented to the disclosure of the following information to the third-party payor. In such situations, the GMUPC may provide the following information: a) The client's name and the contract or policy number; b) the date the client began receiving services; c) the date of onset of the client’s symptoms or problems; d) the date the client’s services were terminated, if known; e) the diagnosis, with brief information substantiating the diagnosis; f) a brief description of the services provided such client, including type of therapy, and number of hours spent in treatment; g) functional status of the client; h) the client’s relationship to the contract subscriber or policyholder. 4. Where disclosure is necessary for the Therapist and/or Supervisor to arrange for legal services to enforce or defend the Therapist and/or Supervisor's legal rights (e.g., revealing the name of the client who is suing to a potential defense attorney so that the attorney can check for conflicts of interest). 5. Where the disclosure is necessary for the GMUPC’s quality assessment and improvement activities; certain performance evaluation, enhancement or training activities; or health care fraud and abuse detection or University compliance. When a third party requests copies of records under Paragraphs 1, 2, 4, and 5 above, their request must be: (i) In writing, dated and signed by the requester. (ii) Identify the nature of the information requested. (iii) Include evidence of the authority of the requester to receive such copies and identification of the person to whom the information is to be disclosed. Within fifteen days of receipt of the request, the Therapist must do one of the following: (i) Furnish the requested copies to any requester authorized to receive them. (ii) Inform the requester if the information does not exist or cannot be found. (iii) If the Therapist does not maintain a record of the information, so inform the requester and provide the name and address, if known, of the provider who maintains the record. (iv) Or deny the request on the grounds that the requester has not established his or her authority to receive such records or proof of his or her identity, or deny the request as otherwise provided by law. F. USES AND DISCLOSURES OF PHI REQUIRING AUTHORIZATION Consent and authorization are different. Authorization gives the GMUPC permission to disclose specific PHI to a third party specified by the client. This is typically referred to as a release of information (see Appendix D). It is specific written permission beyond the consent for services and consent of privacy practices already obtained. For example, information to a school cannot be released without client authorization. 1. For uses and disclosures of PHI other than treatment, payment, or health care operations, the Therapist must obtain client authorization, unless otherwise permitted or required by law (as described below in Section G "Uses and Disclosures of PHI with Neither Consent nor Authorization"). 2. Psychotherapy Notes: Any use or disclosure of psychotherapy notes requires an authorization with certain exceptions. The exceptions to authorizations are: i. When carrying out the following treatment, payment, or health care operations: a. use by the Therapist who created the psychotherapy notes for treatment; b. use or disclosure by the Therapist for training purposes(in which student training is learning under supervision to practice or improve their skills); or c. use or disclosure by the Therapist to defend himself/herself in a legal action or any other proceeding brought by the patient; and ii. The following required or permitted uses or disclosures: a. required by HHS to determine compliance with the Privacy Rule; b. required by law; c. for health oversight activities (including psychology board actions) with respect to the Therapist who created the notes; d. about decedents to coroners and medical examiners, as permitted by state law. While a client may authorize the release of any of his/her PHI, the Privacy Rule specifically requires client authorization for the release of Psychotherapy Notes. Psychotherapy Notes authorization is different from client consent or authorization of other PHI. As defined by the Privacy Rule, “Psychotherapy Notes” means “notes recorded (in any medium) by a mental health professional, documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separate from the rest of the individual’s medical record”. It is the policy of the GMUPC that a Therapist NOT write Psychotherapy Notes. If Psychotherapy Notes are necessary, it must receive prior approval from both the Therapist’s Supervisor and the Clinic Director. 3. Revocation of Authorization. A client may revoke his/her authorization at any time, provided that the revocation is in writing. Exceptions include:i) The Therapist has taken action in reliance on the authorization. ii) If the authorization was obtained as a condition to obtaining insurance coverage, and other law provides the insurer with the right to contest a claim under the policy. G. USES AND DISLOSURES OF PHI WITH NEITHER CONSENT NOR AUTHORIZATION The following are situations in which the Therapist or authorized GMUPC staff may release PHI to a third party without consent or authorization. 1. Child Abuse Reporting: If a Therapist has reason to suspect that a child is abused or neglected, shall report the matter immediately to the local department of the county or city wherein the child resides, or wherein the abuse or neglect is believed to have occurred, or where it was discovered, or to the Department of Social Services' toll-free child abuse and neglect hotline. Therapists required to report suspected abuse or neglect shall cooperate with the investigating agency and shall make related information, records and reports available to the investigating agency. Any Therapist who makes a report or provides records or information pursuant to the child abuse reporting law, or who testifies in any judicial proceeding arising from such report, records, or information, shall be immune from any civil or criminal liability or administrative penalty or sanction on account of such report, records, information or testimony, unless the Therapist acted in bad faith or with malicious purpose. 2. Adult and Domestic Abuse Reporting: Any Therapist who has reason to suspect that an adult is abused, neglected or exploited shall make a report immediately (but no later than 24 hours) either orally or in writing to the local Department of Welfare or Social Services of the county or city where the adult resides or where the abuse is believed to have occurred or where it was discovered. The report must include all information, including records or reports documenting the basis for suspicion. With regard to suspected sexual abuse, the report must be made to the local law enforcement agency where the adult resides or where the sexual abuse is believed to have occurred, or where the abuse was discovered. The Therapist making the report shall disclose and, on request, make available to the law enforcement agency, all information forming the basis of the report. Informing the client: A Therapist who makes a disclosure regarding adult or domestic abuse must promptly inform the client that such a report has been or will be made except if: i. The Therapist in the exercise of his or her professional judgment believes informing the client would place the client at risk of serious harm; or ii. The Therapist would be informing a personal representative and the Therapist reasonably believes the personal representative is responsible for the abuse, neglect or other injury and that informing the personal representative would not be in the client's best interest as determined by the psychologist in the exercise of professional judgment. 3. Health Oversight Activities (State Psychology Boards): The Board of Psychology or its designee may, and on request of any party to a case shall issue subpoenas requiring testimony or the production of physical or other evidence as part of its investigative and adjudicative proceedings. 4. Judicial and Administrative Proceedings: If a client is involved in a court proceeding and a request is made for information about his or her diagnosis and treatment and the records thereof, such information is privileged under state law, and the Therapist must not release information without the written authorization of the client or the client's legal representative, a subpoena (see next paragraph), or a court order. The privilege does not apply when the client is being evaluated for a third party or where the evaluation is court ordered. The Therapist will inform the client in advance if this is the case. The Therapist must receive consultation and document consultation from their Supervisor regarding any judicial proceedings. Where a party serves a Therapist or Supervisor with a subpoena for a client's records, that party must simultaneously provide a copy of the subpoena to the client (or his/her attorney), along with the attached notice. NOTICE TO CLIENT The attached document means that (insert name of party requesting or causing issuance of the subpoena) has either asked the court to issue a subpoena or a subpoena has been issued by the other party's attorney to your doctor or other health care providers (names of health care providers inserted here) requiring them to produce your medical records. Your doctor or other health care provider is required to respond by providing a copy of your medical records. If you believe your records should not be disclosed and object to their disclosure, you have the right to file a motion with the clerk of the court to quash the subpoena. You may contact the clerk's office to determine the requirements that must be satisfied when filing a motion to quash and you may elect to contact an attorney to represent your interest. If you elect to file a motion to quash, it must be filed as soon as possible before the provider sends out the records in response to the subpoena. If you elect to file a motion to quash, you must notify your doctor or other health care provider(s) that you are filing the motion so that the provider knows to send the records to the clerk of court in a sealed envelope or package for safekeeping while your motion is decided. The subpoena must also contain the following notice to the Therapist and/or Supervisor (in boldfaced capital letters): NOTICE TO PROVIDERS IF YOU RECEIVE NOTICE THAT YOUR PATIENT HAS FILED A MOTION TO QUASH (OBJECTING TO) THIS SUBPOENA, OR IF YOU FILE A MOTION TO QUASH THIS SUBPOENA, SEND THE RECORDS ONLY TO THE CLERK OF THE COURT WHICH ISSUED THE SUBPOENA OR IN WHICH THE ACTION IS PENDING AS SHOWN ON THE SUBPOENA USING THE FOLLOWING PROCEDURE: PLACE THE RECORDS IN A SEALED ENVELOPE AND ATTACH TO THE SEALED ENVELOPE A COVER LETTER TO THE CLERK OF COURT WHICH STATES THAT CONFIDENTIAL HEALTH CARE RECORDS ARE ENCLOSED AND ARE TO BE HELD UNDER SEAL PENDING THE COURT'S RULING ON THE MOTION TO QUASH THE SUBPOENA. THE SEALED ENVELOPE AND THE COVER LETTER SHALL BE PLACED IN AN OUTER ENVELOPE OR PACKAGE FOR TRANSMITTAL TO THE COURT. Therapists shall provide a copy of all records as required by a subpoena or court order for such medical records. If the Therapist has, however, actual receipt of notice that a motion to quash (object to) the subpoena has been filed or if the Therapist files a motion to quash the subpoena, then he or she shall produce the records to the clerk of the court issuing the subpoena or in whose court the action is pending. The court then places the records under seal until the court decides the motion to quash. 5. Serious Threat to Health or Safety: A Therapist has a duty to take precautions to protect third parties from violent behavior or other serious harm only when the client has orally, in writing, or via sign language, communicated to the Therapist a specific and immediate threat to cause serious bodily injury or death to an identified or readily identifiable person or persons, if the Therapist reasonably believes, or should believe according to the standards of his or her profession, that the client has the intent and ability to carry out that threat immediately or imminently. If the third party is a child, the Therapist also has a duty to take precautions to protect the child if the client threatens to engage in behaviors that would constitute physical abuse or sexual abuse. The duty to protect does not attach unless the client has communicated the threat to the Therapist while the Therapist is engaged in his or her professional duties. A Therapist who takes one or more of the following discharges the duty actions: (i) Seeks civil commitment of the client. (ii) Makes reasonable attempts to warn the potential victims, or the parent or guardian if the potential victim is under the age of 18. (iii) Makes reasonable efforts to notify a law enforcement official having jurisdiction in the client's or potential victim's place of residence or place of work, or place of work of the parent or guardian if the potential victim is under age 18, or both. 6. Worker's Compensation: Any Therapist treating a client who has filed a workers' compensation claim shall, upon request of the client, employer, insurer, or a certified rehabilitation provider, or of any representative thereof, furnish a copy of any psychological evaluation report to the client, employer, insurer, or a certified rehabilitation provider or any representative thereof, or to each of them, upon request for such report. 7. National Security: Any Therapist may be required to disclose to military authorities the health information of Armed Forces personnel under certain circumstances. The Therapist may be required to disclose to authorized federal officials health information required for lawful intelligence, counterintelligence, and other national security activities. The Therapist may be required to disclose health information to a correctional institution or law enforcement official having lawful custody of protected health information of an inmate or patient under certain circumstances. 8. Research: Under certain limited circumstances, the GMUPC may use and disclose health information for research purposes. All research projects, however, required prior approval by an institutional review board. H. CLIENTS’ RIGHTS TO NOTICE As required under the Privacy Rule, and in accordance with state law, the GMUPC provides notice to clients of the uses and disclosures that may be made regarding their PHI and the Therapists’ duties and client rights with respect to notice (see Appendix A). The GMUPC will make a good faith effort to obtain written acknowledgement that a client receives this notice. If the client refuses or is unable to acknowledge receipt of notice, then the Therapist must document why acknowledgement was not obtained. A client has a right to obtain a paper copy of the notice of the GMUPC's privacy practices upon request, even if the client has agreed to receive the notice electronically. The client is provided notice on the first date of treatment. The client will be given one copy and a signed copy will be in the client’s chart. If an emergency situation, notice is provided as soon as reasonably practicable. The GMUPC Director will promptly revise and distribute notice whenever there is a material change to uses and disclosures, client’s rights, Therapists’ legal duties, or other privacy practices stated in the notice. The GMUPC Notice of Privacy Practices is available to any client to take with them and the Notice is posted in a clear and prominent location. I. CLIENTS' RIGHTS TO REQUEST RESTRICTIONS A client has the right to request restrictions on the uses or disclosures of PHI about the client to carry out treatment, payment, and health care operations; however, the Therapist is not required to accept the requested restrictions. The client can make such a request either orally or in written form and the Therapist must document the request. Once the request is made and received by the Therapist, the Therapist must consult with their Supervisor to determine whether to agree with or deny the restriction. The Therapist and/or Supervisor can receive further consultation from the GMUPC Director. A Therapist who agrees to a restriction may not use or disclose PHI in violation of such restriction, except that, if the client who requested the restriction is in need of emergency treatment and the restricted PHI is needed to provide the emergency treatment, the Therapist may use the restricted PHI, or may disclose such information to another health professional, to provide such treatment to the client. If restricted PHI is disclosed to a psychologist for emergency treatment, the Therapist must request that such psychologist not further use or disclose the information. A restriction agreed to by a Therapist must not prevent uses or disclosures permitted or required by the Privacy Rule. A Therapist, in consultation with his/her Supervisor, may terminate his/her agreement to a restriction, if: (i) The client agrees to or requests the termination in writing. (ii) The client orally agrees to the termination and the oral agreement is documented. (iii) The Therapist informs the client that he/she is terminating his/her agreement to a restriction, except that such termination is only effective with respect to PHI created or received after the Therapist has so informed the client. The GMUPC must maintain a written record of any such restriction, denial or termination. The GMUPC must retain this record for six years from the date of its creation or the date when it last was in effect, whichever is later. J. CLIENT’S RIGHTS TO RECEIVE CONFIDENTIAL COMMUNICAITON BY ALTERNATIVE MEANS AND AT ALTERNATIVE LOCATIONS A Therapist must permit clients to request and receive communications of PHI from the Therapist by alternative means or at alternative locations. A Therapist must accommodate reasonable requests by clients (e.g. a client may request that bills not be sent to his home). K. CLIENT’S RIGHTS TO INSPECT AND COPY RECORDS 1. General right: A Therapist must permit a client to request access to inspect and to obtain a copy of PHI about the client (other than psychotherapy notes) in a designated record set for as long as the PHI is maintained in the record, unless: (i) A Therapist and/or Supervisor have determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the client. (ii) The request for access is made by the client's personal representative and the Therapist and/or Supervisor has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to the client. Clients may inspect and copy psychotherapy notes unless the Therapist reasonably determines that the information does not exist or cannot be found; or that furnishing the review of the information requested by the client would be injurious to the patient's health or well being. Documents prepared for litigation at the request of an attorney should be assumed to be covered by the state attorney-client privilege and should not be included in the client's record or released to anyone without consulting with the attorney who requested it. Other documents prepared for litigation may be released to the client if the provider chooses to do so. A Therapist may be able to withhold these documents from a client if state law permits it. Before withholding these documents, Therapists and Supervisors are advised to check with university counsel. The client can make a request to inspect and copy records either orally or in written form and the Therapist must document the request. Once the request is made and received by the Therapist, the Therapist must consult with their Supervisor to determine whether to agree with or deny the request. The Therapist and/or Supervisor can receive further consultation from the GMUPC Director. 2. Timely response by the Therapist: Within 15 days of receipt of a request for copies of records, the Therapist shall do one of the following: (i) Furnish such copies to any requester authorized to receive them. (ii) Inform the requester if the information does not exist or cannot be found. (iii) If the GMUPC does not maintain a record of the information, so inform the requester and provide the name and address, if known, of who maintains the record. (iv) Deny the request: (a) That release of the information would be injurious to the health and well being of client. (b) On the ground that the requester has not established his/her authority to receive such records or proof of his identity. (c) As otherwise provided by law. If the Therapist denies the request, in whole or in part, he/she must provide the client with a written denial within 30 days. However, if the Therapist is unable to provide the denial within that time, the Therapist may extend the time only once by no more than 30 days. If the Therapist does extend the time, he/she must still (within the original time limits) provide the client with a written statement of the reasons for the delay and the date by which the Therapist will provide the denial. 3. Allowing inspection and/or copying: The Therapist must provide the access requested by clients, including inspection or obtaining a copy, or both, of the PHI regarding them in designated client charts. 4. Providing access in the form or format the client requests: The Therapist must provide the client with access to the PHI in the form or format requested by the client, if it is readily producible in such form or format. If the PHI is not readily producible in such form or format, it may be produced in a readable hard copy form or such other form or format as agreed to by the Therapist and the client. The Therapist may provide the client with a summary of the PHI requested (in lieu of access to the PHI) or may provide an explanation of the PHI only if the client agrees in advance to the summary or explanation and the fees imposed, if any, by the GMUPC. 5. Convenient time and manner of access: The Therapist must provide the access as requested by the client in a timely manner, including arranging with the client for a convenient time and place to inspect or obtain a copy of the PHI, or mailing the copy of the PHI at the client's request. The Therapist may discuss the scope, format and other aspects of the request for access with the patient as necessary to facilitate the timely provision of access. 6. Fees: If the client requests a copy of the PHI, or agrees to a summary or explanation of the PHI, the Therapist in consultation with the Director may impose a reasonable, cost-based fee, provided that the fee includes only the cost of copying, including the cost of supplies for and labor of copying, postage, and preparing an explanation or summary of the PHI if the fees are agreed to by the client. 7. Reviewable grounds for denial of client access: A Therapist may deny a client access to his/her PHI (other than psychotherapy notes) in the following circumstances: (i) A Therapist has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the client. (ii) The request for access is made by the client's personal representative and the Therapist has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to the client. 8. Right to review a denial of access: If the Therapist/Supervisor denies a request on the grounds of potential injury to the client, the Therapist shall permit examination and copying of the client record by an Clinical Supervisor selected by the client, whose licensure, training and experience relative to the client's condition are at least equivalent to that of the clinical Supervisor upon whose opinion the denial is based. 9. Process for review of denial: The Therapist/Supervisor denying the request shall inform the client of the client's right to select another reviewing Clinical Supervisor who shall make a judgment as to whether to make the record available to the client. A statement shall accompany any record copied for review by the Clinical Supervisor selected by the client from the Therapist or the custodian of the records that the client's Therapist and/or Supervisor determined that the client's review of his/her record would be injurious to the client's health or well being. 10. Therapist's duties after denying access: If the Therapist denies access in whole or in part to PHI, the Therapist must comply with the following requirements: (i) To the extent possible, the Therapist must give the client access to any other PHI requested (after excluding the PHI for which the Therapist has a ground to deny access). (ii) The Therapist must provide a timely written denial to the client. (iii) The denial must be in plain language and contain the following: a. The basis for the denial. b. A statement of the client's review rights, including a description of how the client may exercise their review rights or complain. c. A description of how the client may complain to the Therapist, Supervisor, GMUPC Director or to the Secretary of Health and Human Services (a Therapist must document all complaints received and their disposition, if any). The description must include: the name, or title, and telephone number of the contact person or office designated to received such complaints. (iv) The Therapist does not maintain the requested PHI, and know where it is maintained, the Therapist must inform the client where to direct the request for access. 11. Documentation: A Therapist must document the titles of the persons or offices responsible for receiving and processing requests for access by clients and the designated record sets that are subject to access by clients. Designated Record Set means a group of records maintained by or for a GMUPC that is the following: (i) The health records and billing records about clients maintained by GMUPC; (ii) Used, in whole or in part by or for the client to make decisions about clients. The GMUPC must maintain a written or electronic record of any such documentation. The GMUPC must retain this record for six years from the date of its creation or the date when it last was in effect, whichever is later. L. CLIENT’S RIGHTS TO AMEND RECORDS1. Client's general right to amend: A client has the right to have a Therapist amend PHI about the client in a designated chart for as long as the PHI is maintained in the chart. The client can make a request to amend records either orally or in written form and the Therapist must document the request. Once the request is made and received by the Therapist, the Therapist must consult with their Supervisor to determine whether to agree with or deny the request. The Therapist and/or Supervisor can receive further consultation from the GMUPC Director. 2. Timely Action by the Therapist: (i) The Therapist must act on the client's request for an amendment no later than 60 days after receipt of such a request. (ii) If the Therapist is unable to act on the request for amendment within that time, he/she can take a one-time only extension of no more than 30 days. Within the 60-day time frame, the Therapist must provide the requester with a written statement of the reasons for the delay and the date for completing action on the request. 3. Accepting the amendment: If the Therapist accepts the requested amendment in whole or in part, he/she must comply with the following requirements: (i) Make the appropriate amendment to the PHI or record that is the subject of the request for amendment by, at minimum, identifying the records in the chart that are affected by the amendment and appending or otherwise providing a link to the amendment. (ii) Timely inform the client that the amendment is accepted and have the client identify the relevant persons with whom the Therapist may share the amendment, and agree to have the Therapist notify such persons. (iii) Make reasonable efforts to inform and provide the amendment within a reasonable time to: a. Those persons identified by the Therapist as having received PHI about the client and needing the amendment. b. Persons, including business associates, that the Therapist knows have the PHI that is the subject of the amendment and that may have relied, or could foreseeably rely on such information to the client's detriment. 4. Acting on notices of the amendment: A Therapist who is informed by another Covered Entity of an amendment to a client's PHI must amend the PHI in designated record sets. 5. Documentation: A Therapist must document the titles of the persons responsible for receiving and processing requests for amendments by clients. The GMUPC must maintain a written or electronic record of any such documentation for six years from the date of its creation or the date when it was last in effect, whichever is later. 6. Denial of amendment: The Therapist may deny the request if he/she determines that the PHI or record that is the subject of the request: (i) Was not created by the Therapist (unless the client provides a reasonable basis to believe that the originator of the PHI is no longer available to act on the requested amendment). (ii) Is not part of the designated chart. (iii) Would not be available for inspection under the Right to Inspect and Copy provision. (iv) Is accurate and complete. If the Therapist and/or Supervisor deny the requested amendment in whole or in part, the Therapist must comply with the following requirements: (i) Written Denial in which the Therapist must provide the client with a timely written denial and the denial must be: (a) In plain language; (b) contain the basis for the denial; (c) contain a statement of the client's right to submit a written statement disagreeing with the denial; (d) how the client may file such a statement; (e) a statement that, if the client does not submit a statement of disagreement, the client may request that the Therapist provide the client's request for amendment and the denial with any future disclosures of the PHI that is the subject of the amendment; (f) a description of how the client may complain to the Therapist, Supervisor, GMUPC Director pursuant to the complaint procedures or to the Secretary of Health and Human Services; (g) The description must include the name or title and telephone number of the contact person or office designated to receive such complaints. 7. Statement of Disagreement: The Therapist must permit the client to submit to the Therapist a written statement disagreeing with the denial all or part of a requested amendment and the basis of such disagreement. The Therapist may reasonably limit the length of that statement. 8. Rebuttal Statement: The Therapist may prepare a written rebuttal to the client's statement of disagreement and must provide a copy the rebuttal to the client. 9. Recordkeeping: The Therapist must, as appropriate, identify the record or PHI in the designated record set that is the subject of the disputed amendment and append or otherwise link to the client's request for amendment, the Therapist's denial of the request, the client's statement of disagreement, if any, and the Therapist's rebuttal, if any, to the designated record set. 10. Future Disclosures: If a statement of disagreement has been submitted by the client, the Therapist must include the material appended in accordance with the preceding section ((9) "Recordkeeping"), or, at the election of the Therapist, an accurate summary of any such information, with any subsequent disclosure of the PHI to which the disagreement related. If the client has not submitted a written statement of disagreement, the Therapist must include the client's request for amendment and his/her denial, or an accurate summary of such information, with any subsequent disclosure of the PHI only if the client has requested such action in accordance with Section (E). When a subsequent disclosure described in the above two points is 1) made using a "standard transaction" under the HIPAA Transaction Rule (an electronic transmission of any health information to carry out a financial or administrative activity, such as submitting a claim for reimbursement); and 2) that transaction does not permit the additional material to be included with the disclosure, then the Therapist may separately transmit the material required by these above two points as applicable, to the recipient of the standard transaction. M. CLIENT’S RIGHTS TO AN ACCOUNTING OF DISCLOSURES1. General right to accounting of disclosures: A client generally has a right to receive an accounting of disclosures of PHI for which the client has neither provided consent nor authorization (as described above in Section G. "Uses and Disclosures of PHI with Neither Consent nor Authorization"). The Therapist or GMUPC is only required to account for disclosures that occurred within the six years prior to the date of the request for the accounting. A Client may request an accounting of disclosures for a period of time less than six years from the date of the request. 2. Disclosures are not subject to the accounting requirement: (i) For treatment, payment, and health care operations. (ii) Pursuant to the client's authorization. (iii) To the client. (iv) Incidental to permitted or required uses or disclosures (e.g., a client's name is called out in the waiting room and overheard by another person). (v) That occurred prior to the compliance date for the GMUPC. (vi) To correctional institutions or law enforcement officials. (vii)For national security or intelligence purposes. If a health oversight agency or law enforcement official provides the Therapist or GMUPC with a written statement that an accounting to the client would be reasonably likely to impede the agency's activities (and specifying the time for which such a suspension is required), then the Therapist or GMUPC must temporarily suspend an individual's right to receive an accounting of disclosures to a health oversight agency or law enforcement official (for the time specified by such agency or official). If the statement of the health oversight agency or law enforcement official is made orally, the Therapist or GMUPC must: (i) Document the statement, including the identity of the agency or official making the statement. (ii) Temporarily suspend the individual's right to an accounting of disclosures subject to the statement. (iii) Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless the health oversight agency or law enforcement official submits a written statement during that time. The client can request an accounting of disclosures by submitting a request in writing. The request must state the time period for which the accounting is to be supplied, which may not be longer than six years. Once the request is made and received by the Therapist, the Therapist must consult with their Supervisor to determine whether to agree with or deny the request. If services have been terminated and the Office support staff receives the request, then they must consult with the Supervisor of that case. If the Supervisor is unavailable, they must consult with the GMUPC Director. 2. Content of the accounting: The Therapist or GMUPC staff must provide the client with a written accounting that will be sent via postal mail and that meets the following requirements: (i) Except as otherwise provided by section "1." above, the accounting must include disclosures of PHI that occurred during the six years (or such shorter time period at the request of the individual as provided in section "1.iii." above) prior to the date of the request for an accounting, including disclosures to or by business associates of the GMUPC. (ii) The accounting must include for each disclosure: a. The date of the disclosure; b. The name of the entity or person who received the PHI and, if known, the address of such entity or person; c. A brief description of the PHI disclosed; and d. A brief statement of the purpose of the disclosure that reasonably informs the patient of the basis for the disclosure; or, in lieu of such statement: A copy of the client's written authorization; or A copy of a written request for a disclosure, if any. (iii) If, during the period covered by the accounting, the GMUPC has made multiple disclosures of PHI to the same person or entity for a single purpose, or pursuant to a single authorization, the accounting may, with respect to such multiple disclosures, provide: a. The information required by section "2.ii" above, for the first disclosure during the accounting period; b. The frequency, periodicity, or number of the disclosures made during the accounting period; c. The date of the last such disclosure during the accounting period. 3. Providing the accounting: The GMUPC must act on the client's request for an accounting, no later than 60 days after receipt of such a request, as follows. The GMUPC must provide the patient with the accounting requested; or if the covered entity is unable to provide the accounting within 60 days, the covered entity may extend the time to provide the accounting by no more than 30 days, provided that: (i) The GMUPC, within 60 days, provides the client with a written statement of the reasons for the delay and the date by which the GMUPC will provide the accounting. (ii) The GMUPC may have only one such extension of time for action on a request for an accounting. The GMUPC will provide the first accounting to a client in any 12-month period without charge. The GMUPC may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same client within the 12 month period, provided that the GMUPC informs the client in advance of the fee and provides the client with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee. 4. Documentation: The Therapist or GMUPC must document the following: (i) The titles of the persons or offices responsible for receiving and processing requests for an accounting by clients. (ii) The written accounting that is provided to the client. (iii) The information required to be included in an accounting under section "2." above, for disclosures of PHI that are subject to an accounting under section "1.", above. The GMUPC must maintain a written of any such documentation. The GMUPC must retain this record for six years from the date of its creation or the date when it last was in effect, whichever is later. N. THERAPISTS’ AND SUPERVISORS’ DUTIESThe Therapist and GMUPC staff is required to maintain the privacy of PHI and to provide the client with a notice of his/her legal duties and privacy practices with respect to PHI. The GMUPC Director reserves the right to change the privacy policies and practices described in the notice. Unless the GMUPC Director notifies the Therapists and Clinical Supervisors of such changes, however, all Therapists are required to abide by the terms currently in effect. If the GMUPC Director intends to revise his/her policies and procedures, he/she must describe either through written notice, email, or direct training of the revisions to the Student Therapists and Clinical Supervisors. O. COMPLAINTS The privacy of clients’ PHI is critically important for the Therapist’s and the GMUPC’s relationship with clients and the community. The following provides a procedure for a complaint process.
a. In person, either orally or written. b. By mail, in a letter containing the necessary information addressed to the Director. c. By telephone at 703-993-1370. d. By fax at 703-352-0035.
a. The type of infraction the complaint involves b. A detailed description of the privacy issue c. The date the incident or problem occurred, in applicable d. The mailing/email address where formal response to the complaint may be sent.
a. Validate the complaint with the individual. b. If appropriate, attempt to correct any apparent misunderstanding of the policies and procedures on the client’s part; if after clarification, the client does not want to pursue the complaint any further, indicate that “no further action is required.” Record the date and time and file under dismissed complaints. c. If not dismissed, log the complaint by placing a copy of the complaint in both the compliant file and in the client’s record. d. Investigate the complaint by reviewing the circumstances with relevant staff (if applicable). e. If it is determined that the complaint is invalid, send a letter stating the reasons the complaint was found invalid. File a copy of the letter and complaint in an investigated complaints file. f. If the investigative findings are unclear, get a second opinion either from University legal counsel or the APA Practice Organization. g. If it is determined that the complaint is valid and linked to a required process or an individual’s rights, follow the GMUPC sanction policy to the extent that an individual is responsible. If the complaint involves compliance with the standards that do not involve a single individual, then begin the process to revise the current policies and procedures. h. Once an appropriate sanction or action has been taken with respect to a complaint with merit, or if the response will take more than 30 days, send a letter explaining the findings and the associated response or intended response. Document the disposition of the complaint and file the letter and complaint in an investigated complaints file. i. Place a copy of the complaint in the client’s record. j. Review both invalid and investigated complaint file periodically, to determine if there are any emerging patterns. P. PRIVACY SAFEGUARDS The GMUPC must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of PHI. The GMUPC must reasonably safeguard PHI from any intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications or other requirements of the Privacy Rule. All PHI are maintained in client charts or folders (once the client is discharged). The charts are kept in a locked cabinet that is in a locked room. The chart cabinet and chart room are locked. Either the office support staff or GMUPC Director must be present in the GMUPC building for the room and cabinet to be unlocked. No PHI is to leave the GMUPC premises. Q. USES AND DISCLOSURES INVOLVING PERSONAL REPRESENTATIVES 1. Personal Representatives of Adults and Emancipated Minors: Where an incapacitated client has a guardian or legal representative with authority to make health care decisions for the client, the Therapist must treat the guardian or legal representative as the client with respect to PHI that is relevant to and consistent with that individual's representation as authorized by state law (e.g., letting the guardian or legal representative exercise the privacy rights that a client would normally exercise, such as receiving notice, consenting to disclosure, having access to their records, and the right to amend). A Therapist may elect not to treat the guardian or legal representative as the client if: (i) The Therapist has a reasonable belief that: a. The guardian or legal representative has subjected or may subject the client to abuse or neglect; or b. treating the guardian or legal representative as the client could endanger the individual; and (ii) the Therapist decides in the exercise of professional judgment that it is not in the client's best interest to let the guardian or legal representative exercise the client's privacy rights. 2. Personal Representatives of Unemancipated Minors: If a Therapist is treating a child or ward, the Therapist must treat the parent or legal guardian (of the child or ward) as the client with respect to PHI relevant to that representation (letting the parent or guardian exercise the privacy rights that a client would normally exercise, e.g., receiving notice, consenting to disclosure, having access to their records and the right to amend). The Therapist should not treat the parent or guardian as the client when the parent or guardian has specifically agreed to a confidentiality agreement between the minor and the Therapist. In the state of Virginia, minors over the age of 14 have the independent right to consent to treatment. Generally, such laws would also result in the Therapist not being able to disclose the minor's records to the parent or guardian. Consultation with the Supervisor and/or GMUPC Director is recommended in such situations. A Therapist may elect not to treat a parent or guardian as the client if: (i) Therapist has a reasonable belief that: a. The parent or guardian has subjected or may subject the client to abuse or neglect; or b. that treating the parent or guardian as the client could endanger the individual and (ii) the Therapist decides in the exercise of professional judgment that it is not in the client's best interest to let the parent or guardian exercise the client's privacy rights. 3. Personal Representatives of Deceased Patients: The Therapist must treat the personal representative of a deceased client as the client with respect to PHI that is relevant to the representative's representation (letting the personal representative exercise the privacy rights that a patient would normally exercise, e.g., receiving notice, consenting to disclosure, having access to records and the right to amend). A Therapist may elect not to treat the personal representative of a deceased patient as the client if: (i) The Therapist has a reasonable belief that the personal representative has subjected the client to abuse or neglect; and (ii) the Therapist decides in the exercise of professional judgment that it is not in the client's best interest to let the personal representative exercise the client's privacy rights. 4. Verification of Authority of Personal Representatives: In sections "1." "2.," and "3." above, Therapists must verify that the person claiming to be the client's legal representative has the legal authority to represent the client and verify the scope of his/her authority. When in doubt, the Therapist should insist on documentation. The legal representative is only entitled to receive PHI that is relevant to his/her representation (e.g., if a legal representative is only authorized to make decisions regarding a client's cancer treatment, they may only receive PHI relevant to the cancer treatment. They would not need to know about extramarital affairs). If you are uncertain as to the person's authority as a legal representative in general, or are uncertain that the requested PHI is relevant to the person's representation of the client, consult with the GMUPC Director (who may suggest insist that the legal representative obtain a court order). R. PRIVACY OFFICER The Privacy Officer is responsible for all on-going activities related to the development, implementation, maintenance of, and adherence to the GMUPC’s policies and procedures covering the privacy of and access to client’s PHI in compliance with federal and state laws. The following privacy office is the contact person for the GMUPC to receive complaints and fulfill obligations set out in the GMUPC Notice of Privacy given to clients. Privacy Officer: Director, Psychological Services Center Telephone: 703-993-1370 The Privacy Officer’s job description is presented in Appendix E. S. TRAINING The Privacy Officer is responsible for providing or arranging training of all GMUPC staff, Supervisors, and Therapists, as necessary and appropriate to carry our their functions, on the policies and procedures to protect PHI. The Privacy Officer has the discretion to determine the nature and method of training necessary to ensure that staff appropriately protects the privacy of GMUPC clients’ records. The Privacy Officer will train new members of the GMUPC staff within 30 days after starting work at the GMUPC. T. SANCTIONS The Privacy Officer will apply appropriate sanctions against a member of the GMUPC staff who fails to comply with the requirements of the GMUPC’s policies and procedures pertaining to the Privacy Rule. In the case of a Student Therapist, the Privacy Officer will notify the Therapist’s Supervisor of that Therapist’s failure to comply with the requirements of the Privacy Rule or the GMUPC’s policies and procedures. The recommended first step to the first violation is to discuss with that staff member or Therapist what violation occurred and to educate about the correct procedure. A second violation would warrant a warning and remediation, if applicable. A third violation will result in that staff member or Therapist being dismissed from GMUPC activities or practicum training, and return to the GMUPC dependent upon clear evidence of remediation (e.g., demonstrated verbal competency of the Privacy Rule and the GMUPC’s policies and procedures).
Appendix A George Mason University Psychological Clinic
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY, AND SIGN THE ACKNOWLEDGEMENT OF RECEIPT. Protecting Your Personal and Health InformationThe George Mason University Psychological Clinic (GMUPC) is committed to protecting the privacy of client personal and health information. Applicable Federal and State laws require us to maintain the privacy of our clients’ personal and health information. This Notice explains the GMUPC’s privacy practices, our legal duties, and your rights concerning your personal and health information. In this Notice, your personal or protected health information (PHI) is referred to as “health information” and includes information regarding your health care and treatment with identifiable factors such as your name, age, address, income or other personal information. We will follow the privacy practices described in this Notice while it is in effect. This Notice takes effect April 14, 2003 and will remain in effect until replaced.
How We Protect Your Health Information
We protect your health information by: · Treating all of your health information that we collect as confidential. · Stating confidentiality policies and practices in the GMUPC manual, the GMUPC HIPAA Policies and Procedures manual, as well as disciplinary measures for privacy violations. · Restricting access to your health information only to those clinical staff that need to know your health information in order to provide our services to you. · Only disclosing your health information that is necessary for an outside service company to perform its function on the clinic’s behalf and such companies have by contract agreed to protect and maintain the confidentiality of your health information. · Maintaining physical, electronic, and procedural safeguards to comply with federal and state regulations guarding your health information. Uses and Disclosures for Treatment, Payment, and Health Care Operations The GMUPC may use or disclose your protected health information (PHI), for treatment, payment, and health care operations purposes, as long as you consent to receive evaluation or treatment services from the clinic. To help clarify these terms, here are some definitions: § “Treatment, Payment, and Health Care Operations” Treatment is when a therapist provides, coordinates, or manages your health care and other services related to your health care. An example of treatment would be when a therapist consults with a clinical faculty member who has expertise in a clinical problem. Payment is when the GMUPC obtains reimbursement for your healthcare. An example of payment is when the GMUPC discloses your PHI to a health agency such as the Department of Social Services so the GMUPC may obtain reimbursement for your health care. Health Care Operations are activities that relate to the performance and operation of the GMUPC. Examples of health care operations are quality assessment and improvement activities, business-related matters such as audits and administrative services, case management and care coordination, conducting training and educational programs or accreditation activities. § “Use” applies only to activities within the GMUPC such as sharing, employing, applying, utilizing, examining, and analyzing information that identifies you. § “Disclosure” applies to activities outside of the GMUPC, such as releasing, transferring, or providing access to information about you to other parties. Uses and Disclosures Requiring Authorization The GMUPC may use or disclose PHI for purposes outside treatment, payment, or healthcare operations when your appropriate authorization is obtained. An “authorization” is written permission above and beyond the general consent that permits only specific disclosures. In those instances when the GMUPC is asked for information for purposes outside of treatment, payment or healthcare operations, we will obtain an authorization from you before releasing this information. You may revoke all such authorizations at any time, provided each revocation is in writing. You may not revoke an authorization to the extent that the GMUPC has relied on that authorization for your ongoing treatment and/or payment of services. Uses and Disclosures with Neither Consent nor Authorization The GMUPC may use or disclose PHI without your consent or authorization in at least the following circumstances:
| |||||||||||
