Privacy Long Version

\
NOTICE OF PRIVACY PRACTICES
(also referred to as “The Notice” or “NPP”)

THIS INFORMATION SHEET IS DESIGNED TO HELP YOU UNDERSTAND HOW
MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND WHAT
YOUR PRIVACY RIGHTS ARE. PLEASE REVIEW IT CAREFULLY.

The Health Insurance Portability & Accountability Act of 1996, or HIPAA, as it is called, is a federal government regulation that is designed to regulate how medical records and other “individually identifiable health information” (IIHI) may be used or disclosed by any health care provider. Health care organizations throughout the country are changing the ways they conduct business in order to insure these guidelines are met.

One part of restructuring is to provide our clients with this Notice of Privacy Practice, which outlines how we are going about this process. Thriving Families Counseling is a trade name and not a functioning business entity. Disclosure of information is the responsibility of your specific therapist. Whenever the word ‘we’ or ‘us’ is used in this Notice, we mean your specific therapist, who is a “health care entity” subject to HIPAA.

There is no legal relationship, partnership, or otherwise among the various therapists at this practice. The privacy rule focuses on implementing effective policies, procedures, and business service agreements to control the access and use of health information. One of the main objectives of HIPAA is to protect the disclosure of any health information about patients that can identify them specifically.

Definitions that are important in understanding the HIPAA rules.
1. “Health information” (HI) is any information that is oral or recorded in any form, which is created or used by health care professionals or health care entities.

2. “Individually identifiable health information” (IIHI) is a subset of HI that either identifies the individual or can be used to identify the individual.

3. “Protected health information” (PHI) is any individually identifiable health information that is transmitted or maintained by the provider in any form or medium. PHI is information that relates to the past, present or future physical or mental health condition of an individual, the provision of health care to that individual, or the past, present or future payment for the provision of health care to an individual, and that identifies that individual or could reasonably be used to identify the individual.

4. “Psychotherapy notes” are recorded notes in any medium created by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session, and that are separated from the rest of the individual’s medical record. Any “psychotherapy notes” we maintain ARE NOT part of your “medical record” and are for the use of the originating therapist only. We may deny you access to these.

“Psychotherapy notes” are created, kept, viewed, and used only by your individual therapist. Only your individual therapist participates in copying and disclosures of “psychotherapy notes.”

Routine progress notes” ARE part of your “medical record” and you may request access to and disclosure of this “protected health information”, which includes session start/stop times, medication monitoring, modalities and frequencies of services provided, results of clinical tests, diagnoses, functional status, treatment plan, symptoms, prognosis, and progress to date.

5. “Payment” means activities we undertake to obtain reimbursement for your care. Examples include our billing and collection activities, or providing information about your care to an insurance company and/or managed care organization that may be covering all or part of the cost of your services.

6. “Health care operations” means activities such as but not limited to assessing the quality of our services and client outcomes, reviewing the competence or qualifications of our staff or students, arranging for our legal, accounting and similar services, and business planning, development, and administrative activities of this practice. For example, we might compile overall statistics about clients who come to our group and their treatment outcomes. We would do so only in aggregate (not individually identifiable) form. This information would be used for internal purposes.

7. “Treatment” means providing, coordinating, or managing your care and related services, including but not limited to: managing your care with a third party; consulting with other health care providers relating to your care; receiving a referral from another health care provider to us for your care; or our making a referral for your care to another health care provider. An example might be if we provide information about your care to a physician who is involved in your care.

8. Business Associates. There are some jobs that the practice might hire other businesses to do for them. Relationships with these individuals are called “Business Associates” in the law. Examples may include a copy service that is used to make copies of your health record, or some other professional. These “Business Associates” need to receive some of your PHI to do their jobs properly. To protect your privacy, they have agreed in their contract with us to safeguard your information.

In general, we may not use or disclose “protected health information (PHI)” except:
a. To you
b. With your written consent to carry out treatment, payments or health care operations. Your signed acknowledgment that you have received this Notice of Privacy Practices acknowledges your consent to carry out these operations.
c. When you authorize release of specific information to specific individuals or agencies, for specific purposes. You would indicate this by a separate signed authorization form.

Item “c” above applies particularly to “psychotherapy notes”, which may not be used or disclosed without your specific written authorization, except:
a. For internal use – solely by your individual therapist
b. For use by students, trainees, or practitioners in mental health who are under supervision of your therapist, or
c. By us to defend legal action or other proceeding brought by you

The privacy rule applies to PHI only. Health information that does not identify an individual and provides no reasonable basis to believe that that information can be used to identify a person is NOT considered PHI. You may request access to and disclosure of the “Protected Health Information (PHI)” in your “medical record” at any time.

HIPAA gives you, our client, significant rights about understanding and controlling how your protected health information is used. By receiving this notice, you acknowledge your understanding that your healthcare provider and his/her business associates may use and disclose information in your records for treatment, payment, and healthcare operations with these terms as defined above in Item One. You have the following rights with respect to your protected PHI, which you can exercise by presenting a written request to your provider:

1. The right to request restriction on certain uses and disclosures of PHI, including those related to disclosures to family members, other relatives, close personal friends, or any other identified by you. However, we are not required to agree to a requested restriction. If we do agree to the restriction, we must abide by it, unless you agree in writing to remove it.
2. The right to reasonable requests for receiving confidential communications of protected health information from us, by alternative means, or at alternative locations.
3. The right to restrict certain disclosures of PHI to a health plan when you pay out-of-pocket for services.
4. The right to be notified if: (a) there is a breach (a use or disclosure of your PHI in violation of the HIPAA Privacy Rule) involving your PHI; (b) that PHI has not been encrypted to government standards; and (c) a risk assessment by your therapist fails to determine that there is a low probability that your PHI has been compromised.
5. The right to inspect and copy your protected health information.
6. The right to amend your protected health information.
7. The right to receive an accounting of disclosures of your protected health information (not the actual PHI, itself).
8. The right to obtain a paper copy of this notice from us, upon request.

When you consent, we may automatically and without limit use or disclose otherwise protected information, in order to conduct health care and payment operations, as well as to contact you to provide appointment reminders or clarification. By acknowledging your receipt of this Notice, you acknowledge consent to perform these operations. If you do not agree, or wish to impose restrictions, you must make this known to your therapist. Otherwise, your full consent is implied and assumed.
You do have the right to request restrictions on the use of or disclosures of your “Protected Health Information (PHI)”, including carrying out treatment, payment, or health care operations, as well as our use of information at times when we ordinarily use the information without your specific consent, including:
a. Maintaining a directory of clients at this practice which includes your name
b. Responding to emergencies or disaster relief efforts and
c. Communicating to a family member, other relative, or close personal friend of yours or any person identified by you, such information that is directly relevant to that person’s involvement in your care, or payment related to your care, or information about your location, general condition, or if you die.

If you are present or otherwise available to consent to a use or disclosure of your information in any of these circumstances, we may use the information if we obtain your agreement, provided that you do have the opportunity to object and you do not object, or that we reasonably infer from the circumstances that you do not object. We may contact you to provide appointment information or confirmation, as well as information about treatment alternatives, health related benefits, or services that may be of interest to you. We may use and disclose PHI to reschedule or remind you of appointments for treatment or other care. If you want us to call or write to you only at your home or your work, or prefer some other way to reach you, you must disclose this to us in advance. Just tell us in writing, using the form we will provide to you upon request. We may routinely create and use protected healthcare information for treatment, payment, and health care operations. Any other uses and disclosures of PHI will be made only with your written authorization. You may revoke such authorization in writing. We are required to honor and abide by your written request except to the extent that we have already taken actions relying on your past authorization. You have the right to request restrictions on our use or disclosure of PHI. Forms are available for this purpose. We are not required to agree to every restriction you request.

We are required to disclose “Protected Health Information (PHI)” to you, when your request meets the requirements of a proper request, and to the Secretary of Health and Human Services, when required to investigate or determine our compliance with these regulations. We have a specific form to be used for your written authorization to use or disclose specific aspects of your PHI. Ask your therapist for this form, if you want specific information disclosed to you or to another person. You can also call or write to your therapist at this practice, if you want to authorize disclosure after you have finished with your treatment here.

NOTE: It is our policy, our preference, and our customary practice, for the purpose of protecting your privacy, when we disclose information to sources outside the practice, to make reasonable efforts to limit the disclosure to the minimum information necessary to accomplish the purpose of the use, disclosure, or request.

There are uses and disclosures of PHI from your records that do NOT require your consent or authorization. The laws let us use and disclose some of your PHI without your consent or authorization, in certain cases. These include the following:

To Prevent a Serious Threat to Health or Safety

If we come to believe that there is a serious threat to your health or safety, or a serious threat to the health and safety of another person, or to the general public, we can disclose some of your PHI. We will only do this to persons who can prevent the danger. If you are not present or available or the opportunity to agree or object cannot practicably be provided because of an emergency or because of your actual, suspected, or alleged incapacity, we may disclose without your consent to the person involved in your health care, ONLY the protected health information as directly relevant to that person’s involvement.

For treatment
Your PHI may be used and disclosed by those who are involved in your care for the purpose of providing, coordinating, or managing your health care treatment and related services. This includes consultation with clinical supervisors or other treatment team members. We may disclose PHI to any other consultant only with your authorization.

For Payment
We may use and disclose PHI so that we can receive payment for the treatment services provided to you. This will only be done with your authorization. Examples of payment-related activities are: making a determination of eligibility or coverage for insurance benefits, processing claims with your insurance company, reviewing services provided to you to determine medical necessity, or undertaking utilization review activities. If it becomes necessary to use collection processes due to lack of payment for services, we will only disclose the minimum amount of PHI necessary for purposes of collection.

For Health Care Operations

We may use or disclose, as needed, your PHI in order to support our business activities including, but not limited to, quality assessment activities, employee review activities, licensing, and conducting or arranging for other business activities. For example, we may share your PHI with third parties that perform various business activities (e.g., billing or typing services) provided we have a written contract with the business that requires it to safeguard the privacy of your PHI. For training or teaching purposes PHI will be disclosed only with your authorization.

When Required by Law
There are some federal, state, or local laws which require us to disclose PHI. These include, but are not limited to, the following:
a. We have to report suspected child and adult abuse
b. If you are involved in a law suit or legal proceedings, and we receive a subpoena, discovery request, or other lawful process, we may have to release some of your PHI. We will only do so after trying to tell you about the request, consulting your lawyer, or possibly trying to obtain a court order to protect disclosure of the information that has been requested of us.
c. We have to release (disclose) some information to the government agencies for the purpose of investigating or determining compliance with the requirements of the Privacy Rule.

Child Abuse or Neglect
We may disclose your PHI to a state or local agency that is authorized by law to receive reports of child abuse or neglect.

Deceased Patients
We may disclose PHI regarding deceased patients as mandated by state law, or to a family member or friend that was involved in your care or payment for care prior to death, based on your prior consent. A release of information regarding deceased patients may be limited to an executor or administrator of a deceased person’s estate or the person identified as next-of-kin. PHI of persons that have been deceased for more than fifty (50) years is not protected under HIPAA.

Relating to Decedents
We might disclose PHI to coroners, medical examiners or funeral directors, and to organizations relating to organ, eye, or tissue donations or transplants.

Medical Emergencies
We may use or disclose your PHI in a medical emergency situation to medical personnel only in order to prevent serious harm. We will try to provide you a copy of this notice as soon as reasonably practicable after the resolution of the emergency.

Family Involvement in Care
We may disclose information to close family members or friends directly involved in your treatment based on your consent or as necessary to prevent serious harm.

Verbal Permission
We may also use or disclose your information to family members that are directly involved in your treatment with your verbal permission.

Law Enforcement
We may disclose PHI to a law enforcement official as required by law, in compliance with a subpoena (with your written consent), court order, administrative order or similar document, for the purpose of identifying a suspect, material witness or missing person, in connection with the victim of a crime, in connection with a deceased person, in connection with the reporting of a crime in an emergency, or in connection with a crime on the premises.

Health Oversight
If required, we may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies and organizations that provide financial assistance to the program (such as third-party payors based on your prior consent) and peer review organizations performing utilization and quality control.

Specialized Government Functions
We may review requests from U.S. military command authorities if you have served as a member of the armed forces, authorized officials for national security and intelligence reasons and to the Department of State for medical suitability determinations, and disclose your PHI based on your written consent, mandatory disclosure laws and the need to prevent serious harm.

Public Health
If required, we may use or disclose your PHI for mandatory public health activities to a public health authority authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, or if directed by a public health authority, to a government agency that is collaborating with that public health authority.
· Public Safety

We may disclose your PHI if necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. If information is disclosed to prevent or lessen a serious threat it will be disclosed to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.
· Research

PHI may only be disclosed after a special approval process or with your authorization.

You have the right to inspect and to receive a copy of your health information except for:
a. Psychotherapy notes
b. Information compiled in reasonable anticipation of or for use in, a civil, criminal, or administrative action or proceeding.

We may charge a reasonable, cost-based fee for copies. If your records are maintained electronically, you may also request an electronic copy of your PHI. You may also request that a copy of your PHI be provided to another person.
In rare circumstances, we may deny you access to PHI, if:
a. We have determined that access is reasonably likely to endanger your life or physical safety or someone else’s life or physical safety.
b. The information refers to another person and we have determined that access requested is reasonably likely to cause substantial harm to that other person.
c. The request is made by your personal representatives and we have determined that providing the information to that representative is reasonably likely to cause that person or another person substantial harm.
Except for these exclusions, the situations in which we deny you access to PHI without an opportunity to review the denial are rare and unlikely to occur or apply.

If you feel that the PHI we have about you is incorrect or incomplete, you may ask us to amend the information although we are not required to agree to the amendment. If we deny your request for amendment, you have the right to file a statement of disagreement with us. We may prepare a rebuttal to your statement and will provide you with a copy. Please contact your therapist if you have any questions.

You have the right to request a restriction or limitation on the use or disclosure of your PHI for treatment, payment, or health care operations. We are not required to agree to your request unless the request is to restrict disclosure of PHI to a health plan for purposes of carrying out payment or health care operations, and the PHI pertains to a health care item or service that you paid for out of pocket. In that case, we are required to honor your request for a restriction.
We can share some information about you with your family or close other persons. We will only share information with those actually involved in your care and anyone else you choose, such as close friends or clergy. You may tell us whom you want us to tell, what information about your condition or treatment. You can tell us what you want, and we will honor your wishes, as long as it is not against the law.

If it is an emergency – and therefore, we cannot ask if you disagree – we can share information if we believe that it is what you would have wanted and if we believe it will help you if we do share it. However, if we do share information, in an emergency, we will tell you as soon as we can. If you do not approve, we will stop, as long as it is not against the law, and as long as it does not pose a serious threat to health or safety.

You have the right to request an accounting of disclosures of your PHI.
When we disclose your PHI, we keep some records of whom we sent it to, when we send it, and what we sent. You can get an accounting (list) of many of these disclosures. This does not include the actual PHI which was disclosed. We may charge you a reasonable fee if you request more than one accounting in any 12-month period.
I
You have the right to request that we communicate with you about health matters in a certain way or at a certain location. We will accommodate reasonable requests. We may require information regarding how payment will be handled or specification of an alternative address or other method of contact as a condition for accommodating your request. We will not ask you for an explanation of why you are making the request.

When we become aware of or suspect a breach, your therapist will conduct a risk assessment. Your therapist will keep a written record of that risk assessment. Unless the therapist determines that there is a low probability that PHI has been compromised, the therapist will give notice of the breach. The risk assessment can be done by a business associate if it was involved in the breach. While the business associate will conduct a risk assessment of a breach of PHI in its control, the therapist will provide any required notices to patients and Health and Human Services. After any breach, particularly one that requires notice, the therapist will re-assess its privacy and Notice of Privacy Practices security practices to determine what changes should be made to prevent the re-occurrence of such breaches.

You have the right to receive a paper copy of this “NPP.” It is available, upon request, from your therapist.

If you need more information or have questions about the privacy practices described above,
please speak with your therapist. If you have a problem with how your PHI has been handled, or if you believe that your privacy rights have been violated, contact your =therapist.
You have the right to file a complaint with your therapist and with the Secretary of the Federal Department of Health and Human Services at 200 Independence Avenue, S.W., Washington, D.C. 20201. We promise you that we will not in any way limit your care here or take any actions against you, if you complain, although we appreciate your contacting us before you submit your complaint, so that we have an opportunity to respond to you.
The effective date of this notice is September 2013. It will remain in effect, as is, until amended