HIPAA & Compliance
HIPAA POLICY
1. Purpose and Objective
In compliance with the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191 as amended) (“HIPAA”), Persante Health Care (“Persante”) has adopted the following Health Insurance Portability and Accountability Act Policy (“Policy”) to ensure reasonable protection of Protected Health Information (“PHI”), as defined by the Code of Federal Regulations 45 C.F.R. 160.103. It is the intent of this Policy to act as a supplement to, not a replacement for, other Company Policies.
Persante Health Care – HIPAA Joint Privacy Notice describes how medical information about patients may be used and disclosed and how patients can obtain access to this information. The Persante Compliance Department shall post in relevant locations and have pertinent patients and/or other individuals read it carefully.
2. Introduction
This Joint Notice is being provided to patients on behalf of Persante Health Care and the practitioners with clinical privileges that work at the parent contract Hospital, and/or Persante Health Care, with respect to services provided at the Hospital facilities, and/or Persante Health Care. Persante Health Care understands that patient medical information is private and confidential. Further, Persante Health Care is required by law to maintain the privacy of “protected health information.” “Protected health information” or “PHI” includes any individually identifiable information that Persante Health Care obtain from patients or others that relates to the patient’s past, present or future physical or mental health, the health care patients have received, or payment for patient health care. Persante Health Care will share protected health information with one another, as necessary, to carry out treatment, payment or health care operations relating to the services to be rendered at the Hospital, and/or Persante Health Care facilities.
As required by law, this notice provides patients with information about their rights and Persante Health Care’s legal duties and privacy practices with respect to the privacy of PHI. This notice also discusses the uses and disclosures Persante Health Care will make of patient PHI. Persante Health Care must comply with the provisions of this notice as currently in effect, although Persante Health Care reserve the right to change the terms of this notice from time to time and to make the revised notice effective for all PHI Persante Health Care maintains. Patients can always request a written copy of Persante Health Care’s most current privacy notice from the Admitting office at the Hospital, and/or Persante Health Care’s offices.
3. Permitted Uses and Disclosures
Persante Health Care can use or disclose patient PHI for purposes of treatment, payment and health care operations. For each of these categories of uses and disclosures, Persante Health Care has provided a description and an example below. However at Persante Health Care, not every particular use or disclosure in every category will be listed. Treatment means the provision, coordination or management of patient health care, including consultations between Persante Health Careen health care providers relating to patient care and referrals for health care from one health care provider to another. For example, a doctor treating a patient for a sleep apnea may need to know if that patient has heart conditions because symptoms may affect therapy recommendations. In addition, the doctor may need to contact an additional physician to create the necessary follow-on equipment and compliance regimen appropriate for patient treatment.
Payment means the activities Persante Health Care undertake to obtain reimbursement for the health care provided to patients, including billing, collections, claims management, determinations of eligibility and coverage and other utilization review activities. For example, Persante Health Care may need to provide PHI to a patient’s Third Party Payor to determine whether the proposed course of treatment will be covered or if necessary to obtain payment.
Federal or state law may require Persante Health Care to obtain a written release from patients prior to disclosing certain specially protected PHI for payment purposes, and Persante Health Care will ask patients to sign a release when necessary under applicable law.
Health care operations means the support functions of the Hospital, and/or Persante Health Care, related to treatment and payment, such as quality assurance activities, case management, receiving and responding to patient comments and complaints, physician reviews, compliance programs, audits, business planning, development, management and administrative activities. For example, Persante Health Care may use patient PHI to evaluate the performance of Persante Health Care staff when caring for patients. Persante Health Care may also combine PHI about many patients to decide what additional services Persante Health Care should offer, what services are not needed, and whether certain new treatments are effective. Persante Health Care may also disclose PHI for review and learning purposes. In addition, Persante Health Care may remove information that identifies the patient so that others can use the de-identified information to study health care and health care delivery without learning who the patient identity.
4. Other Uses and Disclosures of Protected Health Information
- Persante Health Care may contact patients to provide appointment reminders for treatment or medical care.
- Persante Health Care may contact patients to tell patients about or recommend possible treatment alternatives or other health-related benefits and services that may be of interest to patients.
- Persante Health Care may disclose to patient family or friends or any other individual identified by patients to the extent directly related to such person’s involvement in that patient’s care or the payment for that patient’s care. Persante Health Care may use or disclose patient PHI to notify, or assist in the notification of, a family member, a personal representative, or another person responsible for that patient’s care, of the patient’s location, general condition or death. If the patient is not able, Persante Health Care will give the patient an opportunity to object to these disclosures, and Persante Health Care will not make these disclosures if the patient objects. If the patient is not able, Persante Health Care will determine whether a disclosure to the patient’s family or friends is in the patient’s best interest, taking into account the circumstances and based upon Persante Health Care’s professional judgment.
- Persante Health Care may include certain limited PHI in the Hospital directory. This may include the patient’s name, location in the Hospital, the patient’s general condition (e.g., fair, stable, etc.) and patient religious affiliation. The directory information, except for patient religious affiliation, may be released to people who ask for this patient by name. The patient’s religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they do not ask for this patient by name. The patient may request not to be listed in the directory.
- When permitted by law, Persante Health Care may coordinate their uses and disclosures of PHI with public or private entities authorized by law or by charter to assist in disaster relief efforts.
- Persante Health Care will allow the patient’s family and friends to act on the patient’s behalf to pick up filled prescriptions, medical supplies, X-rays, and similar forms of PHI, when Persante Health Care determines, in their professional judgment, that it is in the patient’s best interest to make such disclosures, and prior authorizations are provided to this effect.
- Persante Health Care may contact patients as part of their fundraising and marketing efforts as permitted by applicable law. Patients have the right to opt out of receiving such fundraising communications.
- Persante Health Care may use or disclose patient PHI for research purposes, subject to the requirements of applicable law. For example, a research project may involve comparisons of the health and recovery of all patients who was studied on a piece of diagnostic equipment or medication treatment method. All research projects are subject to a special approval process which balances research needs with a patient’s need for privacy. When required, Persante Health Care will obtain a written authorization from patients prior to using patient health information for research.
- Persante Health Care will use or disclose PHI about patients when required to do so by applicable law.
5. Special Situations
Subject to the requirements of applicable law, Persante Health Care will make the following uses and disclosures of patient PHI:
● Organ and Tissue Donation.
If the patient is an organ donor, Persante Health Care may release PHI to organizations that handle organ procurement or transplantation as necessary to facilitate organ or tissue donation and transplantation.
● Military and Veterans.
If the patient is a member of the Armed Forces, Persante Health Care may release PHI about the patient as required by military command authorities. Persante Health Care may also release PHI about foreign military personnel to the appropriate foreign military authority.
● Worker’s Compensation.
Persante Health Care may release PHI about patients for programs that provide benefits for work-related injuries or illnesses.
● Public Health Activities.
Persante Health Care may disclose health information about patients for public health activities, including disclosures:
○ to prevent or control disease, injury or disability;
○ to report births and deaths;
○ to report child abuse or neglect;
○ to persons subject to the jurisdiction of the Food and Drug
Administration (FDA) for activities related to the quality, safety, or effectiveness of FDA-regulated products or services and to report reactions to medications or problems with products;
○ to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
○ to notify the appropriate government authority if Persante Health Care believe that an adult patient has been the victim of abuse, neglect or domestic violence. Persante Health Care will only make this disclosure if the patient agrees or when required or authorized by law.
○ Health Oversight Activities. Persante Health Care may disclose PHI to federal or state agencies that oversee Persante Health Care activities (e.g., providing health care, seeking payment, and civil rights).
○ In response to a court order, subpoena, warrant, summons or similar process;
○ To identify or locate a suspect, fugitive, material witness, or missing person;
○ About the victim of a crime under certain limited circumstances; ○ About a death Persante Health Care believe may be the result of criminal conduct;
○ About criminal conduct on Persante Health Care, or relevant business operational premises; or
○ In emergency circumstances, to report a crime, the location of the crime or the victims, or the identity, description or location of the person who committed the crime.
● Lawsuits and Disputes.
limitations. If the patient are involved in a lawsuit or a dispute, Persante Health Care may disclose PHI subject to certain
● Law Enforcement.
Persante Health Care may release health information if asked to do so by a law enforcement official.
● Coroners, Medical Examiners and Funeral Directors.
Persante Health Care may release PHI to a coroner or medical examiner. Persante Health Care may also release PHI about patients to funeral directors as necessary to carry out their duties.
● National Security and Intelligence Activities.
Persante Health Care may release PHI about patients to authorized federal officials for intelligence, counter-intelligence, other national security activities authorized by law or to authorized federal officials so they mayprovide protection to the President or foreign heads of state.
● Inmates.
If the patient is an inmate of a correctional institution or under the custody of a law enforcement official, Persante Health Care may release PHI about patients to the correctional institution or law enforcement official. This release would be necessary (1) to provide the patient with health care; (2) to protect the patient’s health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
● Serious Threats.
As permitted by applicable law and standards of ethical conduct, Persante Health Care may use and disclose PHI if Persante Health Care, in good faith, believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public or is necessary for law enforcement authorities to identify or apprehend an individual.
6. Other Uses of Patient Health Information
Subject to the requirements of applicable law, Persante Health Care will make the following uses and disclosures of patient PHI:
- Organ and Tissue Donation. If the patient is an organ donor, Persante Health Care may release PHI to organizations that handle organ procurement or transplantation as necessary to facilitate organ or tissue donation and transplantation.
- Military and Veterans. If the patient is a member of the Armed Forces, Persante Health Care may release PHI about the patient as required by military command authorities. Persante Health Care may also release PHI about foreign military personnel to the appropriate foreign military authority.
- Worker’s Compensation. Persante Health Care may release PHI about patients for programs that provide benefits for work-related injuries or illnesses.
- Public Health Activities. Persante Health Care may disclose health information about patients for public health activities, including disclosures: ○ to prevent or control disease, injury or disability; ○ to report births and deaths; ○ to report child abuse or neglect:
– to persons subject to the jurisdiction of the Food and Drug Administration (FDA) for activities related to the quality, safety, or effectiveness of FDA-regulated products or services and to report reactions to medications or problems with products;
– To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
– to notify the appropriate government authority if Persante Health Care believe that an adult patient has been the victim of abuse, neglect or domestic violence. Persante Health Care will only make this disclosure if the patient agrees or when required or authorized by law.
-Health Oversight Activities. Persante Health Care may disclose PHI to federal or state agencies that oversee Persante Health Care activities (e.g., providing health care, seeking payment, and civil rights).
- Lawsuits and Disputes. If the patient are involved in a lawsuit or a dispute, Persante Health Care may disclose PHI subject to certain limitations.
- Law Enforcement. Persante Health Care may release health information if asked to do so by a law enforcement official.
- In response to a court order, subpoena, warrant, summons or similar process;
- To identify or locate a suspect, fugitive, material witness, or missing person;
- About the victim of a crime under certain limited circumstances;
- About a death Persante Health Care believe may be the result of criminal conduct;
- About criminal conduct on Persante Health Care, or relevant business operational premises; or
- In emergency circumstances, to report a crime, the location of the crime or the victims, or the identity, description or location of the person who committed the crime.
- Coroners, Medical Examiners and Funeral Directors. Persante Health Care may release PHI to a coroner or medical examiner. Persante Health Care may also release PHI about patients to funeral directors as necessary to carry out their duties.
- National Security and Intelligence Activities. Persante Health Care may release PHI about patients to authorized federal officials for intelligence, counter-intelligence, other national security activities authorized by law or to authorized federal officials so they may provide protection to the President or foreign heads of state.
- Inmates. If the patient is an inmate of a correctional institution or under the custody of a law enforcement official, Persante Health Care may release PHI about patients to the correctional institution or law enforcement official. This release would be necessary (1) to provide the patient with health care; (2) to protect the patient’s health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
- Serious Threats. As permitted by applicable law and standards of ethical conduct, Persante Health Care may use and disclose PHI if Persante Health Care, in good faith, believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public or is necessary for law enforcement authorities to identify or apprehend an individual.
Certain uses and disclosures of PHI will be made only with the patient’s written authorization, including uses and/or disclosures: (a) of psychotherapy notes (where appropriate); (b) for marketing purposes; and (c) that constitute a sale of PHI under the Privacy Rule. Other uses and disclosures of PHI not covered by this notice or the laws that apply to us will be made only with the patient’s written authorization. Patient’s have the right to revoke that authorization at any time, provided that the revocation is in writing, except to the extent that Persante Health Care already has taken action in reliance on the patient’s authorization.
Note: HIV related information, genetic information, alcohol and/or substance abuse records, mental health records and certain special conditions related to minors may enjoy certain special confidentiality protections under applicable State and Federal law. Any disclosures of these types of records will be subject to these special protections.
7. Patient Rights
- 1. Patients have the right to request restrictions on Persante Health Care uses and disclosures of PHI for treatment, payment and health care operations. However, Persante Health Care is not required to agree to the patient’s request. Persante Health Care is, however, required to comply with a patient’s request if it relates to a disclosure to that patient’s health plan regarding health care items or services for which that patient has paid the bill in full. To request a restriction, patients may make Persante Health Care’s request in writing to the Director of Compliance.
- Patients have the right to reasonably request to receive confidential communications of patient PHI by alternative means or at alternative locations. To make such a request, patients may submit their requests in writing to the Director of Compliance.
- Patients have the right to inspect or obtain a copy of the PHI contained in Persante Health Care records, except:
- (i) for psychotherapy notes, (e.g., notes that have been recorded by a mental health professional documenting counseling sessions and have been separated from the rest of the patient’s medical record);
- (ii) for information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding;
- (iii) for PHI involving laboratory tests when a patient’s access is restricted by law;
- (iv) if the patient is a prison inmate, and access would jeopardize their health, safety, security, custody, or rehabilitation or that of other inmates, any officer, employee, or other person at the correctional institution or person responsible for transporting them;
- (v) if Persante Health Care obtained or created PHI as part of a research study, the patient’s access to the PHI may be restricted for as long as the research is in progress, provided that the patient has agreed to the temporary denial of access when consenting to participate in the research;
- (vi) for PHI contained in records kept by a federal agency or contractor when the patient’s access is restricted by law; and
- (vii) for PHI obtained from someone other than Persante Health Care under a promise of confidentiality when the access requested would be reasonably likely to reveal the source of the information. In order to inspect or obtain a copy the patient’s PHI, the patient may submit their request in writing to the Director of Compliance. If the patient requests a copy, Persante Health Care may charge that patient a fee for the costs of copying and mailing those records, as well as other costs associated with that request.
Persante Health Care may also deny a request for access to PHI under certain circumstances if there is a potential for harm to that patient or others. If Persante Health Care denies a request for access for this purpose, the patient maintains the right to have the denial reviewed in accordance with the requirements of applicable law.
4. The patients have the right to request an amendment to their PHI but Persante Health Care may deny their request for amendment if Persante Health Care determines that the PHI or record that is the subject of the request:.
- (i) was not created by Persante Health Care, unless the patient provides a reasonable basis to believe that the originator of PHI is no longer available to act on the requested amendment;
- (ii) is not part of the patient’s medical or billing records or other records used to make decisions about the patient;
- (iii) is not available for inspection as set forth above; or
- (iv) is accurate and complete.
In any event, any agreed upon amendment will be included as an addition to, and not a replacement of, already existing records. In order to request an amendment to the patient’s health information, the patient must submit a request in writing to the Director of Customer Service for Medical Records at Persante Health Care, or Persante Health Care acting as an agent of the hospital, along with a description of the reason for the patient’s request.
5. The patient maintains the right to receive an accounting of disclosures of PHI made by Persante Health Care to individuals or entities other than to the patient for the six years prior to the patient’s request, except for disclosures:
- (i) to carry out treatment, payment and health care operations as provided above;
- (ii) incidental to a use or disclosure otherwise permitted or required by applicable law; (iii) pursuant to the patient’s written authorization;
- (iv) for the Hospital’s directory or to persons involved in the patient’s care or for other notification purposes as provided by law;
- (v) for national security or intelligence purposes as provided by law;
- (vi) to correctional institutions or law enforcement officials as provided by law;
- (vii) as part of a limited data set as provided by law
To request an accounting of disclosures of the patient’s PHI, the patient must submit their request in writing to the Director of Customer Service at Persante Health Care. The patient’s request must state a specific time period for the accounting (e.g., the past three months). The first accounting the patient requests within a twelve (12)-month period will be free. For additional accountings, Persante Health Care may charge that patient for the costs of providing the list. Persante Health Care will notify the patient of the costs involved, and the patient may choose to withdraw or modify their request at that time before any costs are incurred.
6. The patient maintains the right to receive a notification, in the event that there is a breach of the patient’s unsecured PHI, which requires notification under the Privacy Rule.
8. Complaints
If the patient believes that their privacy rights have been violated, the patient should immediately contact the Persante Health Care Compliance Hotline. Persante Health Care will not take action against a patient for filing a complaint. The patient also may file a complaint with the Secretary of the U. S. Department of Health and Human Services.