ECA HIPAA Policy ECA
(See BCBK, BE, CN, CNA, IDEA and JR et seq.)
The district shall comply with all applicable Health Insurance Portability and Accountability Act (HIPAA) provisions ensuring the confidentiality of protected health information.
Staff Training Required
The district shall provide appropriate and timely professional development activities regarding HIPAA requirements.
All staff shall abide by HIPAA requirements and maintain the confidentiality of protected health information. The district shall provide notice to staff and students as required by law.
Approved: KASB Recommendation – 7/03; 4/07
Adapt regulation for local use, remove from policy book and distribute as necessary.
NOTICE OF PRIVACY PRACTICES
450 District Shawnee Heights, HEALTH INSURANCE PLAN
(referred to as the “Group Health Plan”, “We” “Our” or “Us” in this document)
This notice describes how Protected Health Information (PHI) about You may be used and how You can get access to the information.
PLEASE READ IT CAREFULLY.
PHI is individually identifiable information about You. All of the following are examples of PHI:
- demographic information: Your name, address, social security number and date of birth; or
- medical information: relating to Your past, present or future physical or mental health that is collected/created/received from You, a health care provider, a health plan, employer or health care clearinghouse; or
- the providing of health care; or
- the past, present or future payment for providing health care to You.
OUR LEGAL DUTY
We are required by applicable federal and state laws to maintain the privacy of Your PHI. We are also required to give You this notice about Our privacy practices, Our legal duties, and Your rights concerning Your PHI. We must follow the privacy practices that are described in this notice while it is in effect. This notice takes effect on April 14, 2004 or the date coverage became effective for You, whichever is later, and will remain in effect until We replace it.
We reserve the right to change Our privacy practices and the terms of this notice at any time, provided such changes are permitted by applicable law. We reserve the right to make the changes in Our privacy practices and the new terms of Our notice effective for all PHI that We maintain, including PHI We created or received before We made the changes. Before We make a significant change in Our privacy practices, We will change this notice and send the new notice to Our health plan subscribers at the time of the change.
You may request a copy of Our notice at any time. For more information about Our privacy practices, or for additional copies of this notice, please contact Us using the information listed at the end of this notice.
USES AND DISCLOSURES OF YOUR PHI
We use and disclose PHI about You for treatment, payment and health care operations. For example:
- Treatment: We may disclose Your PHI to a doctor, hospital or other health care provider on request when necessary to assist in Your treatment. For example, We might disclose Your PHI to assist in case managements or precertification activities.
- Payment: We may use and disclose Your PHI to pay claims from doctors, hospitals and other providers for services delivered to You that are covered by Your health plan. For example, We might disclose Your PHI to determine Your eligibility for benefits, to coordinate benefits, to examine medical necessity and to issue explanations of benefits to the person who subscribes to the health plan in which You participate. We may disclose Your PHI to a health care provider or entity subject to the federal Privacy Rules so they can obtain payment or engage in these payment activities.
- Health Care Operations: We may use and disclose Your PHI in connection with Our health care operations. Health care operations include:
- Rating Our risk and determining contributions for Your health plan;
- Quality assessment and improvement activities;
- Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, conducting training programs, accreditation, certification, licensing or credentialing activities
- Medical review, legal services and auditing, including fraud and abuse detection and compliance;
- Business planning and development; and
- Business management and general administrative activities, including management activities relating to privacy, customer service, resolution of internal grievances, and creating de-indentified PHI or a limited data set.
We may disclose Your PHI to another entity which has a relationship with You and is subject to the federal Privacy Rules, for their health care operations relating to quality assessment and improvement activities, reviewing the competence or qualifications of health care professionals, or detecting or preventing health care fraud and abuse.
ON YOUR AUTHORIZATION: You may give a written authorization to use Your PHI to disclose it to anyone for any purpose. If You give Us an authorization, You may revoke it in writing at any time. Your revocation will not affect any use or disclosure permitted by Your authorization while it was in effect. Unless You give Us a written authorization, We cannot use or disclose Your PHI for any reason except those described in this notice.
TO YOUR FAMILY AND FRIENDS: We may disclose Your PHI to a family member, friend or other person to the extent necessary to help with Your health care or with payment for Your health care. We may use or disclose Your name, location and general condition or death to notify or assist in the notification of (including identifying or locating) a person involved in Your care. Before We disclose Your PHI to a person involved in Your health care or payment for Your health care, We will provide You with an opportunity to object to such uses or disclosures. If You are not present, or in the event of Your incapacity or an emergency, We will disclose Your PHI based on Our professional judgment of whether the disclosure would be in Your best interest.
UNDERWRITING: We may receive Your PHI for underwriting, premium rating or other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits. We will not use or further disclose this PHI for any other purpose, except as required by law, unless the contract of health insurance or health benefits is placed with Us. In that case, Our use and Disclosure of Your PHI will only be as described in this notice.
DISASTER RELIEF: We may use or disclose Your PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts.
PUBLIC BENEFIT: We may use or disclose Your PHI as authorized by law for the following purposes deemed to be in the public interest or benefit:
- As required by law;
- For public health activities, including disease and vital statistics reporting, child abuse reporting, FDA oversight, and to employers regarding work-related illness or injury;
- To report adult abuse, neglect or domestic violence;
- To health oversight agencies;
- In response to court and administrative orders and other lawful processes;
- To law enforcement officials pursuant to subpoenas and other lawful processes, concerning crime victims, suspicious deaths, crimes on Our premises, reporting crimes in emergencies and for purposes of identifying or locating a suspect or other person;
- To coroners, medical examiners and funeral directors;
- To organ procurement organizations;
- To avert a serious threat to health or safety;
- In connection with certain research activities;
- To the military and to federal officials for lawful intelligence, counterintelligence and national security activities;
- To correctional institutions regarding inmates; and
- As authorized by state workers compensation laws.
HEALTH RELATED SERVICES: We may use Your PHI to contact You with information about health-related benefits and services or about treatment alternatives that may be of interest to You. We may disclose Your PHI to a business associate to assist Us in these activities. We may use or disclose Your PHI to encourage You to purchase or use a product or service by face-to-face communication or to provide You with promotional gifts.
- Access: You have the right to look at or get copies of Your PHI, with limited exceptions. You may request that We provide copies in a format other than photocopies. We will use the format You request unless We cannot practicably do so. You must make a request in writing to obtain access to Your PHI when You make the request as an exercise of Your HIPAA Privacy rights. Many records are available without making the request as an exercise of HIPAA Privacy rights. You may obtain a form to request access by using the contact information listed at the end of this notice. If You request copies, We will charge You a fee for the costs of copying, other supplies and postage if You want the copies mailed to You and staff time associated with Your request. For information maintained off-site in archival warehouses or that is not reasonably identifi-able and accessible, We will charge the actual cost of the time and other resources required to make the information available. If You request an alternative format, We will charge a cost-based fee for providing Your PHI in that format. If You prefer, We will prepare a summary or an explanation of Your PHI for a fee. Contact Us using the information listed at the end of this notice for a full explanation of Our fee structure.
- Disclosure Accounting: You have the right to receive a list of instances in which We or Our business associates disclosed Your PHI for purposes other than for treatment, payment, health care operations, as authorized by You, and for certain other activities since April 14, 2004 or the date coverage became effective for You, whichever is later. For example, We would account for Your PHI or demographic information We disclose during an audit by a government oversight agency or pursuant to a court order. You must make Your request in writing. We will provide You with the date on which We made a disclosure, the name of the person or entity to whom We disclosed Your PHI, a description of the PHI We disclosed, the reason for the disclosure and certain other information. If You request this accounting more than once in a 12-month period, We may charge You a reasonable, Cost-based, fee for responding to these additional requests. Contact Us using the information listed at the end of this notice for a full explanation of Our fee structure and how to make Your request.
- Restriction: You have the right to request that We place additional restrictions on Our use or disclosure of Your PHI. You must make a request in writing if You wish to request additional restrictions. You may obtain a form to request additional restriction by using the contact information listed at the end of this notice. We are not required to agree to these additional restrictions, but if We do, We will abide by Our agreement (except in an emergency). Both Your request and any agreement to additional restrictions must be in writing signed by the person making the request and (for Our agreement) by a person authorized to make such an agreement on Our behalf. We will not be bound unless Our agreement is so stated in writing.
- Confidential Communications: You have the right to request that We communicate with You about Your PHI by alternative means or to an alternative location. You must make Your request in writing, and You must state that the information could endanger You if it is not communicated in confidence as You request. We must accommodate Your request if it is reasonable, specifies that alternative means or location and continues to permit Us to collect premiums and pay claims under Your health plan, including issuance of explanations of benefits to the subscriber of the health plan in which You participate. An explanation of benefits issued to the subscriber for health care that You received for which You did not request confidential communications or about the subscriber or others covered by the health plan in which You participate may contain sufficient information to reveal that You obtained health care, even though You requested that We communicate with You about that health care in confidence. Other transactions under the membership may also detract from the level of confidentiality You might obtain from an alternate communication or address.
- Amendment: You have the right to request that We amend Your PHI. Your request must be in writing, and it must explain why the information should be amended. If You need information about making a request or amendment, contact Us using the contact information listed at the end of this notice. We may deny Your request if We did not create the information You want amended and the originator remains available or for certain other reasons. If We deny Your request, We will provide You a written explanation. You may respond with a statement of disagreement to be appended to the information You wanted amended. If We accept Your request to amend the information, We will make reasonable efforts to inform others, including giving people Your name, of the amendment and to include the changes in any future disclosures of that information.
- Electronic Notice: If You receive this notice on Our web site or by electronic mail (e-mail), You are entitled to receive this notice in written form. Please contact Us using the information listed at the end of this notice to obtain this notice in written form.
QUESTIONS AND COMPLAINTS
If You want more information about Our privacy practices or have questions or concerns, please contact Us using the information listed below. If You are concerned that We may have violated Your privacy rights, or You disagree with a decision We made about access to Your PHI or in response to a request You made to amend or restrict the use or disclosure of Your PHI or to have Us communicate with You by alternative means or at an alternative location, You may complain to Us using the contact information listed below. You also may submit a written complaint to the U.S. Department of Health and Human Services. We will provide You with the address to file Your complaint with the U.S. Department of Health and Human Services upon request. We support Your right to the privacy of Your PHI. We will not retaliate in any way if You choose to file a complaint with Us or with the U.S. Department of Health and Human Services.
(Request for Amendment Form)
To: ______________________________, the ( ______________ District) privacy official.
I request that the district make the following amendment to protected health information:
I would like the amendment made for the following reason(s):
Note: The reader is encouraged to review policies and/or procedures for related information in this administrative area.
Implemented: (adopt, date) (Revise Date)
(Shawnee Heights District)
Adapt regulation for local use, remove from policy book and distribute as necessary.