|
|
|
|
|
Executive Director
|
Clinical Director HIPAA Privacy Officer |
 |
15127 South 73rd Avenue, Suite G |
Hazel Crest, IL (815) 485-1911
|
POLICIES AND PROCEDURES CHICAGO CHRISTIAN COUNSELING CENTER |
The Department of Health and Human Services has enacted the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule. This law requires health providers to comply with procedures that protect and enhance the work of providers and healthcare networks. It has also mandated privacy standards for those using health services.
The following information details your privacy rights. A shorter version of this document was made available to you at your first session. Please feel free to read this in its entirety. If you wish, you may request a full copy from our office staff or from your therapist. It is also available on line at our website www.chicagochristiancounseling.org.
Use and Disclosure of PHI
Protected Health Information (“PHI”) may not be used or disclosed in violation of the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule (45 C.F.R. parts 160 and 164) (hereinafter, the “Privacy Rule”) or in violation of state law.
Your therapist is permitted, but not mandated, under the Privacy Rule to use and disclose PHI without client consent or authorization in limited circumstances. However, state or federal law may supercede, limit, or prohibit these uses and disclosures.
Under the Privacy Rule, these permitted uses and disclosures include those made:
- To the client
- For treatment, payment, or health care operations purposes, or
- As authorized by the client.
- Reporting on victims of domestic violence or abuse, as required by law
- Court orders
- Workers’ compensation laws
- Serious threats to health or safety
- Government oversight (including disclosures to a public health authority, coroner or medical examiner, military or veterans’ affairs agencies, an agency for national security purposes, law enforcement)
- Health research
- Marketing or fundraising.
Use and Disclosure of PHI—Minimum Necessary Requirement
When using, disclosing or requesting PHI, your therapist will make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. Your therapist recognizes that the requirement also applies to covered entities that request client records and require that such entities meet this same standard, as required by law.
The minimum necessary requirement does not apply to disclosures for treatment purposes or when your therapist shares information with you. The requirement does not apply for uses and disclosures when client authorization is given. It does not apply for uses and disclosures as required by law or to uses and disclosures that are required for compliance with the Privacy Rule.
- Who in your office has access to
PHI? As of April 14, 2003, Chicago Christian Counseling Center has made
every effort to ensure that your personal health information is kept safely
and securely, with the minimum number of personnel having access to that
information. In our agency, your PHI will be available to your therapist, our
secretarial staff, our billing agent, our billing company, and our collection
agency.
- What steps do you take to ensure
compliance with the Minimum Necessary Requirement? Routine PHI can be
released to your insurance carrier, including your demographic information,
your diagnosis and dates of service. An authorization to release additional
information must be signed by you in order to release additional information.
According to law, your insurance provider cannot penalize you for refusing to
authorize the release of further information. Your therapist will provide you
with a form authorizing such a release. This release will be kept available in
your PHI file, and a copy can be given to you for your own records. Your
therapist will go over any information to be released, either to your
insurance carrier or any other entity, before additional information is
released.
- What criteria do you use to limit
disclosure of PHI? Your therapist will make every attempt to disclose the
minimum amount possible in responding to requests for further information.
Your therapist will provide only information that is reasonably necessary to
accomplish the purpose for which the request is made. Any non-routine requests
for disclosure will be reviewed both by you and your therapist prior to your
authorization to release information.
- What happens when you request PHI? You, as the client can receive a copy of your PHI. Your therapist will also limit requests for PHI to the minimum necessary.
- Your therapist may rely, if such reliance
is reasonable under the circumstances, on a requested disclosure as the
minimum necessary for the stated purpose, if the PHI is requested by another
covered entity.
- Your therapist may rely, if such reliance
is reasonable under the circumstances, on a requested disclosure as the
minimum necessary for the stated purpose, if the PHI is requested by a member
of the Chicago Christian Counseling Center staff or business
associate.
- Your therapist will not use, disclose, or request an entire clinical record, except when the entire clinical record is justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure, or request.
Use and Disclosure of
PHI—Psychotherapy Notes Authorization
While a client may authorize the release of any of his PHI, the Privacy Rule specifically requires client authorization for the release of Psychotherapy Notes. Authorization to Release Psychotherapy Notes is different from client consent or authorization of other PHI, because a health plan or other covered entity may not condition treatment, payment, enrollment, or eligibility for benefits on obtaining such authorization.
As defined by the Privacy Rule, “Psychotherapy Notes” means “notes recorded (in any medium) by a mental health professional, documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separate from the rest of the individual’s medical record.” The term “excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.”
Your therapist abides by the Psychotherapy Notes authorization requirement of the Privacy Rule, unless otherwise required by law. In addition, authorization is not required in the following circumstances--
- For your therapist’s use for treatment
- For use or disclosure in supervised training programs where trainees learn to practice counseling
- To defend your therapist in a legal action brought by the client, who is the subject of the PHI
- For purposes of HHS in determining our compliance with the Privacy Rule
- By a health oversight agency for a lawful purpose related to oversight of your therapist’s practice
- To a coroner or medical examiner
- In instances of permissible disclosure related to a serious or imminent threat to the health or safety of a person or the public.
Where are Psychotherapy Notes kept? In accordance with HIPAA regulations, your psychotherapy notes are kept separately from other PHI.
- What is the process you employ to secure a signed authorization form? If you request your therapist to forward any information other than routine insurance information to any one, your therapist will provide you with a written consent form. Authorizations are necessary to provide information to other family members, your physician, your psychiatrist, school or employer personnel, your pastor, another therapist, or, if need be, another therapist to whom you might transfer. Information will only be provided with your authorization, and the form will be presented and discussed during a session or other mutually-agreed upon time. You may also receive a form from our secretarial staff. The specific information you authorize to release will be defined in the authorization form. You might also decide not to authorize a release of information and you are free to communicate that to your therapist who will abide by your decision. A time limit will be established for the authorization that can be revoked, at your request, at any time. These authorizations and revocations will be kept on file with your PHI information.
- What steps do you take to confirm that
you have received a valid authorization? The following points outline key
elements that must be included in a valid authorization as required by the
HIPAA Privacy Rule. A valid authorization—
- Must be completely filled out with no false information.
- May not be combined with another client authorization.
- Must be written in plain language.
- Must contain a statement adequate to put the client on notice of his or her right to revoke the authorization in writing and either exception to such right and a description of how to revoke, or a reference to revocation in the notice provided to the client.
- Must contain a statement adequate to put the client on notice of the inability to condition treatment, payment, enrollment, or eligibility for benefits on the authorization.
- Must contain a statement adequate to put the client on notice of the potential for information to be rediscovered and no longer protected by the rule.
Further, a valid authorization must contain the following information—
- A description of the information to be used and disclosed that identifies the information in a specific and meaningful fashion.
- The name or other specific identification of the person(s), or class of persons, authorized to make the requested use and disclosure.
- The name or other specific identification of the person(s), or class of persons, to whom the requested use and disclosure will be made.
- A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when a client initiates the authorization and does not, or elects not to, provide a statement of the purpose.
- An expiration date that relates to the individual or the purpose of the use or disclosure.
- A signature (or if signed by a personal representative, a description of authority to sign) and date.
- You will be provided with a copy of this authorization as requested.
As required under the Privacy Rule, and in accordance with state law, your therapist provides notice to clients of the uses and disclosures that may be made regarding their PHI and our duties and client rights with respect to notice. Your therapist will make a good faith effort to obtain written acknowledgment that the client receives this notice.
- What is the process you employ to secure
a signed Notice Form from your client? Your therapist provided you with a
shorter Privacy Notice Form on the first day you came for treatment. Your
signature has been kept on file with your PHI indicating that you received
such notice.
- Your therapist will provide notice to the client on the first date of treatment. In an emergency situation, your therapist provides notice “as soon as reasonably practicable.” (This first date of treatment timing requirement applies to electronic service delivery, and a client may request a paper copy of notice when services are electronically delivered.)
- Except in emergency situations, your therapist will make a good faith effort to obtain from a client written acknowledgement of receipt of the notice. If the client refuses or is unable to acknowledge receipt of notice, your therapist will document why acknowledgement was not obtained.
- Your therapist will promptly revise and distribute notice whenever there is a material change to uses and disclosures, client’s rights, your therapist’s legal duties, or other privacy practices stated in the notice.
- Your therapist will make notice available in the Chicago Christian Counseling Center office for clients to take with them and post the notice in a clear and prominent location.
The Privacy Rule permits clients to request restrictions on the use and disclosure of PHI for treatment, payment, and health care operations, or to family members. While your therapist is not required to agree to such restrictions, your therapist will attempt to accommodate a reasonable request. Once he/she has agreed to a restriction, he/she may not violate the restriction; however, restricted PHI may be provided to another health care provider in an emergency treatment situation.
A restriction is not effective to prevent uses and disclosures when a client requests access to his or her records or requests an accounting of disclosures. A restriction is not effective for any uses and disclosures authorized by the client, or for any required or permitted uses recognized by law.
The Privacy Rule also permits clients to request receiving communications from your therapist through alternative means or at alternative locations. As required by the Privacy Rule, your therapist will accommodate all reasonable requests.
- How are requests to restrict the use and
disclosure of information handled?
- Your therapist is not required to accommodate requests to restrict the use and disclosure of information, but once agreed upon, he/she may not violate the agreement.
- Restricted PHI may be provided to another health care provider in an emergency treatment situation.
- A restriction is not effective to prevent uses and disclosures when a client requests access to his or her records or requests an accounting of disclosures.
- A restriction is not effective for any uses and disclosures authorized by the client, or for any required or permitted uses recognized by law.
- Your therapist will want to know if you would like to receive communications (billing notices, phone calls) through alternative means or at alternative locations and will accommodate reasonable requests. Your therapist will not require an explanation for a confidential communication request, and reasonable accommodation may be conditioned on information on how payment will be handled and specification of an alternative address or method of contact.
- What is the process when a client wants to terminate a restriction? If you would like to make any changes in communicating confidential information, or would like contact from your therapist at another location, please contact your therapist and your request swill be noted in writing. If necessary, your signature will be required in order to make the necessary changes.
In accordance with state law, the Privacy Rule, and other federal law, clients have access to and may obtain a copy of the clinical and billing records that your therapist maintains. Clients are also permitted to amend their records in accordance with such law.
You are welcome to discuss changes in your therapist’s written communiqués and material that is sent via your authorization. Information requested by parents from children over 12 must be co-authorized by any child over the age of 12 years. Billing statements and other insurance information would be included.
Client Rights—Accounting of Disclosures
Your therapist can provide clients with an accounting of disclosures you have authorized, for disclosures made up to six years prior to the date of the request. While your therapist may do so, your therapist does not have to provide an accounting for disclosures made for treatment, payment, or health care operation purposes, or pursuant to client authorization. Your therapist is not legally required to provide an accounting for disclosures made for national security purposes, to correctional institutions or law enforcement officers, or those that occurred prior to April 14, 2003.
- How can a client request an accounting of disclosures? Clients may request an account of disclosures by submitting a request in writing. The request must state the time period for which the accounting is to be supplied, which may not be longer than six years. The request must state whether the client wishes to be sent the accounting via postal or electronic mail.
- How do you keep track of, and process,
requests for disclosures? An account of disclosures will be maintained in
your files. Should you require a listing of disclosures, you should be aware
that:
- A written accounting will be provided. For each disclosure in the accounting--the date, name and address (if known) of the entity that received the PHI, a brief description of the PHI disclosed, and a brief statement of the purpose of the disclosure that “reasonably informs” the client of the basis of the disclosure—is provided. In lieu of the statement of purpose, a copy of a written request for disclosure for any of the permitted disclosures in the Privacy Rule or by HHS for compliance purposes may be provided.
- Your therapist will keep a copy of the accounting and include the name of the person who is responsible for receiving and processing accounting requests.
- In addition:
- If multiple disclosures have been made for a single purpose for various permitted disclosures under the Privacy Rule or to HHS for compliance purposes, the accounting also includes the frequency, periodicity, or number of disclosures made and the date of the last disclosure.
- Chicago Christian Counseling Center will provide an accounting within 60 days of a request, and our agency may extend this limit for up to 30 more days by providing the client with a written statement of the reasons for the delay and the date that the accounting will be provided.
- The first accounting is provided without charge. For each subsequent request, Chicago Christian Counseling Center may charge a reasonable, cost-based fee. You will be informed of this fee and be provided with the option to withdraw or modify your request.
- Your therapist must temporarily suspend providing an accounting of disclosures at the request of a health oversight agency or law enforcement official for a time specified by such agency or official. The agency or official should provide a written statement that such an accounting would be “reasonably likely to impede” activities and the amount of time needed for suspension. However, the agency or official statement may be made orally, in which case your therapist will document the statement, temporarily suspend the accounting, and limit the temporary suspension to no longer than 30 days, unless a written statement is submitted.
Chicago Christian Counseling Center relies on certain persons or other entities, who or which are not our employees, to provide services on your therapist’s behalf. These persons or entities may include accountants, lawyers, billing services, and collection agencies. Where these persons or entities perform services, which require the disclosure of individually identifiable health information, they are considered under the Privacy Rule to be business associates.
This agency enters into a written agreement with each of our business associates to obtain satisfactory assurance that the business associate will safeguard the privacy of the PHI of our clients. Chicago Christian Counseling Center relies on our business associates to abide by the contract and will take reasonable steps to remedy any breaches of the agreement that our agency becomes aware of.
- When Chicago Christian Counseling Center
enters into and maintains a business associate contract with any person and
entity that provides services on our behalf, which require the disclosure of
individually identifiable health information, a formal contract is developed
to ensure confidentiality of information. The agreement establishes the uses
and disclosures of PHI to the business associate and prohibits use and further
disclosure, except to the extent that information is needed for the proper
management and administration of the business associate or to carry out its
legal responsibilities. The contract also provides that the business associate
will—
- Use appropriate safeguards to prevent inappropriate use and disclosure, other than provided for in the contract,
- Report any use or disclosure not provided for by its contract of which it becomes aware,
- Ensure that subcontractors agree to the contract’s conditions and restrictions,
- Make records available to clients for inspection and amendment and incorporate amendments as required under the client access and amendment of records requirements of the rule,
- Make information available for an accounting of disclosures,
- Make its internal practices, books, and records relating to the use and disclosure of PHI available to HHS for compliance reviews, and
- At contract termination, if feasible, return or destroy all PHI.
- If Chicago Christian Counseling Center becomes aware of a pattern of activity or practice of a business associate that constitutes a material breach or violation of the agreement, our agency will take reasonable steps to cure the breach. If such steps are unsuccessful, you will terminate the contract, or if termination is not feasible, you will report the problem to HHS.
Chicago Christian Counseling Center has designated a privacy officer, who is responsible for the development and implementation of the policies and procedures to protect PHI, in accordance with the requirements of the Privacy Rule. As the contact person for this practice, the privacy officer receives complaints and fulfills obligations as set out in notice to clients.
The Chicago Christian Counseling Center has appointed Janet Lundgren, Psy.D. as our agency privacy officer.
Privacy Officer Job
Description
The Privacy
Officer is responsible for all ongoing activities related to the development,
implementation, maintenance of, and adherence to the practice’s policies and
procedures covering the privacy of and access to client’s PHI in compliance with
federal and state laws.
The
duties of the Privacy Officer are as follows:
- Develops, implements and maintains the practice’s policies and procedures for protecting individually identifiable health information.
- Conducts ongoing compliance monitoring activities.
- Works to develop and maintain appropriate consent forms, authorization forms, notice of privacy practices, business associate contracts and other documents required under the HIPAA Privacy Rule.
- Ensures compliance with the practice’s privacy policies and procedures and applies sanctions for failure to comply with privacy policies for all members of the practice’s workforce and business associates.
- Establishes and administers a process for receiving, documenting, tracking, investigating and taking action on all complaints concerning the practices privacy policies and procedures.
- Performs all aspects of privacy training for the practice and other appropriate parties. Conducts activities to foster information privacy awareness with the practice and related entities.
- Ensures alignment between security and privacy practices
- Cooperates with the Office of Civil Rights and other legal entities in any compliance reviews or investigations.
As required by the Privacy Rule, the staff of Chicago Christian Counseling Center has been trained, as necessary and appropriate to carry out their functions, on the policies and procedures to protect PHI. Chicago Christian Counseling Center has the discretion to determine the nature and method of training necessary to ensure that staff appropriately protects the privacy of our clients’ records.
The following provides guidance for writing procedures to meet the staff training requirement:
- All members of the Chicago Christian Counseling Center staff have been trained in protecting privacy rights of clients. The training focuses on policies and procedures to protect PHI and other personal information.
- All new members of our staff will be trained within a reasonable time after joining our agency. Chicago Christian Counseling Center will provide training to staff whose function is impacted by a material change in the Privacy Rule within a reasonable time from the effective date of the material change.
To protect the privacy of the PHI of our clients, Chicago Christian Counseling Center will have in place appropriate administrative, technical, and physical safeguards, in accordance with the Privacy Rule.
- Chicago Christian Counseling Center must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of PHI.
- Chicago Christian Counseling Center must reasonably safeguard PHI from any intentional or unintentional use or disclosure that would violate the Privacy Rule.
- Chicago Christian Counseling Center must reasonably safeguard PHI to limit incidental uses or disclosures.
The privacy of our clients’ PHI is critically important for our relationship with our clients and for Chicago Christian Counseling Center. Our agency provides a process for our clients to make complaints concerning our adherence to the requirements of the Privacy Rule.
The following provides a sample procedure for a complaint process.
Procedure for a Complaint Process
- Clients may file privacy complaints by
submitting them in one of the following ways:
- In person, using the Privacy Complaint form
- By mail, either on the Privacy Complaint
form (available from any staff member) or in a letter containing the
necessary information. All complaints should be mailed to:
- Janet Lundgren, Psy.D
Chicago Christian Counseling Center
15127 S. 73rd Avenue Suite G
Orland Park IL 60462 - By telephone at 708-845-5500 extension 108
- By fax at 708-845-5505
- All privacy complaints should be initially shared with your therapist, and if necessary reported to the Privacy Officer if not resolvable with your therapist.
- The complaint must include the following
information:
- The type of infraction the complaint involves
- A detailed description of the privacy issue
- The date the incident or problem occurred, if applicable
- The mailing/email address where formal response to the complaint may be sent.
- When a privacy complaint is filed by a
client the following process should be followed:
- Validate the complaint with the individual.
- If appropriate, attempt to correct any apparent misunderstanding of the policies and procedures on the client’s part; if after clarification, the client does not want to pursue the complaint any further, indicate that “no further action is required.” Record the date and time and file under dismissed complaints.
- If not dismissed, the complaint will be logged by placing a copy of the complaint form in both the complaint file and in the client’s record.
- The complaint will be investigated by reviewing the circumstances with relevant staff (if applicable).
- If it is determined that the complaint is invalid, a letter will be sent to the petitioner stating the reasons the complaint was found invalid. A copy of the letter and form will be filed in an investigated complaints file.
- If the investigative findings are unclear, Chicago Christian Counseling Center will obtain a second opinion either from our lawyer, our malpractice insurance provider, or the therapist’s professional practice organization.
- If it is determined that the complaint is valid and linked to a required process or an individual’s rights, the Chicago Christian Counseling Center will follow the office sanction policy to the extent that an individual is responsible. If the complaint involves compliance with the standards that do not involve a single individual, then our agency will begin the process to revise current policies and procedures.
- Once an appropriate sanction or action has been taken with respect to a complaint with merit, or if the response will take more than 30 days, Chicago Christian Counseling Center will send a letter explaining the findings and the associated response or intended response. The disposition of the complaint will be documented and filed and the letter and form placed in an investigated complaints file.
- A copy of the complaint form will be placed in the client’s record.
- Chicago Christian Counseling Center will review both invalid and investigated complaint files periodically, to determine if there are any emerging patterns.
Chicago Christian Counseling Center has and will apply appropriate sanctions against a member of our staff who fails to comply with the requirements of the Privacy Rule or our policies and procedures. Chicago Christian Counseling Center may not apply sanctions against an individual who is testifying, assisting, or participating in an investigation, compliance review, or other proceeding.
Administrative Requirement—Mitigation
Chicago Christian Counseling Center mitigates, to the extent possible, any harmful effect of unauthorized disclosure or our business associate’s use or disclosure, of PHI in violation of policies and procedures or the requirements of the Privacy Rule.
Administrative Requirement—Retaliatory Action and Waiver of Rights
The Chicago Christian Counseling Center maintains that clients should have the right to exercise their rights under the Privacy Rule. Our agency or the therapists within our agency will not take retaliatory action against a client for exercising his or her rights or for bringing a complaint. Of course, the Chicago Christian Counseling Center will take legal action to protect itself, or our therapists, if we believe that a client undertakes an activity in bad faith.
Chicago Christian Counseling Center will not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against a client for exercising a right, filing a complaint or participating in any other allowable process under the Privacy Rule.
Chicago Christian Counseling Center will not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against a client or other person for filing an HHS compliance complaint, testifying, assisting, or participating in a compliance review, proceeding, or hearing, under the Administrative Simplification provisions of HIPAA.
Chicago Christian Counseling Center will not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against a client or other person for opposing any act or practice made unlawful under the Privacy Rule, provided that the client or other person has a “good faith belief” that the practice is unlawful and the manner of opposition is reasonable and does not involve disclosure of PHI.
Chicago Christian Counseling Center will not require a client to waive his or her rights provided by the Privacy Rule or his or her right to file an HHS compliance complaint as a condition of receiving treatment.
Administrative Requirement—Policies and Procedures
To ensure that Chicago Christian Counseling Center is in compliance with the Privacy Rule, our agency has implemented policies and procedures to ensure compliance with the privacy rule.
- Our policies and procedures are a demonstration of our compliance with the Privacy Rule.
- Chicago Christian Counseling Center will promptly change our policies and procedures that accord with changes to the Privacy Rule. Notice will promptly be provided to clients promptly to reflect the change in policy and procedure, unless the change does not materially affect the notice. The timing of the change in notice and reliance on the change may depend on the terms for such changes in the notice.
Chicago Christian Counseling Center meets applicable state laws and the Privacy Rule’s requirements regarding documentation.
Documentation is required throughout the Privacy Rule to demonstrate implementation of certain requirements. These documentation requirements include those specifically related to: notice, authorization, the minimum necessary standard, and clients’ rights.
- Chicago Christian Counseling Center
procedures include:
- Policies and procedures in written and electronic form.
- All written communication required by the Privacy Rule is maintained (or an electronic copy is maintained) as documentation.
- If an action, activity, or designation is required by the Privacy Rule to be documented, a written or electronic copy is maintained as documentation.
- Documentation is maintained for a period of six years from the date of creation or the date when it last was in effect, whichever is later.
| Respectfully submitted:
Bruce Frens, Executive Director |
Janet Lundgren, Psy.D. Privacy Officer |
|
|
|
|
|
|