1. Purpose of Policy

To set forth the rights that Project Open Hand (POH) clients have regarding their Protected Health Information (PHI).

2. Policy

It is the policy of Project Open Hand POH to comply with client rights regarding Protected Health Information (PHI) as set forth in the Health Insurance Portability and Accountability Act of 1996 (HIPAA). 

This policy pertains to all individuals at POH who have access to, use, or disclose PHI, regardless of the POH division or unit. POH divisions or units may enforce stricter authorization requirements for the use or disclosure of PHI than those set forth in this policy.

3. Background 

Expanded consumer control and privacy protections were important concerns for the drafters of the HIPAA Privacy Rule. To this end, individuals have certain rights set forth in the HIPAA Privacy Rule as follows:

3. 1. The right to obtain a written notice explaining how PHI will be used and disclosed.

   2. The right to access and obtain a copy of their medical records.

   3. The right to request an amendment of their PHI.

   4. The right to obtain an accounting of disclosures of their PHI (with limited exceptions).

   5. The right to request that certain information be restricted from use or disclosure for purposes of treatment, payment or health care operations (although HIPAA allows POH to use its discretion in agreeing to such requests).

   6. The right to request restrictions on the manner and method of confidential communications.

Please note that minors enrolled in services are also accorded these rights with respect to the PHI generated during the provision of the services.

4. Procedures

I. RIGHT TO NOTICE OF PRIVACY PRACTICE 

POH shall provide clients with detailed information that describes, in plain language, its privacy practices and an individual’s rights related to his/her PHI.  

A. This Notice of Privacy Practices shall be provided to all current clients. New clients will receive a copy of the Notice at the time of their first visit at a POH site. Clients may receive additional copies of the Notice upon request.

B. POH shall make a good faith effort to obtain a written acknowledgement from the patient that he/she received the notice.

C. The Notice shall also be posted in clear and prominent locations where it is reasonable to expect clients to be able to read it. Additionally, the Notice will be posted and available electronically on the POH web site that contains information about the POH and its services.

D. POH shall revise and distribute its notice whenever there is a material change to the use or disclosures of PHI, individual’s rights, the provider’s legal duties or other privacy practices stated in the notice.

II. RIGHT TO ACCESS AND TO OBTAIN A COPY OF PHI

A. POH shall provide individuals with the right to access and obtain a copy of medical information that is used to make decisions about their care. This may include medical and billing information, but may not include some mental health information.

B. Access to mental health information can be denied if a licensed mental health care professional (physician, psychologist, or master-prepared social worker) has determined, in the exercise of professional judgment, that the access requested is reasonably likely to compromise the mental health or physical treatment of the patient or, if the request involves psychotherapy notes, or will endanger the life or physical safety of the patient.

C. POH sites shall provide access to information even if the information wasn’t created at that site. Thus, if a clinic has copies of medical records created by another clinic, these records shall be provided to the individual upon his/her request. If a POH site does not maintain the requested PHI but knows where the requested information is maintained, it shall inform the individual where to direct his/her request.

D. POH shall provide access only to non-duplicative information. If the same information is kept in more than one designated record set or at more than one location, POH shall produce the information only once per request.

E. POH may charge a reasonable, cost-based fee for providing copies of PHI, including the costs of copying (supplies and labor), postage (if the individual has requested that the PHI be mailed) and preparation of any summary or explanation (if agreed to in advance).

III. RIGHT TO REQUEST AN AMENDMENT OF PHI

A. Requests for amendments must be submitted in writing and provide a reason that supports the request Amendments may be denied under the following circumstances:

1. The PHI was not created by POH (unless the individual provides a reasonable basis to believe that an originator of the PHI external to POH is no longer available to act on the request);

2. The information at issue is not part of the medical information kept by POH;

3. The information is not part of the PHI that the patient would be permitted to access and obtain a copy; or

4. The information is accurate and complete.

B. If a request to amend PHI is denied, the patient shall have the right to submit a written addendum, not to exceed 250 words, with respect to any item or statement that the patient believes is incomplete or incorrect.

C. Upon the patient’s clear written indication, the addendum shall be attached to his/her records and included whenever POH makes a disclosure of the item or the statement that the patient believes to be incomplete or incorrect.

IV. RIGHT TO AN ACCOUNTING OF DISCLOSURES

A. POH shall provide individuals with the right to an accounting of how their PHI has been disclosed (see section IV. C for exceptions).

B. POH shall respond in writing to any requests and include the following in the accounting:

1. Disclosures for the six years prior to the request, unless the individual wants information for a shorter time period;

2. Disclosures made to or by business associates;

3. The date of each disclosure;

4. The name of the person or entity who received the PHI, including an address if possible;

5. A brief description of the information disclosed; and

6. A brief statement of the purpose of the disclosure.

C. Accountings do not need to include disclosures made for the following purposes:

1. To carry out treatment, payment or health care operations or as part of a limited data set;

2. To individuals regarding their own information;

3. Incident to a use or disclosure otherwise permitted or required by HIPAA;

4. Pursuant to an authorization;

5. For use in the facility’s directory;

6. To persons involved in the patient’s care;

7. For notification purposes (e.g. to notify a family member, personal representative or other person of the individual’s location, general condition or death);

8. For national security or intelligence purposes;

9. To correctional facilities or law enforcement officials; or

10. For disclosures made prior to April 14, 2003.

D. POH shall provide the first accounting of disclosures to an individual free of charge. A reasonable, cost-based fee may be charged for each subsequent request for an accounting within the same 12-month period as long as the individual has been informed in advance of the fee and the individual has had the opportunity to withdraw or modify the request.