Notice of Privacy Practices

 

Policy Purpose

Individuals are entitled to adequate notice of the uses and disclosures of their protected health information, of their rights and the Organization’s responsibilities with respect to PHI unless an exception applies. The Privacy Rule requires Melissa Memorial Hospital (MMH) to describe its privacy practices in plain English, in a document called a Notice of Privacy Practices (“Notice”). MMH must give individuals a copy of this document.

Policy

MMH must timely make its Notice available to all individuals and post the Notice throughout its facilities and on its website. MMH must also make a good faith effort to obtain written acknowledgements from patients that they have received the Notice. The Notice must contain all of the required elements notifying an individual of the permitted uses and disclosures; uses and disclosures that require an opportunity for them to agree or object; uses and disclosures that require an authorization; whether MMH intends to use or disclose information for marketing, facility directories or fundraising; the individual's rights to access, amendment, and limitations on sharing; MMH’s responsibilities; a way to make complaints; contact details for further information; and an effective date.

Procedures

Notice Content Requirements

The Notice shall contain the following content:

1. Header: The Notice must contain this exact language as a header or otherwise prominently displayed:

1. • “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”

1. Uses and Disclosures: This part of the Notice must contain:

• A description, including at least one example, of the types of uses and disclosures of information that MMH is permitted to make for each of the following purposes: treatment, payment, and health care operations;

• A description of each of the other purposes (other than treatment, payment, or health care operations) for which MMH is permitted or required to use or disclose PHI without the individual’s written authorization;

• If a use or disclosure otherwise allowed under the two paragraphs above is materially limited or prohibited by a stricter law, the description of the use or disclosure must reflect the more stringent law;

• The description of the use or disclosures allowed under paragraphs the first two paragraphs above must include sufficient detail to place the individual on notice of the uses and disclosures that are permitted or required by applicable law;

• A description of the types of uses and disclosures that require an authorization including psychotherapy notes, some marketing, sale of protected health care information. Another statement that other uses and disclosures not described in the Notice will be made only with the individual’s written authorization and that the individual may revoke authorization at any time in writing - revocation will be effective except to the extent MMH has acted in reliance on it; and

• If MMH intends to use information in any of the following ways and acts in the capacity of the covered entity mentioned, it must include a separate statement in the Notice for each of the following activities: (i) Covered entity may contact individuals for fundraising activities and the individual has a right to opt out; (ii) a group health plan, health insurance issuer or HMO may share PHI to the plan sponsor; or (iii) a non-long term care health plan may use information for underwriting purposes, excluding the use of genetic information.

1. Individual Rights: The Notice must contain a statement of the individual’s rights with respect to PHI, and how he or she may exercise the right to:

1. • Request restrictions on certain uses and disclosures of information (the notice must contain a statement that the Organization is not required to agree to all requested restrictions);

1. • Receive confidential communications of PHI;

1. • Inspect and copy their own PHI;

1. • Seek amendment of their own PHI;

1. • Receive an accounting of disclosures of their own PHI; and

1. • Obtain a paper copy of the Notice of Privacy Practices upon request even if an electronic copy has already been provided.
2. Organization’s Duties: The Notice must include statements of the following:

1. • MMH is required by law to maintain the privacy of protected health information, to provide individuals with notice of its legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured PHI;

1. • MMH must abide by the terms of the Notice currently in effect; and

1. • If Melissa Memorial Hospital desires to reserve the right to amend the Notice, the Notice must state that Melissa Memorial Hospital reserves the right to change the terms of its Notice and to make the new Notice provisions effective for all PHI it maintains. This statement must also explain how MMH will provide individuals with a revised Notice.
2. Complaints: The Notice must explain that individuals may file a complaint with MMH and/or the Secretary of HHS if they believe their privacy rights have been violated. A brief description of how to file a complaint with MMH must be included along with a statement that the individual will not be retaliated against for filing a complaint.
3. Contact Information: The Notice must contain the name, or title, and telephone number of a person or office to contact for further information.
4. Effective Date: The Notice must contain an effective date that is not earlier than the date it is published.

Notice Dissemination and Publication Requirements

1. MMH must provide the Notice to individuals no later than the date of the first service delivery by a direct care provider. The Notice may also be given to an individual by e-mail, if the individual agrees to such electronic notice. If MMH knows that the e-mail transmission has failed, it must provide a hard paper copy. If the first service is delivered electronically, MMH must send the notice electronically and contemporaneously with provision of the service.

1. MMH must make the Notice available for individuals to take with them. (When the individual is not physically present, the Notice may be sent by first class mail.)

1. The Notice must be posted in a clear and prominent location where individuals can be reasonably expected to be able to read the Notice.

1. The Notice shall be posted prominently on MMH’s website (if any) and shall be available electronically through the website.

1. If MMH participates in an organized health care arrangement it may comply with the Notice requirements by a joint Notice if it meets the requirements of 45 CFR 520(d).

Special Notice Requirements

1. No Notice is required to be given to inmates who may receive treatment at the MMH facility.

1. In the case of patients who are minors, the Notice should be given to the minor’s parent or guardian.

Optional Elements

1. If MMH elects to limit its use and disclosure beyond the required limitations, it may describe the more limited use and disclosures although it may not limit uses and disclosures required by law or allowed to the individual.

1. MMH must reserve its right to revise its Notice to change its limited uses for any information created or received prior to the revision.

Acknowledgement of Notice of Privacy Practices

1. MMH will make a good faith effort to obtain a written Acknowledgement that the individual received the Notice. If an individual refuses to sign the Acknowledgement, then we will document the good faith efforts taken and the reason why the Acknowledgement was not obtained.

1. A “good faith effort” to obtain written acknowledgment is not required when emergency treatment or stabilization is needed. Additionally, if MMH mails the notice to the correct address even if the individual does not return the acknowledgment form, MMH does not need to make further good faith efforts to obtain a written acknowledgment.

1. In non-emergency situations, MMH will seek to obtain acknowledgement of the Notice during the intake process.

Revisions to the Notice of Privacy Practices

1. MMH must promptly revise and distribute its Notice whenever there is a material change to privacy practices, including practices regarding PHI uses and disclosures, individual’s rights, and Melissa Memorial Hospital's legal duties, or other privacy practices stated in the Notice.

1. MMH must make the revised notice available upon request.

1. MMH must post the Notice in service delivery areas.

1. MMH must post the revised notice on its website.

1. Unless Melissa Memorial Hospital reserved the right to amend its Notice within the previous Notice, it may not make any changes applicable to PHI created or received prior to the effective date of the new Notice.

Record Retention

All versions of the MMH approved Notice of Privacy Practices will be archived and maintained by the Privacy Officer for a period no less than six (6) years from the date of its creation or the date when it was last in effect, whichever is later. Any acknowledgments of receipt or good faith efforts to obtain such acknowledgements must also be retained no less than six (6) years from the date when it was received or the date when it was last in effect, whichever is later.

RELEVANT HIPAA REGULATIONS:

• 45 CFR 164.520 Notice of Privacy Practices for protected health information