|
|
NOTICE OF
PRIVACY PRACTICES FOR Effective date: _______________ THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU (OR A PATIENT FOR WHOM YOU ARE A PERSONAL REPRESENTATIVE) MAY BE USED AND DISCLOSED AND HOW TO GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY. If you have any questions regarding this notice, you may contact our privacy officer at: Upper Bucks Orthopaedic Association 215-257-3700 1. Protected health information Upper Bucks Orthopaedic Association (UBOA) is required by law to maintain the privacy of certain health information ("protected health information") and to provide patients with notice of our legal duties and privacy practices with respect to their protected health care information. We are required to abide by the terms of the notice currently in effect. Generally speaking, a patient’s protected health information is any information: Created or maintained by us, That relates to the patient’s past, present or future physical or mental health or condition, the provision of health care to the patient, or payment for health care provided to the patient, and Individually identifies the patient or reasonably can be used to identify the patient. A patient’s medical and billing records at our practice are examples of information that usually will be regarded as protected health information. 2. Patient permission to use protected health information – Consents and authorizations We are required to obtain a patient’s permission to internally use or externally disclose the patient’s protected health information – with limited exceptions. The permission generally must be in the form of a written consent or an authorization. Which applies depends upon the type of the information and the purpose of the disclosure.
Consent We generally need a patient’s written consent to use or disclose the patient’s protected health information for treatment, payment, or health care operations purposes. These purposes are discussed in section 3. We are only required to obtain a patient consent once. Usually, we will obtain patient consent form before a physician-patient relationship and we first see the patient. In certain circumstances, we may use and disclose a patient’s protected health information for treatment, payment, and health care operations without patient consent. Exceptions to the patient consent requirement are made for an emergency, when we are required by law to treat the patient, or when there are substantial communication barriers. We also do not need to obtain a patient’s consent if the patient is a prison inmate or we have only an indirect treatment relationship with the patient, such as if we are only consulting on the patient’s care and do not see the patient. Other exceptions to the patient consent requirement are discussed in section 4. Authorization A patient authorization to use and disclose health information is more detailed and limiting in scope than a patient consent to use and disclose health information for treatment, payment, and health care operation purposes. As a general rule, we are required to obtain a patient’s authorization for uses and disclosures for purposes other than treatment, payment, or health care operations. In addition, certain types of health information are subject to specific disclosure rules, even when the disclosure for a treatment, payment, or health care operations purpose. For example, in certain circumstances, an authorization rather than a patient consent will be required for disclosure of psychotherapy notes or HIV test results and other HIV-related information. Exceptions to the patient authorization requirements are discussed in section 4. 3. Uses and disclosures for treatment, payment, and operations This section describes treatment, payment, and health care operations purposes. The descriptions include examples. Not every possible use or disclosure for treatment, payment, and health care operations purposes will be listed. Some listed examples fall into more than one category – not just the category under which they are listed. Treatment Treatment includes the provision, coordination, or management of health care services to the patient by our practice or one or more other health care providers. Some examples of treatment disclosures include: During an office visit, practice physicians and other staff involved in a patient’s care review the patient’s medical record and share and discuss the patient’s medical information with each other. We share and discuss a patient’s medical information with an outside physician to whom we have referred the patient for care. We share and discuss a patient’s medical information with an outside physician with whom we are consulting regarding the patient. We share and discuss a patient’s medical information with an outside laboratory, radiology center, or other health care facility where we have referred the patient for testing. We share and discuss a patient’s medical information with an outside home health agency, durable medical equipment agency or other health care provider to whom we have referred the patient for health care services and products. We share and discuss a patient’s medical information with a hospital or other health care facility where we are admitting or treating the patient. Payment Payment uses and disclosures include activities to obtain or provide reimbursement of health care to the patient. Some examples include: Sharing information with the patient’s health insurer to determine whether the patient is eligible for coverage or whether proposed treatment is a covered service, Submission of a claim form to the patient’s health insurer, Provision of a bill to a family member or other person designated as responsible for payment for services rendered to the patient, Providing medical records and other documentation to the patient’s health insurer to support the medical necessity of a health service, Allowing a patient’s health insurer access to the patient’s medical record for a medical necessity or quality review audit, Providing information to consumer reporting agencies, Providing information to a collection agency or our attorney for purposes of securing payment of a delinquent account, and Disclosing information in a legal action for purposes of securing payment of a delinquent account. Health care operations Health care operations uses and disclosures are activities conducted to operate the practice. Some examples include: A patient sign-in sheet in the waiting area which is accessible to all patients, Paging patients in the waiting room when it is time for them to go to an examining room, Making appointment reminder calls, including leaving messages with other persons who answer the phone or answering machines, Notification of test results by post cards, Mailing bills in envelopes with our name and return address, Sharing the medical care provided to a patient with our billing staff so that they can bill for the care, Review and analysis of the medical care provided to our patients for purposes of evaluating the quality of care provided by our practice, and Sharing medical information about a patient with our attorneys to defend a legal action brought by a patient. 4. Uses and disclosures without consent or authorization This section describes ways in which we may use and disclose a patient’s protected health information without the patient’s permission in the form of a consent or authorization. Each category includes examples. Not every use or disclosure in a category will be listed. Some listed examples fall into more than one category – not just the category under which they are listed. Disclosure to the patient or the patient’s personal representative We do not need a patient’s consent or authorization to disclose the patient’s protected health information to the patient or the patient’s personal representative. Individuals involved in patient’s care or payment for patient’s care We may disclose a patient’s protected health information to someone involved in a patient’s care or payment for a patient’s care, such as a spouse, a family member, or close friend. For example, when a patient has had surgery, we may discuss the patient’s physical limitations with a family member assisting in the patient’s post-operative care. In such situations we are required to limit the disclosure to information that is directly relevant to the recipient’s involvement with the patient’s care or payment for the patient’s care. In addition if the patient is present for, or otherwise available prior to the disclosure, and has the capacity to make health care decisions, we must provide the patient with the opportunity to agree or object to the disclosure and we may not make the disclosure if the patient objects. Notification purposes We may disclose a patient’s protected health information to notify, or to assist in the notification of, a family member, a personal representative, or another person responsible for the patient’s care regarding a patient’s location, general condition, or death. For example, if a patient collapses in our office and is taken to the emergency room, we may notify the patient’s spouse. In addition, we may disclose a patient’s protected health information to an disaster relief entity, such as the Red Cross, so that it can notify a family member, a personal representative, or another person involved in the patient’s care regarding the patient’s location, general condition, or death.
Required by law We may disclose protected health information when required by federal, state, or local law. For example, we may disclose a patient’s protected health information to comply with mandatory reporting requirements for births and deaths, child abuse, disease prevention and control, vaccine-related injuries, medical device-related deaths and serious injuries, gunshot and other injuries by a deadly weapon or criminal act, driving impairments, and blood alcohol testing. In such situations, we are required to only disclose protected health information to the extent necessary to comply with the legal requirement. Other public health activities Earlier, we mentioned some mandatory reporting requirements for public health purposes. In limited situations, we may voluntarily assist in public health activities in other ways that involve the disclosure of a patient’s protected health information. These activities include, but are not limited to: Adverse event reports regarding drugs and medical devices and assistance with medical product recalls, repairs, and replacements. Notification to a person who could have been exposed to a communicable disease or is otherwise at risk for contracting or spreading a disease or condition in situations where we are authorized by law to make the notification as part of a public health intervention or investigation. In the case of HIV-related information, we must comply with state law limitations on HIV contact tracing and disclosure. We provide health care to certain patients at the request of their employer and may disclose to the employer findings regarding a work-related illness or injury or a work place related medical surveillance to enable the employer to comply with OSHA and similar requirements. In such a case, we are required to notify the employee at the time of the health care or by posting a notice where the health care is provided. Victims of abuse, neglect or domestic violence Above, we mentioned our mandatory child abuse and other reporting requirement. When we believe a patient to be the victim of abuse, neglect, or domestic violence, we also may voluntarily disclose protected health information regarding the patient in a report to a government authority authorized to receive such reports, such the Department of Aging in the case of an elderly patient or the Department of Public Welfare in the case of a nursing home patient. In such a case we must obtain the patient’s agreement with limited exceptions. Health oversight activities We may disclose protected health information to a health oversight agency for oversight activities authorized by law. These activities could include audits, inspections, investigations, licensure actions, and legal proceedings. Judicial and administrative proceedings We may disclose protected health information in the course or any judicial or administrative proceeding pursuant to a court order. In addition, we may disclose protected health information about the patient in response to a subpoena issued in connection with a judicial or administrative proceeding if we either have the patient’s permission or we are required by law to respond to the subpoena. Law enforcement purposes Earlier we mentioned our mandatory reporting requirement for gunshot and other injuries by a deadly weapon or criminal act and blood alcohol testing. We also may disclose protected health information for law enforcement purposes when required by law or with the patient’s permission. Coroners and medical examiners We may disclose protected health information to a coroner or medical examiner for the purpose of identifying a deceased patient, determining a cause of death, or facilitating their performance of other duties required by law. Funeral directors We may disclose protected health information to funeral directors as necessary to carry out their duties. This includes HIV-related information. Organ and tissue donation We may use protected health information for the purpose of facilitating donation and transplantation. We may disclose protected health information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating donation and transplantation. Protection of others from harm In limited circumstances, we may disclose protected health information about a patient to protect another person from being harmed. For example, we may warn that a patient has threatened another identifiable person with imminent serious bodily harm if we have reason to believe that the threat is real. Military activities In certain circumstances, we may disclose protected health information regarding patients in the military at the request of the military command authorities.
National security and intelligence activities In certain circumstances, we may disclose protected health information to federal officials for the conduct of legally authorized intelligence, counterintelligence, and other national security activities. Protective services for the President and others In certain circumstances, we may disclose protected health information to federal officials for the provision or protective services to the President and others. Correctional institutions and other law enforcement custodial situations We may disclose protected health information to a correctional institution or a law enforcement official having custody of a patient when they request the information for a purpose such as health care, safety, or security. Workers’ compensation and similar programs We may disclose a patient’s protected health information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault. For example, this would include submitting a claim for payment to a patient’s employer’s workers’ compensation carrier when we treat the patient for a work injury. Business associates Certain functions of the practice are performed by a business associate such as a billing company, an accountant firm, or a law firm. We may disclose protected health information to our business associates and allow them to create and receive protected health information on our behalf. Whenever we have a business associate arrangement that involves the use or disclosure of protected health information, we are required to have a written agreement that protects the privacy of the protected health information. [Other possible categories not generally applicable to physician practices: facility directory, research, military components, components of the Department of Veterans Affairs, components of the Department of State.] 5. Uses and disclosures with authorization In all other situations which do not fall under a category listed under section 3 or 4 we will obtain a written patient authorization to use or disclose protected health information. A patient authorization can be revoked at any time except to the extent that we have relied on the authorization.
6. Patient privacy rights regarding protected health information Restriction on use or disclosure Your right Patients have the right to request that that we restrict uses and disclosures of their protected health information: To carry out treatment, payment, or health care operations, To someone who is involved in their care or the payment for their care, or For notification purposes. Limitations on your right We are not required to agree to any request for a restriction. If we do agree, must comply with the request unless the information is needed for emergency care. We can terminate our agreement to a requested restriction, with the patient’s consent, as to all the patient’s protected health information that we maintain. We also can terminate our agreement without the patient’s consent, but only as to protected health information created or received after we notify the patient of the termination of our agreement. How to exercise your right To request a restriction, a patient must submit a written request to our privacy officer. The request must tell us: (a) what information the patient wants restricted; (b) how the patient wants the information restricted; and (c) to whom the patient wants the restriction to apply. Confidential communication Your right Patients have the right to request that we communicate their protected health information to them by a certain means or at a certain location. For example, the patient might request that we only contact the patient by mail or at work. Limitations on your right We are not required to accommodate a request that is unreasonable. How to exercise your right To make a request for confidential communications, a patient must submit a written request to our privacy officer. The request must tell us how or where the patient wants to be contacted. In addition, if another individual or entity is responsible for payment, the request must explain how payment will be handled. A patient is not required to provide us with any explanation of the basis for a request for confidential communications. Accounting of disclosures Your right Patients have the right to obtain, upon request, an "accounting" of certain disclosures of their protected health information by us (or a business associate for us). A requested accounting generally will list for each covered disclosure: The date, The name and address of the recipient, A brief description of the disclosed information, and A brief statement of the purpose of the disclosure. Limitations on your right A patient’s right to an accounting does not apply to all disclosures. For example, an accounting does not need to list disclosures: To the patient or the patient’s personal representative, To carry out treatment, payment, or health care operations, To someone who is involved in the patient’s care or the payment for the patient’s care, For notification purposes, For national security or intelligence purposes, or To correctional institutions or law enforcement purposes. In addition, a patient’s right to an accounting is limited to disclosures that occurred on or after February 26, 2003 and within six years of the request for an accounting. In certain situations, a patient’s right to an accounting of disclosures to a health oversight agency or a law enforcement official can be temporarily suspended. How to exercise your right To request an accounting, a patient must submit a written request to our privacy officer. The request should designate the applicable time period.
Timely action We generally are required to act on a request for an accounting by providing the accounting within 60 days after receipt. If we cannot comply with this time period, we must notify the patient in writing of the reason for the delay and when we will comply (which will be within a 30 day extension). Fees We are required to provide the first accounting requested by a patient within a 12-month period free of charge. We reserve the right to charge a reasonable cost-based fee to provide any additional accounting within the 12-month period. We must notify the patient of the cost involved and the patient may choose to withdraw or modify the request at that time before any costs are incurred. We further reserve the right to require advance payment of any accounting fee. Inspection and copying Your right As a general rule, patients have the right to inspect and obtain a copy of their protected health information. Usually, patients will have a right of access to their medical and billing records at our practice. Limitations on your right A patient’s right of access does not apply to all of the patient’s protected health care information. For example, it does not apply to: Psychotherapy notes. Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. In addition, we may deny patients access to their protected health information in certain circumstances, such as when: The information was obtained from someone other than a health care provider under a promise of confidentiality and the requested access would be reasonably likely to reveal the source of the information. A licensed health care professional determines that the requested access would endanger the life or physical safety of the patient or another person. A licensed health care professional determines that the requested access is reasonably likely to cause substantial harm to a non-health care provider named in the information. The access is requested by a personal representative and a licensed health care professional determines that the requested access is reasonably likely to cause substantial harm to the patient or another person. How to exercise your right To exercise the right of access, a patient must submit a written request to our privacy officer. The request must: (a) describe the health information to which access is requested, (b) state how the patient wants to access the information, such as inspection, pick-up of copy, mailing of copy, (c) specify any requested form or format, such as paper copy or an electronic means, and (d) include the mailing address, if applicable. Timely action We generally are required to act on a request for access by providing the access (or a written notice of denial) within 30 days after receipt if the information is maintained on-site, or within 60 days after receipt if the information is maintained off-site. If we cannot comply within these time periods, we must notify the patient in writing of the reason for the delay and when we will comply (which will be within a 30 day extension). Provision of access In the case of access by inspection or pick-up, we will arrange a convenient time and place with the patient. We are only required to comply with a form or format specified by the patient if the covered protected health information is readily producible in that form. Otherwise, we only need to provide the information in a readable hard copy form or such other form as is mutually agreed. With the patient’s agreement, we may comply with a request for access by providing a summary of the requested health information. With the patient’s agreement, we also may provide an explanation of health information to which we provide the patient with access. Fees We reserve the right to charge patients a reasonable cost-based fee for copying their health information. Patients can ascertain our current copying rates by contacting our privacy officer. We reserve the right to charge patients for a summary or explanation, but will advise them of any fees in advance of their agreement. We reserve the right to charge patients a reasonable cost-based fee for mailing a copy of their health information, or a summary or explanation. Patients can ascertain our current copying rates by contacting our medical records department. We reserve the right to require advance payment of any copying or mailing charges.
Right to request amendment Your right If patients believe that protected health information that we maintain about them is incorrect or incomplete, they may request that we amend the information. Patients have a right to request an amendment for as long as we maintain the information. Limitations on your right We may deny a request for an amendment if the request asks that we amend information that: Was not created by us, unless the patient provides a reasonable basis to believe that the originator is no longer available or act on the requested amendment, Is not part of the health information maintained by us, Is not part of the health information that the patient would be permitted to inspect and copy, or Is accurate or complete. How to exercise your right To request an amendment, patients must submit a written request to our privacy officer The request must specify each change that the patient wants and provide a reason to support each requested change. Timely action We generally are required to act on a request for an amendment by making the amendment (or providing a written denial) within 60 days after receipt. If we cannot comply with this time period, we must notify the patient in writing of the reason for the delay and when we will comply (which will be within a 30 day extension). Paper copy of privacy notice Your right Patients have a right to receive, upon request, a paper copy of our Notice of Privacy Practices. Patients may ask for a paper copy of the current notice at any time. Patients are entitled to obtain a paper copy – even if they agreed to receive the notice electronically. How to exercise your right To obtain a paper copy, contact our privacy officer.
7. Minors, incompetent, and deceased patients In the case of minors who lack legal capacity to make their own health care decisions, a parent, legal guardian, or other personal representative generally provides any required consent, authorization, or other permission to use and disclose the minor’s protected health care information and exercises the minor’s privacy rights. In the case of incompetent patients (such as a comatose patient or a patient with advanced Alzheimer Disease), a personal representative for the patient (such as a health care power of attorney, guardian, or a close family member) generally provides any required consent, authorization, or other permission to use and disclose the patient’s protected health care information and exercises the patient’s privacy rights. A patient’s protected health information remains protected even after the patient’s death. In the case of a deceased patient, a personal representative for the patient such as an executor of the patient’s estate, generally provides any required consent, authorization, or other permission to use and disclose the patient’s protected health care information and exercises the patient’s privacy rights. 8. Changes to this notice We reserve the right to change this notice at any time. We further reserve the right to make any change effective for all protected health information that we maintain at the time of the change – including information that we created or received prior to the effective date of the change. We will post a copy of our current notice in the waiting room for the practice. At any time, patients may review the current notice by contacting our privacy officer. Patients also may access the current notice at our web site at www.uboanet.com. 9. Complaints If patients believe that we have violated their privacy rights, they may submit a complaint to the practice or the Secretary of Health and Human Services. To file a complaint with the practice, submit the complaint in writing to our privacy officer. We will not retaliate against patients for filing a complaint. 10. Legal effect of this notice This notice is not intended to create contractual or other rights independent of the Standards for Privacy of Individually Identifiable Health Information ("privacy rule") issued by the Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act ("HIPAA").
©
2001 |
