Purpose / Statement: The purpose of this policy is to outline the procedures Bayhealth will follow to provide individuals with the Notice of Privacy Practices (Notice). The Notice sets forth the uses and disclosures of protected health information (PHI) in accordance with the Privacy Standards of the Health Insurance Portability and Accountability Act of 96, 45 CFR parts 160 and 164 (HIPAA).
- Policy Statement
1.1 Bayhealth will make an accurate Notice available to each individual that presents for health care services in accordance with the notice requirements under HIPAA. The Notice shall adequately describe the uses and disclosures of PHI that may be made by Bayhealth as well as the individual’s rights and Bayhealth’s legal duties with respect to PHI. -
Areas Involved:
2.1 All Bayhealth departments and facilities. -
Forms Involved:
3.1 Form # N9795: Notice of Privacy Practices (pamphlet) -
Procedure:
4.1 Key Definitions
4.1.1 Access an individual’s right to inspect and/or obtain a copy of their health information maintained by Bayhealth.
4.1.2 Health Information any information that:
4.1.2.1 Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
4.1.2.2 Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual.
4.1.3 Disclosure with respect to PHI, the release, transfer, provision, access, or any other manner of divulging of information.
4.1.4 Accounting of Disclosures the written statement provided to an individual, subsequent to written request, that informs the individual of all disclosures of PHI by Bayhealth. The Privacy Revision Information: (Required for all revised policies) For New Policy, Write “New” New template. Changed booklet to pamphlet (3.1). Retention time changed from 6 years to 10 years due to ACO (4.4.1) 7-02-17 Notice of Privacy Practices, HIPAA.03, Effective Date September 26, 2018 3 Rule requires the disclosures to be tracked for six (6) years; the individual may ask for a shorter period of time.
4.1.5 Consent the signed consent form/s used by Bayhealth to obtain an individual’s permission to access, use, and disclose the individual’s PHI for treatment, payment, and health care operations (TPO).
4.1.6 Health Care Operations as pertains to Bayhealth, any activities of Bayhealth related to operational functions (see HIPAA.02).
4.1.6.1 More Definitions see Policy #HIPAA.02, the Glossary of Privacy and Security Related Terms
4.2 Development and Approval of the Notice of Privacy Practices
4.2.1 The Notice shall be developed by the Risk Management department in compliance with current HIPAA regulations and requirements of 45 CFR § 164.520. The Notice shall be approved by the Privacy & Security Committee prior to implementation. The Notice may never be combined in a single document with the Consent for Treatment.
4.3 Distribution of Notice
4.3.1 The Notice shall be offered to an individual at the time the individual is asked to sign the Consent for Treatment which shall be no later than the date of the first service delivery, including service delivered electronically to the individual.
4.3.2 The Notice shall be made available to any person upon request. For this purpose, a supply of Notices shall be kept in all registration areas, Health Information Management, Patient Advocacy, and the office of the Privacy Officer.
4.3.3 The Notice shall be prominently posted in the following areas which are deemed to be the areas where individuals seeking service form Bayhealth are likely to be able to read the Notice: registration areas, all outpatient service areas, all emergency departments, and Health Information Management.
4.3.4 The Notice shall be prominently posted on Bayhealth’s public web site and shall be available for printing from that site. The Notice will be deemed ‘prominently posted’ when it is described on the home page in a font size that is no smaller than the median font size used on the home page, and the description includes a link from which the entire Notice may be printed. 4.4 Document Retention
4.4.1 Bayhealth must retain copies of each version of the Notices it issues. Due to being an Accountable Care Organization (ACO), the minimum retention time must be 10 years. The templates must be retained in order to demonstrate compliance with the Notice requirements. Copies of the Notice’s templates will be maintained by the Privacy Officer. 4.5 References
4.5.1 http://www.hhs.gov/ocr/privacy/