HIIPA Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL/PSYCHOLOGICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Privacy is a very important concern for all those who come to this office. It is also complicated because of federal and state laws and our professional ethics. Because the rules are so complicated some parts of this Notice are quite detailed and you probably will have to read them several times to understand them. If you have any question I will be happy to help you.
Contents of this Notice
A. Introduction: To Clients
B. What we mean by "your medical information."
C. Privacy and the laws about privacy
D. How your protected health information can be used and shared:
1. Uses and disclosures with your consent.
a. The basic used and disclosures - For treatment, payment and health care operations (TPO).
b. Other uses and disclosure in healthcare.
2. Uses and disclosures requiring your Authorization.
3. Uses and disclosures not requiring your Consent or Authorization.
4. Uses and disclosures requiring you to have an opportunity to object.
5. An accounting of disclosures Andrea Mathews, LPC, NCC has made.
E. If you have questions or problems.
A. Introduction - To Clients
This notice will tell you about how Andrea Mathews, LPC, NCC handles information about you. It tells how I use this information here in this office, how I share it with other professionals and organizations, and how you can see it. I want you to know all of this so that you can make the best decisions for yourself and your family. I am also required to tell youabout this because of the privacy regulations of federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPPA), for which implementation occurred for health care professionals in April, 2003. Because this law and the laws of this state are very complicated and I don't want to make you read a lot that may not apply to you, I have simplified some parts. If you have any questions or want to know more about anything in this Notice, please ask me for more explanation or more detail.
B. What we mean by "your medical information."
Each time you visit me or any doctor's office, hospital, clinic, or any other "healthcare provider," information is collected about you and your physical and/or mental health. It may be information about your past, present or future health or conditions, or the treatment or other services you got from me or from others, or about payment for healthcare. The information I collect from you is called PHI, which stands for Protected Health Information. This information goes into your medical or healthcare record or file at my office. In this office this PHI is likely to include these kinds of information:
When you understand what is in your record and what it is used for you can make better decisions about to whom, when, and why others should have this information. Although your health record is the physical property of the healthcare practitioner or facility that collected it, the information belongs to you. You can inspect, read, or review it based on certain criteria that I will apply toward your best interests and through a particular signature protocol. If you want a copy I can make one but may charge you for the costs of copying (and mailing if you want it mailed to you). If you find anything in your record that you think is incorrect or something important is missing you can ask me to amend (add information to) your record although in some situations I don't have to agree to do that. I can explain more about this, if needed.
C. Privacy and the laws
The HIPAA law requires me to keep your PHI private and to give you this notice of my legal duties and privacy practice, called the Notice of Privacy Practices or NPP (either in this form or in the short form to which you consented upon admission to treatment here). I will obey the rules of this notice as long as it is in effect but if I change it, the rules of the new NPP will apply to all the PHI that I keep. If I change the NPP, I will post the new Notice in my office where everyone can see. You or anyone else can also get a copy from me at any time, or you may find it at my website at http://www.andreamathewslpc.com .
D. How your protected health information can be used and shared
When your information is read by me or others in this office, this is called, in the law, "use." If the information is shared with or sent to others outside of this office, this is called, in the law, "disclosure." Except in some special circumstances, when I use your PHI here or disclose it to others I will share only the minimum necessary PHI needed for the purpose. The law gives you right to know about your PHI, how it is used and to have a say in how it is disclosed and so I will tell you more about what I do with your information. I use and disclose PHI for several reasons. Mainly, I will use and disclose it for routine purposes and I will explain more about these below. For other uses, I must tell you about them and have written Authorization form you, unless the law lets or requires me to make the use of disclosure without your Authorization. However, the law also says that we are allowed to make some uses and disclosures with out your consent or authorization. All of these are outlined below.
Privacy is a very important concern for all those who come to this office. It is also complicated because of federal and state laws and our professional ethics. Because the rules are so complicated some parts of this Notice are quite detailed and you probably will have to read them several times to understand them. If you have any question I will be happy to help you.
Contents of this Notice
A. Introduction: To Clients
B. What we mean by "your medical information."
C. Privacy and the laws about privacy
D. How your protected health information can be used and shared:
1. Uses and disclosures with your consent.
a. The basic used and disclosures - For treatment, payment and health care operations (TPO).
b. Other uses and disclosure in healthcare.
2. Uses and disclosures requiring your Authorization.
3. Uses and disclosures not requiring your Consent or Authorization.
4. Uses and disclosures requiring you to have an opportunity to object.
5. An accounting of disclosures Andrea Mathews, LPC, NCC has made.
E. If you have questions or problems.
A. Introduction - To Clients
This notice will tell you about how Andrea Mathews, LPC, NCC handles information about you. It tells how I use this information here in this office, how I share it with other professionals and organizations, and how you can see it. I want you to know all of this so that you can make the best decisions for yourself and your family. I am also required to tell youabout this because of the privacy regulations of federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPPA), for which implementation occurred for health care professionals in April, 2003. Because this law and the laws of this state are very complicated and I don't want to make you read a lot that may not apply to you, I have simplified some parts. If you have any questions or want to know more about anything in this Notice, please ask me for more explanation or more detail.
B. What we mean by "your medical information."
Each time you visit me or any doctor's office, hospital, clinic, or any other "healthcare provider," information is collected about you and your physical and/or mental health. It may be information about your past, present or future health or conditions, or the treatment or other services you got from me or from others, or about payment for healthcare. The information I collect from you is called PHI, which stands for Protected Health Information. This information goes into your medical or healthcare record or file at my office. In this office this PHI is likely to include these kinds of information:
- Your history. As a child, in school and at work, marital and personal history.
- Reasons you came for treatment. Your problems, complaints, symptoms, needs, goals.
- Diagnoses. Diagnoses are the medical terms for your problems or symptoms.
- A Treatment Plan. Treatments and other services which I think will best help you.
- Progress Notes. Each time you come in, I write down some things about how you are doing, what I observe and what you tell me.
- Records I get from others who treated you or evaluated you.
- Psychological test scores, school records, etc.
- Information about medications you took or are taking.
- Legal matters.
- Billing and insurance information. This list is just to give you an idea and there may be other kinds of information that go into your healthcare record here. I use this information for many purposes. For example, I may use it:
- To plan your care and treatment.
- To decide how well my treatments are working for you.
- When, per your written consent, I talk with other healthcare professionals who are also treating you, such as your family doctor, or the professional who referred you to me.
- To show you that you actually received the services from me, which I billed to you or to your health insurance company.
- To improve the way I do my job by measuring the results of my work.
When you understand what is in your record and what it is used for you can make better decisions about to whom, when, and why others should have this information. Although your health record is the physical property of the healthcare practitioner or facility that collected it, the information belongs to you. You can inspect, read, or review it based on certain criteria that I will apply toward your best interests and through a particular signature protocol. If you want a copy I can make one but may charge you for the costs of copying (and mailing if you want it mailed to you). If you find anything in your record that you think is incorrect or something important is missing you can ask me to amend (add information to) your record although in some situations I don't have to agree to do that. I can explain more about this, if needed.
C. Privacy and the laws
The HIPAA law requires me to keep your PHI private and to give you this notice of my legal duties and privacy practice, called the Notice of Privacy Practices or NPP (either in this form or in the short form to which you consented upon admission to treatment here). I will obey the rules of this notice as long as it is in effect but if I change it, the rules of the new NPP will apply to all the PHI that I keep. If I change the NPP, I will post the new Notice in my office where everyone can see. You or anyone else can also get a copy from me at any time, or you may find it at my website at http://www.andreamathewslpc.com .
D. How your protected health information can be used and shared
When your information is read by me or others in this office, this is called, in the law, "use." If the information is shared with or sent to others outside of this office, this is called, in the law, "disclosure." Except in some special circumstances, when I use your PHI here or disclose it to others I will share only the minimum necessary PHI needed for the purpose. The law gives you right to know about your PHI, how it is used and to have a say in how it is disclosed and so I will tell you more about what I do with your information. I use and disclose PHI for several reasons. Mainly, I will use and disclose it for routine purposes and I will explain more about these below. For other uses, I must tell you about them and have written Authorization form you, unless the law lets or requires me to make the use of disclosure without your Authorization. However, the law also says that we are allowed to make some uses and disclosures with out your consent or authorization. All of these are outlined below.
1. Uses and disclosures of PHI in healthcare with your consent:
After you have read this Notice (usually in its shortened form) you will be asked to sign a separate Consent Form to allow us to use and share your PHI. In almost all cases we intend to use your PHI here or share your PHI with other people or organizations to provide treatment to you, or arrange for payment for our services, or some other business functions called healthcare operations. Together these routine purposes are called TPO, and the Consent Form allows us to use and disclose your PHI for TPO. Re-read that last sentence until it is clear because it is very important.
After you have read this Notice (usually in its shortened form) you will be asked to sign a separate Consent Form to allow us to use and share your PHI. In almost all cases we intend to use your PHI here or share your PHI with other people or organizations to provide treatment to you, or arrange for payment for our services, or some other business functions called healthcare operations. Together these routine purposes are called TPO, and the Consent Form allows us to use and disclose your PHI for TPO. Re-read that last sentence until it is clear because it is very important.
1a. For treatment, Payment or health care operations:
We need information about you and your condition to provide care to you. You have to agree to let us collect the information and to use it and share it only as necessary to care for you properly. Therefore, you must sign the Consent form before we begin to treat you because if you do not agree and consent we cannot treat you. Generally, I may use or disclose your PHI for three purposes, as above: treatment, obtaining payment and what are called healthcare operations. These are detailed below.
For treatment:
I use the information gathered during assessment and during each session, to provide you with treatment or services. These might include individual, family, group therapy, treatment planning, or measuring the effects of my services, so that I can improve my care for you. I may share or disclose your PHI to others who provide treatment to you, with your written authorization. This may mean that I will speak to your Psychiatrist, or personal physician. I may share your PHI with referring and following third parties, such as the Department of Human Resources (DHR), if you are their client, in order to coordinate services, provide the best treatment and collect payment. I may share your PHI with attendees at an Individual Service Plan (ISP) meeting with DHR in order to facilitate your care, as a part of your treatment plan. I may need to refer you to other professionals or consultants for services I do not offer, such as special testing, or treatments, or medication. When I do this, with your written authorization, I will need to tell them some things about you and your conditions. I will also get back their findings and opinions and those will go into your record here. Other professionals, who treat you in the future, may need to contact me to gather information regarding the treatment you received from me. I can also share your PHI with them upon your written authorization. These are some examples, so that you can see how I use and disclose your PHI for treatment.
For Payment:
I may use your information to bill you, your insurance, or others third party payors, to be paid for the treatment I provide to you. I may contact your insurance company to check on exactly what your insurance covers. I may have to tell them about your diagnoses, what treatments you have received, and what I expect as I treat you. I will need to tell them about when we met, your progress and other similar things. You will sign a Consent to Treat, when you initiate your treatment here, which allows me to do so.
For health care operations:
There are some other ways I may use or disclose your PHI, which are called health care operations. For example, I may use your PHI to see where I can make improvements in the care and services that I provide. This information will be gathered from your record and the records of others that I treat, but once compiled will not use name or identity. This compiled information of a select group of diagnoses, or treatments (without name or identity) will be called Outcome Studies, and may be used as statistical or anecdotal information in publications or for Outcome Studies of insurance companies. I may be required to supply some information to some government health agencies so that they can study disorders and treatment and make plans for services that are needed. If I do, your name and identity will be removed from what I send.
We need information about you and your condition to provide care to you. You have to agree to let us collect the information and to use it and share it only as necessary to care for you properly. Therefore, you must sign the Consent form before we begin to treat you because if you do not agree and consent we cannot treat you. Generally, I may use or disclose your PHI for three purposes, as above: treatment, obtaining payment and what are called healthcare operations. These are detailed below.
For treatment:
I use the information gathered during assessment and during each session, to provide you with treatment or services. These might include individual, family, group therapy, treatment planning, or measuring the effects of my services, so that I can improve my care for you. I may share or disclose your PHI to others who provide treatment to you, with your written authorization. This may mean that I will speak to your Psychiatrist, or personal physician. I may share your PHI with referring and following third parties, such as the Department of Human Resources (DHR), if you are their client, in order to coordinate services, provide the best treatment and collect payment. I may share your PHI with attendees at an Individual Service Plan (ISP) meeting with DHR in order to facilitate your care, as a part of your treatment plan. I may need to refer you to other professionals or consultants for services I do not offer, such as special testing, or treatments, or medication. When I do this, with your written authorization, I will need to tell them some things about you and your conditions. I will also get back their findings and opinions and those will go into your record here. Other professionals, who treat you in the future, may need to contact me to gather information regarding the treatment you received from me. I can also share your PHI with them upon your written authorization. These are some examples, so that you can see how I use and disclose your PHI for treatment.
For Payment:
I may use your information to bill you, your insurance, or others third party payors, to be paid for the treatment I provide to you. I may contact your insurance company to check on exactly what your insurance covers. I may have to tell them about your diagnoses, what treatments you have received, and what I expect as I treat you. I will need to tell them about when we met, your progress and other similar things. You will sign a Consent to Treat, when you initiate your treatment here, which allows me to do so.
For health care operations:
There are some other ways I may use or disclose your PHI, which are called health care operations. For example, I may use your PHI to see where I can make improvements in the care and services that I provide. This information will be gathered from your record and the records of others that I treat, but once compiled will not use name or identity. This compiled information of a select group of diagnoses, or treatments (without name or identity) will be called Outcome Studies, and may be used as statistical or anecdotal information in publications or for Outcome Studies of insurance companies. I may be required to supply some information to some government health agencies so that they can study disorders and treatment and make plans for services that are needed. If I do, your name and identity will be removed from what I send.
1b. Other uses and disclosures in healthcare:
Appointments:
I may use and disclose information to schedule or reschedule appointments for treatment. If you want me to call or write you only at your home or your work, or prefer some other way to reach you, I usually can arrange that. Just tell me.
Treatment Alternatives:
I may use and disclose your PHI to tell you about or recommend possible treatments or alternatives that may be of interest to you.
Other Benefits and Services:
I may use and disclose your PHI to tell you about health-related benefits or services that may be of interest to you.
Research: I may use or share your information to do research to improve treatments. For example, comparing two treatments for the same disorder to see which works better or faster or costs less. In all cases, your name, address and other information that reveals who you are will be removed from the information given to researchers. If they need to know who you are, we will discuss the research project with you and you will have to sign a special Authorization form before any information is shared.
Business Associates:
There are some jobs I may hire other businesses to do for me. They are called our Business Associates in the law and are required to follow the same HIPAA requirements that I follow with regard to your confidentiality. Currently, I have hired no other business associates. However, if I decide to do so, some examples might include a copy service, I may use to make copies of your record for a specific reason (such as for an insurance company upon an appeal for payment), or a billing service who figures out, prints and mails my bills. Or, a collection agency who will need minimum information to contact you with regard to late payments. These business associates need to receive some of your PHI to do their jobs properly. To protect your privacy, they will have each agreed in their contract with me to safeguard your information.
Appointments:
I may use and disclose information to schedule or reschedule appointments for treatment. If you want me to call or write you only at your home or your work, or prefer some other way to reach you, I usually can arrange that. Just tell me.
Treatment Alternatives:
I may use and disclose your PHI to tell you about or recommend possible treatments or alternatives that may be of interest to you.
Other Benefits and Services:
I may use and disclose your PHI to tell you about health-related benefits or services that may be of interest to you.
Research: I may use or share your information to do research to improve treatments. For example, comparing two treatments for the same disorder to see which works better or faster or costs less. In all cases, your name, address and other information that reveals who you are will be removed from the information given to researchers. If they need to know who you are, we will discuss the research project with you and you will have to sign a special Authorization form before any information is shared.
Business Associates:
There are some jobs I may hire other businesses to do for me. They are called our Business Associates in the law and are required to follow the same HIPAA requirements that I follow with regard to your confidentiality. Currently, I have hired no other business associates. However, if I decide to do so, some examples might include a copy service, I may use to make copies of your record for a specific reason (such as for an insurance company upon an appeal for payment), or a billing service who figures out, prints and mails my bills. Or, a collection agency who will need minimum information to contact you with regard to late payments. These business associates need to receive some of your PHI to do their jobs properly. To protect your privacy, they will have each agreed in their contract with me to safeguard your information.
2. Uses and disclosures requiring your Authorization:
Many of the above disclosures require, in the state of Alabama, your written authorization. I will follow the letter of the law in these cases. If you change your mind about authorizing me to use or disclose your PHI, you can revoke (cancel) that permission, in writing, at any time. After that time, I will not use or disclose your information for the purpose that we agreed to. Of course, I cannot take back any information I had already disclosed prior to your revocation.
Many of the above disclosures require, in the state of Alabama, your written authorization. I will follow the letter of the law in these cases. If you change your mind about authorizing me to use or disclose your PHI, you can revoke (cancel) that permission, in writing, at any time. After that time, I will not use or disclose your information for the purpose that we agreed to. Of course, I cannot take back any information I had already disclosed prior to your revocation.
3. Uses and disclosures of PHI from mental health records not requiring Consent or Authorization:
The laws let me use and disclose some of your PHI without your consent or authorization in some cases, as below.
When required by law:
There are some federal, state or local laws that require me to disclose PHI:
To Prevent a Serious Threat to Health or Safety:
If I come to believe that there is a serious threat to your heath or safety or that of another person or the public, I can disclose some of your PHI. I will only give this information to those who can prevent the danger and will only give that information which is essential to resolving the threat.
For Law Enforcement Purposes:
I may release medical information if asked to do so by a law enforcement official to investigate a crime or criminal. Again, I will try to assert your right to privileged communication.
For specific government functions:
I may disclose PHI of military personnel and veterans to government benefit programs relating to eligibility and enrollment, to Worker's Compensation programs, to correctional facilities, if you are an inmate, and for national security reasons.
The laws let me use and disclose some of your PHI without your consent or authorization in some cases, as below.
When required by law:
There are some federal, state or local laws that require me to disclose PHI:
- I have to report suspected child abuse.
- If you are involved in a lawsuit or legal proceeding and I receive a subpoena, discovery request, or other lawful process, I may have to release some of your PHI. I will only do so after trying to inform you about the request, consulting with your attorney or trying to get a court order to protect the information they requested. This means that I will assert, on your behalf, your right to privileged communications.
- I may have to disclose some information to government agencies, which check on me to see that I am obeying the privacy laws.
To Prevent a Serious Threat to Health or Safety:
If I come to believe that there is a serious threat to your heath or safety or that of another person or the public, I can disclose some of your PHI. I will only give this information to those who can prevent the danger and will only give that information which is essential to resolving the threat.
For Law Enforcement Purposes:
I may release medical information if asked to do so by a law enforcement official to investigate a crime or criminal. Again, I will try to assert your right to privileged communication.
For specific government functions:
I may disclose PHI of military personnel and veterans to government benefit programs relating to eligibility and enrollment, to Worker's Compensation programs, to correctional facilities, if you are an inmate, and for national security reasons.
4. Uses and disclosures requiring you to have an opportunity to object: I can share some information about you with your family or close others. However, I will only share information with those involved in your care and anyone else you choose, such as close friends or clergy. I will ask you about who you want us to tell what information about your condition or treatment. You can tell me what you want and I will honor your wishes as long as it is not against the law. In most of these cases I will get a written authorization from you. If it is an emergency, so I cannot ask if you disagree, I can share information if I believe that it is what you would have wanted and if I believe it will help you if I share it. If I do share information, in an emergency, I will tell you as soon as I can. If you don't approve I will stop, as long as it is not against the law. Again, I will report only the minimum necessary.
5. An accounting of disclosures: When I disclose your PHI, I now keep some records of, when I sent it, to whom it was sent, and what I sent. You can get an accounting (a list) of many of these disclosures.
E. If you have questions or problems:
If you need more information or have question about the privacy practices described above please speak to me about it. If you have a problem with how your PHI has been handled or if you believe your privacy rights have been violated, please contact me. You have a right to file a complaint with me and with the Secretary of the Federal Department of Health and Human Services. I promise that I will not, in any way, limit your care here or take any actions against you if you complain.
NPP: 2/28/03 for compliance by April 14, 2003.
E. If you have questions or problems:
If you need more information or have question about the privacy practices described above please speak to me about it. If you have a problem with how your PHI has been handled or if you believe your privacy rights have been violated, please contact me. You have a right to file a complaint with me and with the Secretary of the Federal Department of Health and Human Services. I promise that I will not, in any way, limit your care here or take any actions against you if you complain.
NPP: 2/28/03 for compliance by April 14, 2003.