Allen County Health Department
NOTICE OF PRIVACY PRACTICES
Effective Date: 04/14/2003
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE READ CAREFULLY
ACKNOWLEDGEMENT OF RECIEPT OF THIS NOTICE
You will be asked to provide a signed acknowledgement of receipt of this notice. Our intent is to make you aware of the possible uses and disclosures of your Protected Health Information (PHI) and your privacy rights.
WHAT IS THIS NOTICE
This Notice of Privacy Practices is required by the Health Insurance Portability and Accountability Act (HIPAA) of 1996.
This notice tells you:
- How this Health Department and its contracted business partners may use and give out your PHI to carry out treatment, services, payment, or health care operations and for the purposes permitted or required by law.
- What YOUR rights are regarding the access and control of your health information.
- How this Health Department protects your health information.
OUR PRIVACY PROMISE TO YOU
Your health information is personal. This Health Department is legally required by law to protect the privacy of your Protected Health Information (PHI). It does so in all aspects of its business. These policies comply with State and Federal laws. This Health Department uses and gives out your health information only where required by law or where necessary for business.
UNDERSTANDING YOUR HEALTH RECORD/INFORMATION
Each time you receive a service from a health department, hospital, physician, or other healthcare provider, a record of your visit is made. This record contains information about you, including information that may identify you and that relates to your past, present, or future physical or mental health or condition and identifies you, or there is a reasonable basis to believe the information may identify you. For example, this information, often referred to as your health or medical record, serves as a:
- Basis for planning your care
- Means of communication among the many health professionals who are involved in your care.
- Means by which you or a third-party payer (insurance provider) can check that services were actually provided.
Your health record contains PHI. State and Federal law protects this information. Understanding how we may use and share your health information helps you to:
- Understand the need to make sure it is correct,
- Better understand who, what, when, where, and why others may access your health information, and
- Make more informed decisions when authorizing sharing with others.
YOUR HEALTH INFORMATION RIGHTS
Although your health record is the physical property of the health department that compiled, the information belongs to you. Under the Federal Privacy Rules, 45 CFR Part 164, you have the right to:
- Request a restriction on certain uses and sharing of your information. This means you may ask us not to use or share any part of your PHI for purposes of treatment, payment, or healthcare operation. You may also ask that this information not to be disclosed to family members or friends who may be involved in your care. This health department is not required to honor your request.
- Request that we send you confidential communications by alternative means or at alternative locations.
- Obtain a paper copy of the notice of information practices upon request.
- Inspect and obtain a copy of your health record. We may charge a fee for costs of copying.
- Request the portions of your medical record regarding PHI be changed.
- Amend your medical information.
- Obtain a listing of certain health information we were authorized to share for purposes other than treatment, payment, or health care operations after April 14, 2003.
- Take back your authorization to use or share health information except to the extent that action has already been taken except as public health law allows.
- Right to an accounting of disclosures. You may request that we provide you with an accounting of the disclosures we have made of your PHI. This right applies to disclosures made for purposes other than treatment, payment, or health care operations. The disclosure must have been made after April 14, 2003 and no more than 6 years from the date of request. This right excludes disclosures made to you, to family members or friends involved in your care, or for notification.
HEALTH DEPARTMENT RESPONSIBILITIES
This Health Department reserves the right to change our practices and to make the new policies effective for all PHI we maintain at the time. The effective date of the changes is at the top of the first page and at the bottom of the last page. Should our information practices change, this information will be posted in this health department and a copy will be provided at your next visit.
We will not use or disclose your health information without your authorization, except as described in this notice.
EXAMPLES OF DISCLOSURES FOR HEALTH OPERATIONS
These examples do not include all possibilities.
Required uses and disclosures.
By law, we must disclose your health information to you unless it has been determined by a competent medical authority that it would be harmful to you.
We will use your health insurance for services, and treatment.
For example: Information obtained by a nurse, physician, or other member of your healthcare team will be recorded in your record and used to determine the course of services that should work best for you. This includes pharmacists who may be provided information on other drugs you have been prescribed to identify potential interactions.
We will use your health information for regular health operations.
We may use/disclose your PHI in fulfilling the health department responsibilities. We may use your information to determine your eligibility for other services. For example: Staff may look at your record when reviewing the quality of services you are provided. Members of the risk or quality improvement team may use information in your health record to assess the quality and effectiveness of the healthcare and services we provide. We may use/disclose medical information in your health record to assess the quality and effectiveness of the healthcare and services we provide. We may use/disclose medical information to contact you as a reminder that you have an appointment. We may call you by name in the waiting room when we are ready to see you.
We may use/disclose PHI to tell you about or recommend treatment or other health –related benefits and services that may be of interest to you.
Business Associates: There are some services provided in our health department through contracts with business associates. Whenever an arrangement between our office and a business associate involves the use or sharing of your PHI, we will have a written contract that contains terms that will protect the privacy of your PHI. Information shall be made available on a need-to-know basis for these activities associated with compliance with regulatory agencies.
USES AND SHARING OF INFORMATION SPECIFICALLY AUTHORIZED BY YOU:
Use and disclosures of your PHI beyond treatment, payment and operations, will be made only with your written authorization, unless otherwise permitted or required by law described below.
Others involved in your healthcare:
We may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. We may use or disclose PHI to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition, or death.
Unless you object, we may contact you as a reminder that you have an appointment.
OTHER PERMITTED AND REQUIRED USES AND SHARING THAT MAY BE MADE WITHOUT YOUR CONSENT, AUTHORIZAITON, OR OPPORTUNITY TO OBJECT
We may use and share your PHI. It will be limited to the requirements of the law including but not limited to the following instances:
Required by Law:
We may use/disclose your PHI if law or regulation requires the use/disclosure.
Public Health Emergencies:
We may use or share your PHI in an emergency treatment situation. If this happens, we will try to obtain your consent as soon as reasonably practicable. Finally, we may use or share your PHI with an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care.
- Under KRS 214.020 When there is a probability that any infectious or contagious disease will invade this state, we may take such action and adopt and enforce such rules and regulations as we deem efficient in preventing the introduction or spread of such infectious or contagious diseases within this state, up to and including a quarantine and isolation.
- Under KRS 214.010 Every physician shall report all diseases designated by regulation of the Cabinet for Health Services as reportable which are under his special treatment to the local board of health of his county, and every head of a family shall report any of said diseases, when known by him to exist in his family, to the local board or to some other board member.
As required by law, we may disclose your PHI to state and federal public health, or legal authorities charged with preventing or controlling disease, injury, or disability. We may share your PHI, if authorized by law, to a person who may have been exposed to a communicable disease or may be at risk of getting or spreading the disease or condition. Information will be released to avert a serious threat to health or safety. Any disclosure, however, would only be authorized to receive that information pursuant to law.
- Under KRS 194A.060, all records and reports of CHS (or CHR) which directly or indirectly identify a patient or client, or former patient or client, of the Cabinet, are confidential.
- Under KRS 214.420, all information in the possession of local health departments or CHS concerning persons tested for, having, or suspected of having sexually transmitted diseases, or identified in an epidemiologic investigation for sexually transmitted diseases, is strictly confidential. A general authorization for the release of medical or other information is not sufficient to authorize release of this information. Breach of this confidentiality is considered a violation under KRS 214.990
- Under KRS 214.181, no test results relating to human immunodeficiency virus are to be disclosed to unauthorized persons.
- Under KRS 222.271, treatment records of alcohol and drug abuse patients are confidential.
- Under KRS 216.2927, raw data used by the Kentucky Health Policy Board are confidential. This includes data, data summaries, correspondence, or notes that could be used to identify an individual patient, member of the general public or employee of a health care provider.
- Under KRS 202A.091, court records relating to hospitalization of the mentally ill are confidential. Violation of the confidentiality of these records is a Class B misdemeanor under KRS 202A.991.
- Under KRS 202B.180, court records relating to mental retardation admissions are confidential. Violation of the confidentiality of these records is a Class A misdemeanor under KRS 202B..990.
- Under KRS 210.235, all records which directly or indirectly identify any patient, former patient, or person whose hospitalization ahs been sought are confidential.
- Under KRS 211.902, the names of individuals are not to be disclosed in connection with lead poisoning records, except as determined necessary by the Cabinet Secretary.
- Under KRS 211.670, lists maintained by hospitals, and all information collected and analyzed, relating to the Kentucky birth surveillance registry (concerning birth defects, stillbirths, and high risk conditions) are to be held confidential as to the identity of the patient. Violation of this confidentiality is a Class A misdemeanor under KRS 211.991.
- Under KRS 213.131, unauthorized disclosure or inspection of vital records is unlawful. Violation of the confidentiality laws for vital statistics is a Class B misdemeanor under KRS 213.991.
Food and Drug Administration (FDA):
We may disclose to the FDA health information relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.
Abuse, Neglect, Exploitation:
We may disclose your relevant PHI to the Cabinet for Families and Children or other appropriate government authority that is authorized by law to receive reports of abuse, neglect, exploitation, or domestic violence to the governmental agency authorized to receive such information.
We may share your PHI with health oversight agencies such as federal and state Departments of Health and Human Services, Medicare/Medicaid Peer Review Organizations, the United States Department of Agriculture (USDA) or the Center for Disease Control (CDC) for such activities as audits, investigations, and inspections or compliance with civil rights laws.
Judicial and administrative proceedings:
We may disclose PHI during any judicial or administrative proceeding, in response to a court order or administrative tribunal (if such a disclosure is expressly authorized), and in certain conditions in response to a subpoena, discovery request, or other lawful process.
We may disclose information to researchers when their research has been approved by an institutional reviewed the research proposal and established protocols to ensure the privacy of your health information (See Cabinet for Health Services Administrative Order, CHS 01-08, August 28, 2001)(Institutional Review Board for the Protection of Human Subjects).
Coroners, Funeral Directors, and Organ Donation:
We may disclose PHI to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose relevant PHI to a funeral director, as authorized by law in order to permit the funeral director to carry out their duties. We may disclose such information in reasonable anticipation of death. PHI may be used for cadaver organ, eye, or tissue donation purposes.
Law Enforcement/Legal Proceedings:
We may disclose health records for law enforcement purposes as required by law or in response to a valid subpoena, discovery request or other lawful process. These law enforcement purposes include (1) legal processes; (2) limited information requests for identification and location purposes; (3) pertaining to victims of a crime; (4) suspicion that death has occurred as a result of criminal conduct; (5) in the event that a crime occurs on the premises of the Department, including its facilities; and (6) medical emergency and it is likely that a crime has occurred. Also we may disclose information to government agencies.
Should you be an inmate of a correctional institution, we may disclose to the Corrections Cabinet health information necessary for your health and the health and safety of other individuals.
Military, national security:
If you are involved with the military, national security, or intelligence activities, we may release your health information to the proper authorities so they may carry out their duties under the law.
We may disclose health information to the extent authorized by and to the extent necessary to comply with laws relating to workers compensation or other similar programs established by law.
Information that is not personally Identifiable:
We may disclose information about you in a way that does not personally identify you or reveal who you are.
Right to Paper Copy of Notice
You have the right to receive a paper copy of this Notice at any time. To receive a paper copy, send a written request to the Allen County Health Department; P.O. Box 129; Scottsville, KY 42164
CHANGES TO THIS NOTICE OF PRIVACY PRACTICES
The Allen County Health Department has the right to change this Privacy Notice at any time. If we do make a change, we will revise this Notice and promptly distribute it to all clients. The Health Department is required by law to comply with the current version of this Notice until a new version has been distributed.
WHERE DO YOU SEND QUESTIONS OR REQUESTS
To submit questions about your privacy rights, contact the Allen County Health Department at: P.O. Box 129, Scottsville, KY 42164.
Or, you may call the Health Department Privacy Officer (270)-237-4423 x. 100.
If you believe your privacy rights have been violated and wish to make a complaint, you may file a complaint by calling or writing:
- Veronica Anderson, Health Department Privacy Officer at the address and number listed above.
- The Secretary of
Health and Human Services
- Secretary of Health and Human Services, Room 615F
- 200 Independence Avenue SW
- Washington, D.C. 20201
- For additional information, call 877-696-6775.
- No retaliation will occur against you for filing a complaint.
Signature: ____________________ Date: ___________________
Signature: ____________________ Date: ____________________
Chairman, Board of Health
The above policy is effective until such time it is revised or updated to reflect HIPAA and Notice of Privacy Practices for Allen County Health Department Agency.