PATIENT NOTICE OF PRIVACY
Health Insurance Portability and Accountability [top]

This policy establishes East Texas Border Health (ETBH) responsibility for compliance with the privacy standards and procedures for overseeing the efforts of all programs provided by ETBH to safeguard the privacy of Patient information by establishing minimum requirements for administrative measures to implement HIPAA and maintaining compliance to CFR 45 Section 164

Staff Responsibility [top]

ETBH will designate a privacy official and contact person responsible for policy development and handling of privacy inquiries and complaints. Categories of protected health information will be identified for each class or category of staff members and how they may use or disclose protected health information (PHI).

Designation of Privacy Official [top]

The privacy official is responsible for the development and implementation of policies and procedures to safeguard the privacy of Patient's health information consistent with federal and state laws and regulations. The privacy official is a contact to who requests for additional information and complaints can be directed. The privacy official may assign any of these responsibilities to other staff members or contractors, but continues to be responsible for making sure these responsibilities are carried out.

General Staff Responsibilities [top]

• All staff members are responsible for safeguarding the privacy of patient health information. Specific staff responsibilities under these privacy policies and procedures will be listed in the staff members' job description. All staff members must:
• Use and disclose protected health information only as authorized in their job description or as authorized by a supervisor.
• Conduct oral discussions of personal health information with other staff or with Patient and family members in a manner that limits the possibility of inadvertent disclosures
• Complete privacy training
• Report suspected violations of a business associates' contractual obligations to safeguard protected health information.
• Report suspected violations to the policies and procedures established in this manual by staff members.

Protection of Whistle blowers [top]

No action will be taken against a staff member who reports a violation of privacy standards to the Secretary of Health and Human Services or to law enforcement agencies.

Business Associates

A business associate is any person or organization that performs or helps to perform any function or activity that involves the use or disclosure of protected health information. Written contracts or agreements will be negotiated between East Texas Border Health and any business associate that will handle protect health information it receives from or creates.

Contractual Breaches by Business Associates [top]

If a staff member becomes aware of activities or practices by the business associate that violate the agency's contractual obligations, the activities or practice must be reported to the privacy official. The privacy official will take actions to correct violations of contractual provisions when ETBH becomes aware of them. When it is not possible to end the violation of contractual obligations the business associate contract will be terminated. When it is not possible to terminate a business associate contract, Health and Human Services will be notified of the violation of contractual obligations and all efforts made to correct the violation.

Maintenance and Retention of Records and Documentation [top]

All records written or electronic that require actions, activities, and designations will be maintained in a central file located in the business office. Documentation of actions called for by other policies and procedures contained in this manual will be retained for a minimum of six years from the date the information was created.

Use and Disclosure of Information for Treatment Purposes [top]

Prior to receiving services, the Notice of Privacy Practice will be given to the patient. Written acknowledgement of receiving the Notice will be placed in the patient's record. Request for PHI will be limited to the minimum necessary for a specified purpose.

Use and disclosure of PHI for payment purposes is limited to the information that can be transmitted using the standards for electronic transactions. These restrictions apply whether the transaction is conducted electronically or using paper forms.

Before using or disclosing PHI for any function of the functions included in East Texas Border Health, the staff must give the Notice of Privacy Practices to the patient.

Law Enforcement and Public Health [top]

Disclosure of patient information to public health agencies as required by law may be disclosed whether or not the patient authorizes the disclosures. Disclosure of PHI is permitted to agencies responsible for investigating abuse, neglect, and domestic violence, child abuse and neglect, or national security without patient authorization. Disclosure of patient information is permitted to oversight agencies such as the Texas Department of State Health Services, which are responsible for administering public health programs such as Medicare and Medicaid, and for licensing, conducting audits, and for other purposes related to the oversight of the health system. PHI may be disclosed for use in a legal proceeding under the following circumstances:

• The information has been requested in a court order or an order of an administrative tribunal.
• The information has been requested by means of a subpoena, discovery request, or other legal process.

Informing Patients of Disclosures [top]

Unless the patient's primary care provider believes that informing the patient may lead to serious harm for the patient or another person, or unless state law prohibits such notification, the patient will be informed of any disclosure of PHI. If it is not possible to inform the patient, the patient's personal representative must be informed of the disclosure unless the patient's primary care provider believes that informing the representative may lead to serious harm for the patient or another person.

Marketing and Fundraising [top]

Patients must specifically authorize the use of PHI collected or maintained by ETBH for a communication that is sent to the individual describing a product or service offered by an organization other than ETBH. PHI for fund-raising purposes will not be permitted without prior patient authorization.

Other Disclosure Situations [top]

• Following the death of a patient, ETBH may disclose PHI to an organ procurement organization or tissue bank without the patient's prior authorization, and without obtaining the authorization of the patient's representative. PHI may not be disclosed if the patient has indicated that he or she does not want to donate organs or tissue, or the patient has imposed a restriction on the disclosure of PHI for this purpose.
• Coroners and Medical Examiners may receive PHI without the patient's authorization for the following purposes: 1) identification of a deceased person; 2) determination of the cause of death; 3) other purposes specified in state or federal law.
• A staff member may disclose protected health information without the authorization of the patient if, in his or her professional judgment, such disclosure is necessary to reduce a serious and imminent threat to the health and safety of a person or the public.
• Information on a patient's location, medical condition, or death may be disclosed to disaster relief organization such as the Red Cross and other public or private organizations.

Disclosure of Protected Health Information after Death [top]

All standards for use and disclosure of protected health information to the records of the deceased individual will be handled according to the policies and procedures applied to the PHI of living patients. The death of a patient does not reduce the privacy protections that his or her protected health information will receive.

Notice of Privacy Practices [top]

The Notice of Privacy Practices will be written in a language that most patients of average intelligence an education will be able to understand. The Notice will be displayed in a prominent location.

Patient Access to Health Information [top]

A patient may, inspect and obtain a copy of his or her information maintained in his or her records through a written request to the privacy official. A decision to grant the patient or the patient's personal representative will be made within 30 days of the date on which the request was submitted. Restriction to access may include the following:

• Therapy notes will not be made available to the patient unless approved by the treating clinician or successor.
• Information compiled in anticipation of, or for use in, legal proceedings unless required by law or court order.
• Information that, by law, may not be disclosed to the patient.
• Information will not be made available if the patient's physician believes that it is likely to endanger the life of physical safety of the patient, the information is reasonably likely to cause substantial harm to a person other than the patient who is referenced in the patient records, or reasonably likely to cause harm to the Patient or another person.

Approval or denial of request will be documented in writing and placed in the patient record.

ETBH will charge a flat fee of $15 plus $.10 per page for copies of personal health information maintained by ETBH.

Amendment of Health Information [top]

A patient may request amendment of the information maintained by ETBH in the following records:

• The patient's medical record
• The patient's billing records
• Other records that contain protected health information used to direct treatment.

Acceptance or denial of the requested amendment will be attached to the record requested to be changed. If the patient disagrees in writing when notified that a request for amendment of protected information has been denied, the privacy official will review it and will link the written request to the patient record. The written disagreement will accompany the original information when it is used or disclosed in the future.

A patient may request in writing to the privacy official for an accounting of disclosures of PHI. If the patient received an accounting for which he or she was not charged during the preceding 12 months, he or she will be informed that ETBH will charge $15 for the second account. If the patient agrees to pay this fee, the accounting will be provided.

HIPAA Security Standards [top]

ETBH has administrative procedures to safeguard the integrity, confidentiality, and availability of the patient information that it maintains electronically. Certification of security safeguards is performed by the designated Security Officer. Contingency planning, crucial analysis, data back-up plan, disaster recovery plan, emergency operation plan oversight is the responsibility of the Security Officer. ETBH will track and regularly conduct a review or audit of information system activity and security incidents.

HIPAA Code Sets [top]

• Transactions will be coded according to rules outlined in the HIPAA specifications: The final transaction regulation adopts the following code sets:
• Diagnoses must be coded using the International Classification of Diseases, 9th Revision, Clinical Modification (ICD-9-CM Diagnosis Codes).
• Physician services and surgical procedures must be coded using the Common Procedure Terminology, 4th Revision (CPT-4).
• Dental services must be coded using the Code on Dental Procedures and Nomenclature (CDT).
• Inpatient hospital services and surgical procedures must be coded using the International Classification of Diseases, 9th Revision, Clinical Modification, Volume 3 (ICD-9CM Procedure Codes).
• Most other health-related services must be coded using the Health Care Common Procedure Coding Systems HCPC Level II).
• Drugs must be coded using the National Drug Code.

Patient Confidentiality [top]

ETBH ensures that the right to confidentiality is assured for the patient

• The right of confidentiality belongs to the patient of East Texas Border Health. The staff and agency are responsible for and claim the privileged nature of communication between the agency and the patient as confidential on behalf of the patient.
  • Only the patient can authorize the Corporation or members of its staff to divulge information known through patient/agency communications. The privilege of confidentiality may be claimed by a guardian.
  • Patient information consists of that information of a personal nature given by the patient to staff of the Agency. That information is both in the possession of the staff member through memory and documented in the written form in records of the agency. Both forms are subject to the following procedures.

It is the philosophy of East Texas Border Health. that information regarding patients is confidential. Information that identifies, or potentially identifies a patient, or information about a specific patient, will only be given to employees of the agency when the information is necessary to carry out their official responsibility. This applies to volunteers, consultants, students, and employees by contract.

Conditions under which patient information may be released. [top]

• With written consent.

Since the patient has the privilege of confidentiality, only he/she can authorize it to be shared with others. Patient information may be disclosed to outside individuals or agencies provided that a written request from the individual or agency needing the information has been received by the corporation.

• The patient has signed a valid consent form authorizing the disclosure of information.
• A valid consent form shall specify the following information:
• The information requested and the reason the information is needed.
• The name of the person and/or the organization to which the information is to be disclosed.
• The signature of the patient or person having authority to give consent
• Date on which the form was signed
• Date on which the consent form expires or a statement that time limits the consent.
• Date and signature space of revocation of authorization. This may be signed by the patient or representative.
• Consent for disclosure of information to an alcohol or drug patient's attorney must be written. The attorney must endorse the patient's written application.

Who can give consent:

• If the patient is a competent adult, 18 years or older, has been legally married, or is not presently or has not been judged to be legally incompetent, or is a minor being treated for drug/alcohol Abuse, then the patient is the only person who can consent. Consent must be in writing.
• If the patient is an incompetent adult, the court appointed guardian of the patient is the only person authorized to give consent. Incompetent means that he/she does not have the ability to comprehend the effects or consequences of giving an authorization of disclosure. In the case of a "limited guardianship", the patient must have been specifically adjudicated incompetent to consent to disclosure. If the patient is a minor, the patient does have the authority to consent for disclosure in some instances. A parent, guardian, or a managing conservator of the minor patient has the power to authorize consent to disclosure. (Minor means someone under the 18 years of age who has never been legally married or whose minority status has not been legally removed.) If the minor is treated for alcohol his/her signature or consent by parent(s), guardian or managing conservator is required. If the minor is treated for drug abuse, the minor is the only person who may consent to disclosure. If the minor is being treated for a communicable disease, e.g. HIV, STD's the minor may sign for consent to disclosure.
• Consent for disclosure regarding deceased patients shall be given by a court appointed executor, administrator, or other personal representative. If there is not an appointment of a personal representative, information may be released only under authority of a court order. (Exception: A parent having legal custody may authorize disclosure about a deceased minor child.)
• Disclosure required under federal or state laws involving the collection of non-identifying statistics may be made without consent.
• As required by federal law, individuals who are diagnosed with AIDS will be reported to the Texas Department of Health without consent.

Conditions under which patient information may be released without written consent.

There are situations in which signed consent is not required. Even in these situations, attempts should be made to obtain written consent. Only the information deemed necessary shall be disclosed.

EAST TEXAS BORDER HEALTH CLINIC

PATIENT BILL OF RIGHTS [top]

• You have the right to a humane environment that provides reasonable protection from harm and appropriate privacy for your personal needs.
• You have the right to be free from abuse, neglect, and exploitation.
• You have the right to be treated with dignity and respect.
• You have the right to be told before treatment: the procedure you will be given, the risks, side effects, and benefits of all medications and treatment you will receive, the other treatments that are available, and what may happen if you refuse treatment.
• The condition to be treated;
• The proposed treatment;
• The risks, benefits, and side effects of all proposed treatment and medication;
• The probable health and mental health consequences of refusing treatment; and
• Other treatments that are available and which ones, if any might be appropriate for you; and,

• You have the right to accept or refuse treatment after receiving this explanation.
• If you agree to treatment or medication, you have the right to change you mind at any time (unless specifically restricted by law).
• You have the right to a care plan designed to meet your needs.
• You have the right to refuse to take part in research without affecting your regular care.
• You have the right to have information about you kept private and to be told about the times when the information can be released without your permission.
• You have the right to be told in advance of all estimated charges and any limitations on the length of services that the facility is aware of.
• You have the right to make a complaint and receive a fair response from the clinic within a reasonable amount of time.
• You have the right to complain directly to the Department of State Health Services at any reasonable time.
• You have a right to get a copy of these rights before you are admitted, including the Department's address and phone number.
• You have the right to have your right explained to you in simple terms.

EAST TEXAS BORDER HEALTH CLINIC PATIENT GRIEVANCE [top]
East Texas Border Health has a grievance procedure that addresses all patient grievances. East Texas Border Health responds to all grievances promptly and objectively. East Texas Border Health, its staff members, volunteers, consultants, or anyone acting as an agent for East Texas Border Health do not discourage, intimidate, harass, or seek retribution against participants/ patients who try to exercise their rights or file a grievance.

Patients may seek remedy for any complaint and may grieve directly to any staff member. A patient may write or seek assistance to write their grievance if they are unable to read or write, or it may be made verbally in which case the staff member receiving the grievance must reduce the verbal grievance into writing immediately and seek the patient's signature to ensure that the grievance was recorded accurately. Patient shall be provided with pens and paper, envelopes, postage, and access to a toll free telephone number upon request in order to file a complaint.

Patients may have direct access to the Executive Director if the grievance is not resolved by the Physician Assistant. The Physician Assistant shall be responsible for forwarding such information within 24 hours of patient's request for grievance to be handled by the next level or if the Physician Assistant decides that the information should be resolved at a different level. The Chief Medical Officer shall follow the same procedures for informing the Executive Director if the grievance is not resolved within seven days, or to the patient's satisfaction. The Executive Director shall follow the same procedure for informing the Board of Directors if the grievance is not resolved within seven days, or to the patient's satisfaction.

All complaints on all levels shall be recognized within 24 hours (72 hours on weekends). East Texas Border Health informs the patient of the findings and recommendations within seven calendar days of the decision, but no longer than 30 days following the date of the grievance. East Texas Border Health evaluates the grievance thoroughly and objectively, obtaining additional information as needed. If more than seven days is necessary due to investigation or progressing through the chain of command as outlined above, the patient shall be informed of the status, including actions which have been taken and actions which will be taken, in writing within seven days, with an approximation on when the grievance will be resolved. The patient shall be informed, in writing, of progress and approximations of outcomes every seven-calendar days for the duration of the investigation. Participant/ patient have the right to grieve directly to the Texas Department of State Health Services Investigations Department or other agencies listed below at any time. The address and telephone and other applicable agencies are:

• Texas State Board of Medical Examiners (for reporting complaints against licensed physicians)
• 1812 Centre Creek Drive, Ste. 300
• Austin, TX 78754
• Texas Department of Human Services Hotline: (800) 252-5400
• Texas Rehabilitation Commission Service Number: (800) 628-5515
• Texas Department of Criminal Justice (TDCJ)
• 8712 Shoal Creek Blvd., #260
• Austin, TX 78757
• (512) 451-8442
• Texas Department of Protective and Regulatory Services - Child Protective Services (800) 252-5400
• Texas Department of Health's Info Line (800) 299-AIDS

The patient grievance procedure is legible and posted prominently at each program site where participants/ patients have the opportunity to read it at their leisure. East Texas Border Health, its staff members, volunteers, consultants, or anyone acting as an agent for East Texas Border Health shall not discourage, intimidate, harass, or seek retribution against participant/ patient who try to exercise their rights or file a grievance. East Texas Border Health, its staff members, volunteers, consultants, or anyone acting as an agent for East Texas Border Health shall not restrict, discourage, or interfere with patient communication with an attorney or with the appropriate credentialing or licensing department for the purposes of filing a grievance.

All staff and volunteers are instructed on the Patient Grievance Procedure. Staff members make every effort to resolve the grievance informally by discussing the situation or circumstances with the patient. Staff members who are involved will not be included in the acceptance, investigation or decision-making concerning the grievance. All staff members and volunteers must record formal grievances made by patient in the patient's chart within 24 hours (72 on the weekends) and notify the Physician Assistant or designee. An incident report will be completed within 24 hours.