Privacy Policy

PURPOSE

To establish clear, appropriate and acceptable confidentiality of Protected Health Information (PHI) and all aspects of confidentiality, and to establish and maintain processes and resources for reporting, investigating, and resolving potential violations of applicable Federal and State laws within the organization. 

POLICY 

It is the policy of Keys To Tranquility (KTT) to establish a mechanism to protect the confidentiality of individual identifiable member health and financial information from any unauthorized intentional or unintentional use or disclosure in accordance with the requirements set forth in HIPAA 45 CFR 164.

Definition

Protected Health Information (PHI) – Any individually identifiable health or financial information, whether verbal, written, electronic, or otherwise recorded in any form or medium that is:

1. Created or received by KTT or one of its employees, agents or contracted service providers
2. Related to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual or the past, present, or future payment for the provision of health care to an individual

The Federal Privacy Regulations further specify that the following 17 pieces of “Individually Identifiable Information” that, when linked with health or medical information, constitutes PHI (45 CFR 164.514):

1. Names of the individual, and relatives, employers or household members of the individual
2. Geographic identifiers of the individual, including subdivisions smaller than a state, street address, city, county and precinct
3. Zip code at any level less than the initial three digits; except if the initial 3 digits cover a geographical area of 20,000 or less people, than zip code is considered an identifier
4. All elements of dates, except year, or dates directly related to an individual including birth date, admission date, discharge date, date of death and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older
5. Telephone numbers
6. Fax numbers
7. Electronic mail addresses
8. Social Security numbers
9. Medical record numbers
10. Health plan beneficiary numbers
11. Account numbers
12. Certificate/license numbers
13. Vehicle identifiers and serial numbers, including license plate numbers
14. Device identifiers and serial numbers
15. Web Universal Resource Locators (URLs)
16. Internet Protocol (IP) address numbers
17. Biometric identifiers, including finger and voice prints
18. Full-face photographic images and any comparable images

PROCEDURE

Protected Health Information may not be released without a complete and valid written consent or authorization signed by client, parent or legally authorized representative unless a release of the PHI is specifically allowed by State and Federal law without a valid authorization.  

Confidentiality Statement: All KTT staff is required to sign the KTT Confidentiality Statement before they are granted access to PHI.

All KTT employees that suspect, discover, or receive a report of PHI violations from another party have the obligation to report that violation in writing, in person, or by telephone to a supervisor, the Vice President, or anonymously.

Any personnel or contractors that report a violation should discuss the situation only with direct supervisors or the Vice President to ensure that confidentiality of the affected area/individuals can be maintained.

For supervisors that receive notice of a potential violation, this is to be communicated to the Vice President within twenty-four (24) hours.  The supervisor should not discuss the violation with other parties.

When the Vice President receives a report of a potential violation, he/she will then prepare a confidential corporate compliance report (if one has not been completed yet).  The Vice President will then conduct an initial investigation based on the report and coordinate with legal counsel if necessary.

PURPOSE

To assure the protection of all client rights to privacy and define the process through which Federal Confidentiality Guidelines are implemented.

POLICY

Confidentiality is a fundamental component of quality clinical services.  It is therefore the policy of Keys To Tranquility to safeguard the client right to privacy with respect to confidential information disclosed or revealed in the therapeutic setting.

In order to insure that client confidentiality is protected, upon employment all staff members of KTT will be required to review Federal Confidentiality Regulations relating to the “Confidentiality of Alcohol and Drug Abuse Patient Records,” and other confidentiality laws that may be applicable at that time. After having reviewed said laws and regulations, the employee will be required to sign a statement acknowledging their understanding of this material, the implications contained therein, and that the employee agrees to abide by all applicable confidentiality and privacy regulations.  A copy of this signed statement will be included in each employee’s personnel file.

Federal Confidentiality Regulations, 42 CFR Part 2 “Confidentiality of Alcohol and Drug Abuse Patient Records,” will define the basic framework within which all operating policies and practices of KTT are to be conducted. Any exceptions to the contents of this policy are to be enacted only in accordance with relevant clauses contained within the Federal Confidentiality Regulations, and then only upon approval of the President.  In the absence of the President, the Program Director will make such determinations as may be necessary.

The full text of the most recent Federal Confidentiality Regulations will be available through the Vice President.  In summary, these regulations state:

• Program staff shall not convey to a person outside of the program that a client attends or receives services from the program or disclose any information identifying a client as an alcohol or other drug services client unless the client consents in writing for the release of information, the disclosure is allowed by a court order, or the disclosure is made to qualified personnel for a medical emergency, research, audit or program evaluation purposes.
• Federal laws and regulations do not protect any threat to commit a crime, any information about a crime committed by a client either at the program or against any person who works for the program.
• Federal laws and regulations do not protect any information about suspected child abuse or neglect being reported under state law to appropriate state or local authorities.

Any violation of client confidentiality, or knowledge of such violation, shall be immediately reported to the affected employee’s direct supervisor; who will immediately inform the Vice President.

Violation of client confidentiality by a staff member will result in disciplinary action that may include termination of employment.  Violation of one client’s confidentiality by another client may result in termination of services to the client who initiated the breach.

With the exception of situations previously referenced in this policy, and more fully described in the Federal Confidentiality Regulations, confidential information held by Keys To Tranquility may only be released or disclosed if the client in question has properly executed an “Authorization to Use and Disclose Protected Health Information” form.  Said information to be released or disclosed may include only information accumulated through the client’s involvement with KTT Reports from other organizations may be released only by the organization from which the report originated, unless the client has signed a specific “Authorization to Use and Disclose Protected Health Information” form that allows KTT to re-disclose such information.

“Authorization to Use and Disclose Protected Health Information” forms shall contain the following information:

• Name of the organization or person to whom information may be disclosed
• Extent and nature of the information to be disclosed
• Purpose for the disclosure
• Date upon which the authorization to disclose information automatically expires
• Signature of the client about whom information is to be communicated; or, in the case of a minor client, the signature of a legal guardian
• Prohibition on Redisclosure Statement

Confidential client information may be disclosed among employees of the different departments comprising KTT only to the extent necessary for said employees to perform the expected functions of their employment. Graphically illustrated, confidential client information may be disclosed within a department and upwardly within the agency’s internal table of organization. All other internal disclosures shall be limited to the extent necessary for the performance of one’s position responsibilities.

Information to be released to other organizations must be disclosed only in accordance with this policy, and with the best interest of the client as a paramount factor.  Such disclosures will contain only that information necessary to satisfy the professional obligations of KTT Disclosure of incidental information shall be avoided whenever possible.

Authorized disclosures of confidential client information to other organizations will be conducted by the clinician who is primarily responsible for the treatment of said client. If this is not possible or prudent, the Vice President shall oversee the disclosure of confidential client information.

Confidential records are to be maintained in locked quarters within the agency at all times or secured electronically and password protected using the EMR system (KIPU).

In accordance with state law with regards to confidentiality, a client may request information pertaining to their clinical record. Said request should be submitted in writing to either the Clinical Director or the Vice President. Any information to be released shall include only elements detailed in the Release of Information Policy.

Keys To Tranquility

HIPAA

This notice describes how medical information about you may be used and disclosed and how you can get access to this information.

Treatment, payment and health care operations:

Keys To Tranquility (hereinafter Keys To Tranquility) uses and discloses your protected health information for treatment, payment, and health care operations. Some examples of when our office may use or disclose your health care information for these purposes include:

• Sharing test results with other health care providers for confirmation of a diagnosis;
• Providing your diagnosis or other information about your health to your insurance provider or our billing service to obtain payment for the health care services we provide;
• Reviewing information as part of our quality improvement program.

Other uses and disclosures:

Keys To Tranquility may also use or disclose your protected health information, in compliance with guidelines outlined by law, for the following purposes:

• Providing you with information related to your health;
• Contacting you regarding appointments, information about treatment alternatives, or other health related services;
• Incidental uses or disclosures (e.g., listing your name on a sign-in sheet, etc.); 
• Compliance with all laws (including reports of suspected abuse, neglect or violence);
• Providing certain specified information to law enforcement or correctional institutions;
• Providing information to a coroner, medical examiner, funeral director or organ procurement organization;
• Public health activities when requested by a public health authority or the FDA. Responding to health oversight agencies;
• Responding to court or administrative tribunal orders, subpoenas, discovery requests or other lawful process;
• Research activities
• When necessary to avert a serious threat to health or safety;
• Military affairs, veterans affairs, national security, intelligence, Department of State, or presidential protective service activities;
• Providing information to public or private disaster relief agencies; or Information to a family member, other relative, or close personal friend when: notification of your location, general condition or death; to assist in your health care (e.g. pick-up prescriptions or other documents, note follow-up care instructions, etc.)

Authorization for other uses: Keys To Tranquility will make other uses and disclosure of your protected health information only after obtaining your written authorization. If you authorize a use not contained in this notice, you may revoke your authorization at any time, by notifying us in writing that you wish to revoke your authorization.

Your rights regarding the privacy of your health information: Subject to limitations outlined by law, you have certain rights related to use and disclosure of your protected health information, including the right to:

• Request restrictions on certain uses and disclosures. However, Keys To Tranquility is not obligated to agree to requested restrictions;
• Receive confidential communications or protected health information;
• Inspect and copy your protected health information with some limited exceptions;
• Amend your health information;
• Receive an accounting of disclosures of your health information;
• Obtain a copy of this notice.

Keys To Tranquility duties regarding the privacy of your health information:

Subject to limitations outlined by law, Keys To Tranquility has certain duties related to your protected health information, including:  

• Keys To Tranquility is required by law to maintain the privacy of protected health information and to provide individuals with notice of our legal duties and privacy practices with respect to protected health information.
• Keys To Tranquility is required to abide by the terms of the privacy notice that is currently in effect.
• Keys To Tranquility reserves the right to change a privacy practice described in this notice and to make such change effective for all protected health information. Revised notice will be posted in our office and available upon request.