|
Diamond Headache Clinic Privacy Practices
. . . .
Diamond Headache Clinic Notice of
Privacy Practices (download
Word file 71K)
THIS NOTICE DESCRIBES HOW MEDICAL
INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU
CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
The practice acts to maintain the privacy
of protected health information (a.k.a medical records) and
provide individuals with notice of the practice’s legal
duties and privacy practices with respect to protected health
information as described in this Notice and abide by the terms
of the Notice currently in effect.
Provision of
Notice: The practice provides its Notice of Privacy
Practices to every patient with whom it has a direct treatment
relationship. The Notice is provided no later than the date
of the first treatment to the patient after April 13, 2003.
The practice makes its Notice available
to any member of the public to enable prospective patients
to evaluate the practice’s privacy practices when making
his or her decision regarding whether to seek treatment from
the practice. The practice provides its Notice via e-mail
to any patient or other individual who so requests the Notice.
The practice does not routinely have indirect
treatment relationships with patients; however, in the case
of an indirect treatment relationship, the practice makes
its Notice available upon request to the patient in the indirect
treatment relationship.
Documentation
of Provision of Notice: When a direct treatment patient
receives the Notice from the practice, the practice asks the
patient to sign its "Receipt of Notice of Privacy Practices"
form. The form is filed with the patient’s medical record.
If the patient refuses to sign the form, it is noted in the
medical record that the patient was given the Notice and refused
to sign the form.
Effective Date
and Changes to Notice: This Notice is effective April
13, 2003. The practice reserves the right to revise this Notice
whenever there is a material change to the uses or disclosures,
the individual’s rights, the covered entity’s legal
duties, or other privacy practices stated in the Notice. Except
when required by law, a material change to any term of the
Notice will not be implemented prior to the effective date
of the notice in which such material change is reflected.
If the Notice is revised, the practice
makes the revised Notice available upon request beginning
on the revision’s effective date. The revised notice
is posted in the practice’s reception area and made available
to all patients, including those who have received a previous
Notice. Upon receipt of a revised Notice, a patient is asked
to acknowledge receipt of the Notice.
Complaints regarding
patient privacy rights: The practice allows all patients
and their agents to file complaints with the practice and
with the Secretary of the federal Department of Health and
Human Services (DHHS). A patient or his or her agent may file
a complaint with the practice whenever he or she believes
that the practice has violated their rights.
Complaints to the practice must be in
writing, must describe the acts or omissions that are the
subject of the complaint, and must be filed within 180 days
of the time the patient became aware or should have become
aware of the violation. Complaints must be addressed to the
attention of the practice’s privacy officer, Michelle
L Carr, at 467 West Deming Place, Suite 500, Chicago, IL 60614-1726.
The practice investigates each complaint and may, at its discretion,
reply to the patient or the patient’s agent.
Complaints to the Secretary of the Department
of Health and Human Services must be in writing, must name
the practice, must describe the acts or omissions that are
the subject of the complaint, and must be filed within 180
days of the time the patient became aware or should have become
aware of the violation. Complaints must be addressed to: Office
for Civil Rights, U.S. Department of Health and Human Services,
233 N. Michigan Ave., Suite 240, Chicago, Ill. 60601, Voice
Phone (312) 886-2359, FAX (312)886-1807, TDD (312)353-5693.
The practice does not take any adverse
action against any patient who files a complaint (either directly
or through an agent) against the practice.
Contact Person:
The practice has a privacy officer that serves as the contact
person for all issues related to the Privacy Rule. The privacy
officer is _Michelle L Carr . If you have any questions
about this Notice, please contact _Michelle L Carr at 467
West Deming Place, Suite 500, Chicago, IL 60614-1726.
USES AND DISCLOSURES
OF PROTECTED HEALTH INFORMATION
The practice reasonably ensures that the
protected health information (PHI) it requests, uses, and
discloses for any purpose is the minimum amount of PHI necessary
for that purpose.
The practice treats all qualified individuals
as personal representatives of patients. The practice generally
allows individuals to act as personal representatives of patients.
The two general exceptions to allowing individuals to act
as personal representatives relate to un-emancipated minors
and abuse, neglect, or endangerment situations.
The practice makes reasonable efforts
to ensure that protected health information is only used by
and disclosed to individuals that have a right to the protected
health information. Toward that end, that practice makes reasonable
efforts to verify the identity of those using or receiving
protected health information.
Uses and Disclosures
– Treatment, Payment, and Health Care Operations
The practice uses and discloses protected
health information for payment, treatment, and health care
operations. Treatment includes those activities related to
providing services to the patient, including releasing information
to other health care providers involved in the patient’s
care. Payment relates to all activities associated with getting
reimbursed for services provided, including submission of
claims to insurance companies and any additional information
requested by the insurance company so they can determine if
they should pay the claim. Health care operations include
a number of areas, including quality assurance and peer review
activities.
Uses and Disclosures
– Not Requiring Authorization
Disclosure to
Those Involved in Individual’s Care: The practice
discloses protected health information to those involved in
a patient’s care when the patient approves or, when the
patient is not present or not able to approve, when such disclosure
is deemed appropriate in the professional judgment of the
practice.
When the patient is not present, the practice
determines whether the disclosure of the patient’s protected
health information is authorized by law and if so, discloses
only the information directly relevant to the person’s
involvement with the patient’s health care.
The practice does not disclose protected
health information to a suspected abuser, if, in its professional
judgment, there is reason to believe that such a disclosure
could cause the patient serious harm. Further, the practice
uses and discloses information as required by law.
Uses and Disclosures
Required by Law: The practice uses and discloses protected
health information to appropriate individuals as required
by law.
As required by law the practice discloses
protected health information to public health officials. This
includes reporting of communicable diseases and other conditions,
sexually transmitted diseases, lead poisoning, Reyes Syndrome,
and mandated reports of injury, medical conditions or procedures,
or food-borne illness including but not limited to adverse
reactions to immunizations, cancer, adverse pregnancy outcomes,
death, birth.
The practice discloses protected health
information regarding victims of abuse, neglect, or domestic
violence. The practice discloses information about a minor,
disabled adult, nursing home resident, or person over 60 years
of age whom the practice reasonably believes to be a victim
of abuse or neglect to the appropriate authorities as required
by law or, if not required by law, if the individual agrees
to the disclosure. This includes child abuse and neglect,
elder abuse and exploitation, abused and neglected nursing
home residents, or disabled adults abuse.
The practice informs the individual of
the reporting unless the practice, in the exercise of professional
judgment, believes informing the individual would place the
individual at risk of serious harm or the practice would be
informing a personal representative, and the practice believes
the personal representative is responsible for the abuse,
neglect, or other injury, and that informing such person would
not be in the best interests of the individual as determined
by the professional judgment of the practice.
Uses and Disclosures
for Health Oversight Activities: The practice uses
and discloses PHI as required by law for health oversight
activities. The information may be used and released for audits,
investigations, licensure issues, and other health oversight
activities, including, but limited to hospital peer review,
managed care peer review, or Medicaid or Medicare peer review.
Disclosures for
Judicial and Administrative Proceedings: In general,
the practice discloses information for judicial and administrative
proceedings in response to an order of a court or an administrative
tribunal; or a subpoena, discovery request or other lawful
process, not accompanied by a court order or an ordered administrative
tribunal.
Disclosures for
Law Enforcement Purposes: The practice discloses PHI
for law enforcement purposes to law enforcement officials.
Uses and Disclosures
Related to Decedents: The practice uses and discloses
PHI as required to a coroner or medical examiner and funeral
directors as required by law. The attending physician is required
to sign the death certificate and provide the coroner with
a copy of the decedent’s protected health information.
Uses and Disclosures
Related to Cadaveric Organ, Eye or Tissue Donations:
The practice uses and discloses protected health information
to facilitate organ, eye or tissue donations.
Uses and Disclosures
to Avert a Serious Threat to Health or Safety: The
practice uses and discloses protected health information to
public health and other authorities as required by law to
avert a serious threat to health or safety.
Uses and Disclosures
for Specialized Government Functions: The practice
uses and discloses protected health information for military
and veterans activities, national security and intelligence
activities, and other activities as required by law.
Uses and Disclosures
in Emergency Situations: The practice uses and discloses
protected health information as appropriate to provide treatment
in emergency situations. In those instances where the practice
has not previously provided its Notice of Privacy Practices
to a patient who receives direct treatment in an emergency
situation, the practice provides the Notice to the individual
as soon as practicable following the provision of the emergency
treatment.
Marketing Purposes:
The practice does not use or disclose any protected health
information for marketing purposes. The practice does engage
in communications about products and services that encourages
recipients of the communication to purchase or use the product
or service for treatment, to direct or recommend alternative
treatments, therapies, health care providers, or settings
of care to the individual. These activities are not considered
marketing.
In addition, the practice will contact
the individual with appointment reminders or information about
treatment alternatives or other health-related benefits and
services that may be of interest to the individual.
Uses and Disclosures
– Other Uses and Disclosures: The practice does
not use or disclose protected health information to an employer
or health plan sponsor, for underwriting and related purposes,
for facility directories, to brokers and agents, or for fundraising.
If an individual wants the practice to
release his or her protected health information to employers
or health plan sponsors, for underwriting and related purposes,
for facility directories, or to brokers and agents, then he
or she can contact the practice and complete an appropriate
written authorization.
INDIVIDUAL RIGHTS
Individual Rights
– Accounting for Disclosures of Protected Health Information
The practice tracks all disclosures of a patient’s protected
health information that occur for other than the purposes
of treatment, payment, and health care operations, that are
not made to the individual or to a person involved in the
patient’s care, that are not made as a result of a patient
authorization, and that are not made for national security
or intelligence purposes or to correctional institutions or
law enforcement officials.
The practice allows an individual to request
one accounting within a 12-month period free of charge. The
practice charges a reasonable fee for more frequent accounting
requests. The charge will be $15.00. An individual can request
an accounting of disclosures for a period of up to six years
prior to the date of the request. Requests for shorter accounting
periods will be accepted. However, patients may only request
an accounting of disclosures made on or after April 14, 2003.
The practice responds to all requests
for an accounting of disclosures within 60 days of receipt
of the request. If the practice intends to provide the accounting
for disclosures and cannot do so within 60 days, the practice
informs the requestor of such and provides a reason for the
delay and the date the request is expected to be fulfilled.
Only one 30-day extension is permitted.
A request for an accounting for disclosures
must be made in writing and mailed or sent to the practice.
It should be marked "Attention: Privacy Officer."
Individual Rights – Inspect
and Copy Protected Health Information
The practice allows individuals to inspect and copy their
protected health information, documents all requests, responds
to those requests in a timely fashion, informs individuals
of their appeal rights when a request is rejected in whole
or in part, and charges a reasonable fee for the copying of
records.
The practice reviews the request in a
timely fashion and acts on a request for access generally
within 30 days. The practice may have a single extension of
30 days, if needed to act on the request. Each request will
be accepted or denied and the requestor notified in writing.
If a request is denied, the requestor is informed if the denial
is "reviewable" or not. The requestor has the right
to have any denial reviewed by a licensed health care professional
who is designated by the practice as a reviewing official
and who did not participate in the original decision to deny.
The practice informs the requestor of the decision of the
reviewing official and adheres to the decision.
The practice charges reasonable fees based
on actual cost of fulfilling the request. The practice will
determine the appropriate charge for providing the requested
records and inform the requestor in advance of providing the
records. If the requestor agrees to pay the fee in advance,
the records will be provided. Otherwise, the records will
not be provided, unless the Privacy Officer determines that
the charge is burdensome to the requestor. All payments MUST
be sent to the attention of the Privacy Officer marked MEDICAL
RECORDS PAYMENT to ensure proper documentation.
Illinois law prohibits charges that exceed
the following: $20.48 handling fee plus 77 cents each for
pages 1-25, 51 cents each for pages 26-50, and 26 cents each
for pages 51 to end; plus actual expenses related to the copying
of x-rays, CAT scans, and similar. The practice limits charges
for records to the amounts allowed under Illinois law.
Requests for the inspection and copying
of records must be sent to the practice in writing. It should
be marked "Attention: Privacy Officer."
Individual Rights – Request
Amendment to Protected Health Information
The practice allows an individual to request that the practice
amend the protected health information maintained in the patient’s
medical record or the patient’s billing record. The practice
documents all requests, responds to those requests in a timely
fashion, and informs individuals of their appeal rights when
a request is denied in whole or in part.
Generally the practice will act on a request
for amendment no later than 60 days after receipt of such
a request. If the practice cannot act on the amendment within
60 days, the practice extends the time for such action by
30 days and, within the 60-day time limit, provides the requestor
with a written statement of the reasons for the delay and
the date by which the practice will complete action on the
request. Only one such extension is allowed.
If the practice denies the request, in
whole or in part, the practice provides the requestor with
a written denial in a timely fashion. The practice allows
a requestor to submit a written statement disagreeing with
the denial of all or part of the initial request. The statement
must include the basis of the disagreement. The practice limits
the length of a statement of disagreement to one page.
The practice accepts requests to amend
the PHI maintained by the practice. The requests must be in
writing and should be marked "Attention: Privacy Officer."
Individual Rights – Request
Confidential Communications
The practice accommodates all reasonable requests to keep
communications confidential. The practice determines the reasonableness
based on the administrative difficulty of complying with the
request.
A request for confidential communications must be in writing,
must specify an alternative address or other method of contact,
and must provide information about how payment will be handled.
The request must be addressed to the practice’s privacy
officer. No reason for the request needs to be stated.
The practice accommodates all reasonable requests. The reasonableness
of a request is determined solely on the basis of the administrative
difficulty of complying with the request. The practice will
reject a request due to administrative difficulty: if no independently
verifiable method of communication such as a mailing address
or published telephone number is provided for communications,
including billing; or if the requestor has not provided information
as to how payment will be handled.
The practice will not refuse a request:
if the requestor indicates that the communication will cause
endangerment; or based on any perception of the merits of
the requestor’s request.
Individual Rights
– Request Restriction of Disclosures
The practice accepts all requests for restrictions of disclosures
of protected health information. The practice does not agree
to any restrictions in the use or disclosure of protected
health information. All requests for restrictions of disclosures
must be submitted in writing. They must be sent to the attention
of the practice’s privacy officer. The privacy officer
notifies the requestor in writing that the practice does not
accept restrictions of disclosure.
Individual Rights
– Authorizations
The practice obtains a written authorization from a patient
or the patient’s representative for the use or disclosure
of protected health information for other than treatment,
payment, or health care operations; however, the practice
will not get an authorization for the use or disclosure of
protected health information specifically allowed under the
Privacy Rule in the absence of an authorization. The practice
will provide a patient upon request a copy of any authorization
initiated by the practice (as opposed to requested by the
patient) and signed by the patient.
The practice does not condition treatment
of a patient on the signing of an authorization, except disclosure
necessary to determine payment of claim (excluding authorization
for use or disclosure of psychotherapy notes); or provision
of health care solely for purpose of creating protected health
information for disclosure to a third party (e.g., pre-employment
or life insurance physicals).
In Illinois, a specific written authorization is required
to disclose or release of mental health treatment, alcoholism
treatment, drug abuse treatment or HIV/Acquired Immune Deficiency
Syndrome (AIDS) information.
The practice allows an individual to revoke
an authorization at any time. The revocation must be in writing
and must be sent to the attention of the practice’s privacy
officer; however, in any case the practice will be able to
use or disclose the protected health information to the extent
practice has taken action in reliance on the authorization.
Individual Rights
– Waiver of Rights
The practice never requires an individual to waive any of
his or her individual rights as a condition for the provision
of treatment, except under very limited circumstances allowed
under law.
DIAMOND HEADACHE
CLINIC, LTD.
_______________________Consent for Release
and Use of Confidential Information and Receipt of Notice
of Privacy Practices Form
I, ____________________________________,
hereby give my consent to the Diamond Headache
(Name of Patient or Authorized Agent)
Clinic to use or disclose, for the purpose of carrying out
treatment, payment, or health care operations, all information
contained in the patient record of ____________________________.
(Patient’s Name)
I acknowledge receipt of the physician’s Notice of Privacy
Practices. The Notice of Privacy Practice provides detailed
information about how the practice may use and disclose my
confidential information.
I understand that the physician has reserved a right to change
his or her privacy practices that are described in the Notice.
I also understand that a copy of any Revised Notice will be
provided to me or made available at my first office visit
after the revision.
I understand that this consent is valid until it is revoked
by me. I understand that I may revoke this consent at any
time by giving written notice of my desire to do so, to the
physician. I also understand that I will not be able to revoke
this consent in cases where the physician has already relied
on it to use or disclose my health information. Written revocation
of consent must be sent to the physician’s office.
Signed: ____________________________________________
Date: ______________________
If you are not the patient, please specify
your relationship to the patient ___________________.
CONSENT FORM DEFINITIONS
"Health care operations" refers
to a large number of activities, including:
- Conducting quality assessment and improvement activities,
including outcome evaluation and development of clinical
guidelines, provided that the obtaining of generalizable
knowledge is not the primary purpose of any studies resulting
from such activities; population-based activities relating
to improving health or reducing health care costs, protocol
development, case management and care coordination, contacting
of health care providers and patients with information
about treatment alternatives; and related functions that
do not include treatment;
- Reviewing the competence or qualifications
of health care professionals, evaluating practitioner
and provider performance, health plan performance, conducting
training programs in which students, trainees, or practitioners
in areas of health care learn under supervision to practice
or improve their skills as health care providers, training
of non-health care professionals, accreditation, certification,
licensing, or credentialing activities;
- Underwriting, premium rating, and
other activities relating to creation, renewal or replacement
of a contract of health insurance or health benefits,
and ceding, securing, or placing a contract for reinsurance
of risk relating to claims for health care (including
stop-loss insurance and excess of loss insurance);
- Conducting or arranging for medical
review, legal services, and auditing functions, including
fraud and abuse detection and compliance programs;
- Business planning and development,
such as conducting cost management and planning-related
analyses related to managing and operating the entity,
including formulary development and administration, development
or improvement of methods of payment or coverage policies;
and
- Business management and general
administrative activities including but not limited to:
(a) management activities relating to HIPAA privacy rule
compliance; (b) customer services, including the provision
of data analyses for policy holders, plan sponsors, or
other customers, provided that protected health information
is not disclosed to such policy holder, plan sponsor,
or customer; (c) resolution of internal grievances; (d)
due diligence in connection with the sale or transfer
of assets to a potential successor in interest, if the
potential successor in interest is a covered entity or,
following completion of the sale or transfer, will become
a covered entity; and (e) creating de-identified health
information, fundraising for the benefit of the covered
entity, and marketing for which an individual authorization
is not required.
"Payment" means the activities
undertaken by the physician to obtain reimbursement for the
provision of health care. These activities referred to in
this definition relate to the individual to whom health care
is provided and include, but are not limited to:
- Determination of eligibility coverage (including coordination
of benefits or the determination of cost sharing amounts),
and adjudication or subrogation of health benefit claims;
- Billing, claims management, collection activities, obtaining
payment under a contract for reinsurance, and related health
care data processing;
- Review of health care services with respect to medical
necessity, coverage under a health plan, appropriateness
of care, or justification of charges;
- Utilization review activities, including precertification
and preauthorization of services, concurrent and retrospective
review of services; and
- Disclosure to consumer reporting agencies of any of the
following information relating to reimbursement: name and
address, date of birth, Social Security number, payment
history, account number, and name and address of the physician.
"Treatment" means the provision,
coordination, or management of health care and related services
by one or more health care providers, including the coordination
or management of health care by a health care provider with
a third party; consultation between health care providers
relating to a patient; or the referral of a patient for health
care from one health care provider or another.
"Use" means the sharing, employment,
application, utilization, examination, or analysis of patient
information within the physician’s practice that maintains
such information.
|
