Policy Purpose

Individuals are entitled to adequate notice of the uses and disclosures of their protected health information, of their rights and JCMC/AMM responsibilities with respect to PHI unless an exception applies. The Privacy Rule requires JCMC/AMM to describe its privacy practices in plain English, in a document called a Notice of Privacy Practices (“Notice”). JCMC/AMM must give individuals a copy of this document.

Policy

JCMC/AMM must make its Notice available to all individuals and post the Notice throughout its facilities and on its website. JCMC/AMM must also make a good faith effort to obtain written acknowledgements from patients that they have received the Notice. The Notice must contain all of the required elements notifying an individual of the permitted uses and disclosures; uses and disclosures that require an opportunity for them to agree or object; uses and disclosures that require an authorization; whether the JCMC/AMM intends to use or disclose information for marketing, facility directories or fundraising; the individual’s rights to access, amendment, and limitations on sharing; the JCMC/AMM’s responsibilities; a way to make complaints; contact details for further information; and an effective date.

Procedures
Notice Content Requirements

The Notice shall contain the following content:

  • Header: The Notice must contain this exact language as a header or otherwise prominently displayed:
    “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”
    Uses and Disclosures: This part of the Notice must contain:
  • A description, including at least one example of the types of uses and disclosures of information that the JCMC/AMM is permitted to make for each of the following purposes: treatment, payment, and health care operations.
  • A description of each of the other purposes (other than treatment, payment, or health care operations) for which the JCMC/AMM is permitted or required to use or disclose PHI without the individual’s written authorization.
  • If a use or disclosure otherwise allowed under the two paragraphs above is materially limited or prohibited by a stricter law, the description of the use or disclosure must reflect the more stringent law.
  • The description of the use or disclosures allowed under paragraphs the first two paragraphs above must include sufficient detail to place the individual on notice of the uses and disclosures that are permitted or required by applicable law.
  • A description of the types of uses and disclosures that require authorization including psychotherapy notes, marketing, and sale of protected health care information. Another statement that other uses and disclosures not described in the Notice will be made only with the individual’s written authorization and that the individual may revoke authorization at any time in writing – revocation will be effective except to the extent the JCMC/AMM has acted in reliance on it; and
  • If JCMC/AMM intends to use information in any of the following ways and acts in the capacity of the covered entity mentioned, it must include a separate statement in the Notice for each of the following activities: (i) Covered entity may contact individuals for fundraising activities and the individual has a right to opt out; (ii) a group health plan, health insurance issuer or HMO may share PHI to the plan sponsor; or (iii) a non-long term care health plan may use information for underwriting purposes, excluding the use of genetic information.

Individual Rights: The Notice must contain a statement of the individual’s rights with respect to PHI, and how he or she may exercise the right to:

  • Request restrictions on certain uses and disclosures of information (the notice must contain a statement that the JCMC/AMM is not required to agree to all requested restrictions).
  • Receive confidential communications of PHI.
  • Inspect and copy their own PHI.
  • Seek amendment of their own PHI.
  • Receive an accounting of disclosures of their own PHI; and
  • Obtain a paper copy of the Notice of Privacy Practices upon request even if an electronic copy has already been provided.

JCMC/AMM’s Duties: The Notice must include statements of the following:

  • JCMC/AMM is required by law to maintain the privacy of protected health information, to provide individuals with notice of its legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured PHI.
  • JCMC/AMM must abide by the terms of the Notice currently in effect; and
  • If JCMC/AMM desires to reserve the right to amend the Notice, the Notice must state that JCMC/AMM reserves the right to change the terms of its Notice and to make the new Notice provisions effective for all PHI it maintains. This statement must also explain how the JCMC/AMM will give individuals a revised Notice.

Complaints: The Notice must explain that individuals may file a complaint with the JCMC/AMM and/or the Secretary of HHS if they believe their privacy rights have been violated. A brief description of how to file a complaint with the JCMC/AMM must be included along with a statement that the individual will not be retaliated against for filing a complaint.

Contact Information: The Notice must contain the name, or title, and telephone number of a person or office to contact for further information.

Effective Date: The Notice must contain an effective date that is not earlier than the date it is published.

Notice Dissemination and Publication Requirements
  1. The JCMC/AMM must provide the Notice to individuals no later than the date of the first service delivery by a direct care provider. The Notice may also be given to an individual by e-mail if the individual agrees to such electronic notice. If the JCMC/AMM knows that the e-mail transmission has failed, it must provide a hard paper copy. If the first service is delivered electronically, the JCMC/AMM must send the notice electronically and contemporaneously with provision of the service.
  2. The JCMC/AMM must make the Notice available for individuals to take with them. (When the individual is not physically present, the Notice may be sent by first class mail.)
  3. The Notice must be posted in a clear and prominent location where individuals can be expected to be able to read the Notice.
  4. The Notice shall be posted prominently on the JCMC/AMM’s website (if any) and shall be available electronically through the website.
  5. If the JCMC/AMM participates in an organized health care arrangement, it may comply with the Notice requirements by a joint Notice if it meets the requirements of 45 CFR 520(d).
Special Notice Requirements
  1. No Notice is required to be given to inmates who may receive treatment at an JCMC/AMM’s facility.
  2. In the case of patients who are minors, the Notice should be given to the minor’s parent or guardian.
  3. If JCMC/AMM is a group health plan, Notice shall be available directly from the group health plan if the group health plan is uninsured or if it creates or receives PHI in addition to summary plan information, participation information, or enrollment information. If the group health plan provides benefits through an insurer or HMO and does not receive the above information, then Notice is provided through the insurer or HMO.
Optional Elements
  1. If JCMC/AMM elects to limit its use and disclosure beyond the required limitations, it may describe the more limited use and disclosures although it may not limit uses and disclosures required by law or allowed to the individual.
  2. The JCMC/AMM must reserve its right to revise its Notice to change its limited uses for any information created or received prior to the revision.
Acknowledgement of Notice of Privacy Practices
  1. The JCMC/AMM will make a good faith effort to obtain a written Acknowledgement that the individual received the Notice. If an individual refuses to sign the Acknowledgement, then we will document the good faith efforts taken and the reason the Acknowledgement was not obtained.
  2. A “good faith effort” to obtain written acknowledgment is not required when emergency treatment or stabilization is needed. Additionally, if the JCMC/AMM mails the notice to the correct address even if the individual does not return the acknowledgment form, the JCMC/AMM does not need to make further good faith efforts to obtain a written acknowledgment.
  3. In non-emergency situations, JCMC/AMM will seek to obtain acknowledgement of the Notice during the intake process.
Revisions to the Notice of Privacy Practices
  1. The JCMC/AMM must promptly revise and distribute its Notice whenever there is a material change to privacy practices, including practices regarding PHI uses and disclosures, individual’s rights, and JCMC/AMM’s legal duties, or other privacy practices stated in the Notice.
  2. JCMC/AMM must make the revised notice available upon request.
  3. JCMC/AMM must post the Notice in service delivery areas.
  4. JCMC/AMM must post the revised notice on its website.
  5. Unless JCMC/AMM reserved the right to amend its Notice within the previous Notice, it may not make any changes applicable to PHI created or received prior to the effective date of the new Notice.
Record Retention

All versions of the JCMC/AMM approved Notice of Privacy Practices will be archived and maintained by the Privacy Officer for a period no less than six (6) years from the date of its creation or the date when it was last in effect, whichever is later. Any acknowledgments of receipt or good faith efforts to obtain such acknowledgements must also be retained no less than six (6) years from the date when it was received or the date when it was last in effect, whichever is later.

RELEVANT HIPAA REGULATIONS: