Healing Hands Healthcare, LLC
HIPAA Notice of Privacy Practices
In compliance with HIPAA – The Health Insurance Portability and Accountability Act of 1996
If you are a client of Healing Hands Healthcare, this notice describes how your medical information may be used and disclosed and how you can get access to this information.
Effective Date of this amended Notice of Privacy Notice is May 11th 2017
USES AND DISCLOUSRES
Healing Hands Healthcare will not disclose your health information without your authorization, except as described in this notice.
Plan of Care/Treatment. The Agency will use your health information for the plan of care/treatment; for example, information obtained by a nurse/therapist will be recorded in your record and used to determine the course of treatment. Your nurse/therapist and other health care professionals will communicate with one another personally and through the case record to coordinate the care provided. You may receive more than one service (program) during your treatment period with such information shared between programs.
Payment. The Agency will use your health information for payment for services rendered. For example, the Agency may be required by your health insurer to provide information regarding your health care status so that the insurer will reimburse you or the Agency. The Agency may also need to obtain prior approval from your insurer and may need to explain to the insurer your need for home care and the services that will be provided to you.
Health Care Operations. The Agency will use your health information for health care operations. For example, Agency therapist, nurse, field staff, supervisors and support staff may use information in your case record to assess the care and outcomes of your case and others like it. This information will then be used in an effort to continually improve the quality and effectiveness of the services we provide. Regulatory and accrediting organizations may review your case record to ensure compliance with their requirements.
Notification. In an emergency, the Agency may use or disclose health information to notify or assist in notifying a family member, personal representative or another person responsible for your care, of your location and general condition.
Public Health. As required by federal and state law, the Agency may disclose your health information to public health or legal authorities charged with preventing or controlling disease, injury or disability.
Law Enforcement. As required by federal and state law, the Agency will notify authorities of alleged abuse/neglect; and risk or threat of harm to self or others. We may disclose health information for law enforcement purposes as required by law or in response to a valid subpoena.
Fundraising. The Agency may contact the patient to raise funds for the agency, or participation in marketing and advertising events.
Charges against the Agency. In the event, you should file suite against Healing Hands Healthcare, we may disclose health information necessary to defend such action.
Duty to Warn. When a patient communicates to the Agency a serious threat of physical violence against himself/herself or a reasonably identifiable victim or victims, the Agency will notify with the threatened person(s) and/or law enforcement.
The Agency may also contact you about appointment reminders, treatment alternatives or for public relations activities.
In any other situation, the Agency will require your written authorization before using or disclosing any identifiable health information about you. If you choose to sign such an authorization to disclose information, you can revoke that authorization to stop any future uses and disclosures.
INDIVIDUAL RIGHTS
You have the following right with respect to your protected health information:
1. You may request in writing that the Agency not use or disclose your information for treatment, payment or administration purposes or to persons involved din your care except when specifically authorized by you, when required by law, or in emergency situations. The Agency will consider your request; however, the Agency is not legally required to accept it. You have the right to request that your health information be communicated to you in a confidential manner such as sending mail to an address other than your home.
2. Withing the limits of the statutes and regulations, you have the right to a copy of your medical record, free of charge, upon request at the next home visit, or within 4 business days (whichever comes first).
3. If you believe that information in your record is incorrect or if important information is missing, you have the right to submit a request to the Agency to amend your protected health information by correcting the existing information or adding the missing information.
4. You have the right to receive an accounting of disclosures of your protected health information made by the Agency for certain reasons, including reasons related to public purposes authorized by law and certain research. The request for an accounting must be made in writing to the Privacy Officer. The request should specify the time period for the accounting starting on or after April 14, 2003. Accounting requests may not be made for periods of time in excess of six (6) years. The Agency would provide the first accounting you request during any 12-month period without charge. Subsequent accounting request may be subject to a reasonable cost-based fee.
5. You have the right to opt out of receiving fundraising & marketing communications.
6. You have the right to restrict disclosures of protected health information to a health plan where the individual paid out of pocket in full. When patients pay by cash, they can instruct this agency not to share information about their treatment with their health plan/insurance provider.
7. If this notice was sent to you electronically, you may obtain a paper copy of the notice upon request to the Agency.
8. When patients pay by cash, they can instruct this agency not to share information about their treatment with their health plan/insurance provider.
AGENCY’S DUTIES
1. The Agency is required by law to maintain the privacy of protected health information and to provide individuals with notice of its legal duties and privacy practices with respect to protected health information.
2. It is the duty of this agency to notify the patient of a breach of their protected health information. This agency will notify the patient within 15 business days of discovery of any breach in the patient’s protected health information. Notification will occur regardless of whether the breach was accidental or if a business associate was the cause. A “breach” of PHI is any unauthorized access, use or disclosure of unsecured PHI, unless a risk assessment is performed that indicates there is a low probability that the PHI has been compromised. The risk assessment must be performed after both improper uses and disclosures and include the nature and extent of the PHI involved, a list of unauthorized persons who used or received the PHI, if the PHI was in fact acquired or viewed and the degree of mitigation. This agency, and if any business associate was involved, must consider all the following factors in assessing the probability of a breach:
- The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification.
- The unauthorized person who used the protected health information or to whom the disclosure was made.
- Whether the protected health information was actually acquired or viewed; and
- The extent to which the risk to the protected health information has been mitigated.
“Unsecured” protected health information means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology.
3. If the breach is determined to have no or low probability of risk to the patient then the patient will not be notified. Any other risk factor requires the agency to notify the patient in writing within 15 business days of the conclusion of the determination.
4. It is the duty of this agency to notify the patient of a breach of their protected health information. This agency will notify the patient within 15 business days of discovery of any breach in the patient’s protected health information. Notification will occur regardless of whether the breach was accidental or if a business associate was the cause. A “breach” of PHI is any unauthorized access, use or disclosure of unsecured PHI, unless a risk assessment is performed that indicates there is a low probability that the PHI has been compromised. The risk assessment must be performed after both improper uses and disclosures and include the nature and extent of the PHI involved, a list of unauthorized persons who used or received the PHI, if the PHI was in fact acquired or viewed and the degree of mitigation. This agency, and if any business associate was involved, must consider all the following factors in assessing the probability of a breach:
- The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification;
- The unauthorized person who used the protected health information or to whom the disclosure was made;
- Whether the protected health information was actually acquired or viewed; and
- The extent to which the risk to the protected health information has been mitigated.
“Unsecured” protected health information means protected health information that is not rendered unusable, unreadable or indecipherable to unauthorized individuals through the use of a technology or methodology.
5. If the breach is determined to have no or low probability of risk to the patient, then the patient will not be notified. Any other risk factor requires the agency to notify the patient in writing within 15 business days of the conclusion of the determination. The Agency reserves the right to change the terms of this Notice and to make the new Notice provisions effective for all protected health information that it maintains. Prior to making any significant changes to our policies, Agency will change its Notice and provide you with a copy. You can also request a copy of our Notice at any time. For more information about our privacy practices, please contact the office (940) 432-0588.
6. When patients pay by cash, they can instruct this agency not to share information about their treatment with their health plan/insurance provider.
7. This agency will not disclose genetic information.
8. This agency will not use patient information for fundraising or marketing. This agency will not sale patient health information.
COMPLAINTS
If you are concerned that the Agency has violated your privacy rights, or you disagree with a decision the Agency made about access to your records, you may contact the office at (940) 432-0588. You may also send a written complaint to the Federal Department of Health and Human Services. The Healing Hands Healthcare office staff can provide you with the appropriate address upon request. Under no circumstances will you be retaliated against for filing a complaint.
CONTACT INFORMATION
The Agency is required by law to protect the privacy of your information, provide this Notice about our information practices, and follow the information practices that are described in this Notice.
If you have any questions or complaints, please contact:
Agency Administrator: Summer Napier, RN
You may contact this person at:
Healing Hands Healthcare
901 Indiana Avenue, Suite 665
Wichita Falls, TX 76301
Phone: (940) 432-0588
Complaints may also be directed to the State Licensing Authority without fear of retaliation.
Department of Aging and Disability Services,
Texas Health and Human Services, Complaint and Incident Intake,
Mail Code E-249, P.O. Box 149030
Austin, Texas 78714-9030
Toll Free: 1-800-458-9858