3.00 - PROVISION OF PRIVACY NOTICE

I. Purpose:
To issue instructions to ADAMH workforce members regarding the provision of a notice of privacy practices to all patients and clients.

II. Applicability:
This policy applies to all ADAMH workforce members.

III. Authority:
45 CFR Parts 160 & 164

IV. Definitions:

Covered Entity (CE) means a health plan that provides, or pays the cost of, medical care, a health care clearinghouse, or a health care provider.

Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.

Use means with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

Health Plan means an individual or group plan that provides, or pays the cost of medical care as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg- 91(a)(2)).

Health Oversight Agency means an entity acting under a grant of authority from, or a contract with a State, that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance.

Protected Health Information (PHI) means individually identifiable information relating to the past, present or future physical or mental health or condition of an individual, provision of health care to an individual, or the past, present or future payment for health care provided to an individual.

Workforce Members means Board of Trustees members, employees, volunteers, trainees, and other persons whose conduct, in the performance of work for ADAMH, is under the direct control of ADAMH, regardless of whether they are paid by ADAMH.

Treatment, Payment and Operations (TPO) includes all of the following:

Treatment means the provision, coordination, or management of health care and related services, consultation between providers relating to an individual, or referral of an individual to another provider for health care.
Payment means activities undertaken to obtain or provide reimbursement for health care, including determinations of eligibility or coverage, billing, collection activities, medical necessity determinations and utilization review.
Operations includes functions such as quality assessment and improvement activities, reviewing competence or qualifications of health care professionals, conducting or arranging for medical review, legal services and auditing functions, business planning and development, and general business and administrative activities.

V. Policy:

1. Generally: In compliance with 45 CFR 164.520, an individual has a right to adequate notice of the uses and disclosures of their PHI that may be made by or on behalf of ADAMH as a CE, and of the individual's rights and ADAMH's legal duties with respect to their PHI. This right to a notice of privacy practices does not apply to inmates of correctional facilities.
2. Content Requirements: The notice of privacy practices must be written in plain language and must contain the following elements:
   1. The following statement in a header or otherwise prominently displayed: "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."
   2. A description, including at least one example, of the types of uses and disclosures that ADAMH is permitted to make for purposes of treatment, payment and health care operations, with sufficient detail to place an individual on notice of the uses and disclosures permitted or required.
   3. A description of each of the other purposes for which ADAMH is permitted or required to use or disclose PHI without an individual's consent or authorization, with sufficient detail to place an individual on notice of the uses and disclosures permitted or required.
   4. A statement that other uses or disclosures will be made only with the individual's written authorization, and that the authorization may be revoked in accordance with the policy on authorizations.
   5. If ADAMH intends to contact the individual for follow-up regarding ADAMH-related business.
   6. A statement of the individual's rights with respect to his/her PHI, and a brief description of how the individual may exercise those rights, including: the right to request restrictions on certain uses/disclosures of PHI, and the fact that ADAMH does not have to agree to such restrictions; the right to receive confidential communications of PHI; the right to inspect and copy PHI; the right to amend PHI; the right to receive an accounting of disclosures of PHI, and; the right to receive a paper copy of the privacy notice (each of the above in accordance with relevant policies).
   7. A statement of ADAMH's duties with respect to PHI, including statements: that ADAMH is required by law to maintain the privacy of PHI and to provide individuals with notice of its legal duties and privacy policies; that ADAMH is required to abide by the terms of the currently effective privacy notice, and; that ADAMH reserves the right to change the terms of the notice and make the new notice provisions effective for all PHI maintained, along with a description of how ADAMH will provide individuals with the revised notice.
   8. A statement that individuals may complain to ADAMH and to the Secretary of the U.S. Department of Health and Human Services about privacy rights violations, including a brief statement about how a complaint may be filed and an assurance that the individual will not be retaliated against for filing a complaint.
   9. The name, or title, and telephone number of the person or office to contact for further information.
   10. The effective date of the notice, which may not be earlier than the date printed or published.
3. Revisions to Notice: ADAMH must promptly revise and distribute the privacy notice to all covered individuals whenever there is a material change to the uses or disclosures, the individual's rights, ADAMH's legal duties, or other privacy practices described in the notice. Except when required by law, a material change to any term may not be implemented prior to the effective date of the notice reflecting the change.
4. Provision of Notice: As a health plan, ADAMH must do the following:
   1. Make its notice available to any person who asks for it.
   2. Prominently post and make available its notice on any web site it maintains that provides information about its customer services or benefits.
   3. Provide the notice to individuals then covered by the plan no later than April 14, 2003, and to new enrollees at the time of enrollment.
   4. Provide a revised notice to individuals then covered by the plan within 60 days of a material revision.
   5. Notify individuals then covered by the plan of the availability of and how to obtain the notice at least once every three years.
   The privacy notice must also be prominently posted on the ADAMH's web site and available electronically from the web site.
5. Documentation Requirements: ADAMH must retain copies of notices issued for a period of at least six years from the later of the date of creation or the last effective date.