7.00 - INDIVIDUALS' RIGHTS RELATED TO PROTECTED HEALTH INFORMATION

I. Purpose:
To issue instructions regarding ADAMH's obligations relating to patient's/client's rights relating to access to and use/disclosure of their protected health information (PHI).

II. Applicability:
This policy applies to all ADAMH workforce members.

III. Authority:
45 CFR Parts 160 & 164

IV. Definitions:

Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.

Use means with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

Protected Health Information (PHI) means individually identifiable information relating to past, present or future physical or mental health or condition of an individual, provision of health care to an individual, or the past, present or future payment for health care provided to an individual.

Designated Record Set means a group of records maintained by or for the ADAMH Board that includes medical, billing enrollment, payment, claims adjudication, and other records used to make decisions about an individual.

Personal Representative means a person who has authority under applicable law to make decisions related to health care on behalf of an adult or an emancipated minor, or the parent, guardian, or other person acting in loco parentis who is authorized under law to make health care decisions on behalf of an unemancipated minor, except where the minor is authorized by law to consent, on his/her own or via court approval, to a health care service, or where the parent, guardian or person acting in loco parentis has assented to an agreement of confidentiality between the provider and the minor.

Business Associate (BA) means a person or entity who, on behalf of ADAMH, but not in the capacity of a workforce member, performs, or assists in the performance of, a function or activity involving the use or disclosure of PHI, or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services involving disclosure of PHI.

Privacy Notice means the notice of privacy practices relating to the ADAMH Board's use and disclosure of PHI that is mandated under HIPAA regulations for distribution to all individuals whose information will be collected by or on behalf of the ADAMH Board.

Workforce Members means Board of Trustees members, employees, volunteers, trainees, and other persons whose conduct, in the performance of work for ADAMH, is under the direct control of ADAMH, regardless of whether they are paid by ADAMH.

V. Policy:

1. INDIVIDUALS' ACCESS TO PHI: Individuals have a right to access and copy their PHI and any information in their designated record set, except as set forth below:
   1. Denial of Access without a right of review: Access may be denied where:
      1. Information was compiled in anticipation of litigation;
      2. Information was collected in the course of research that includes treatment of the individual and the individual agreed to a suspension of the right of access during the research period;
      3. Access can be denied in accordance with the Clinical Laboratory Improvements Amendments of 1988 (CLIA) or the Privacy Act (5 USC 552a).
   2. Denial of Access with a right of review: Access may be denied, though denial is subject to review where:
      1. Access is determined by a licensed professional to be likely to endanger life or physical safety of the individual or another person;
      2. Access is requested by a Personal Representative and a licensed professional determines that such access is reasonably likely to cause substantial harm.
   3. Right of Review: If the basis for denial of access gives a right of review, the individual has a right to have the denial reviewed by another licensed professional who did not participate in the original denial decision. Such review must be complete within a reasonable period of time, and ADAMH must promptly: (i) provide the individual with notice of the reviewer's decision, and (ii) comply with the determination to provide or deny access.
   4. Timely Review: The ADAMH Board must act on a request for access no later than thirty (30) days after receipt unless the time period is extended as permitted below:
      1. If the information to be accessed is not maintained or accessible on-site, ADAMH must act on the request no later than sixty (60) days after receipt.
      2. If the ADAMH Board is unable to act on the request for access within the applicable 30 or 60 day period, it may extend the time for response by no more than thirty (30) days, provided that, within the original allotted time period, the ADAMH Board gives the individual written notice of the reasons for the delay and the date by which a responsive action will be taken.
   5. Provision of Access: The ADAMH Board must provide the individual with access to the information in the form or format requested if it is readily producible in such form or format, or in a readable hard copy or other form or format as mutually agreed to, either by arranging for a convenient time and place for inspection and copying, or mailing the information at the individual's request.
      1. If the information is maintained in more than one place, the information need only be produced once in response to a current request for access.
      2. The ADAMH Board may provide a summary of the information in lieu of providing access, or may provide an explanation of the information to which access is provided if the individual, in advance, agrees.
      3. The ADAMH Board may impose a reasonable, cost-based fee for copying, or preparing a summary or explanation of the information provided that the fee includes only the cost of copying supplies, postage, and labor for preparing the summary or explanation as agreed to by the individual.
   6. Denial of Access: The ADAMH Board must provide a timely, written denial of access to the individual, written in plain language, explain the basis for the denial, and any applicable right of review, and describe how the individual may complain to the ADAMH Board (including name or title of contact, and phone number) or the U.S. Secretary of Health and Human Services.
      1. To the extent possible, the individual must be given access to any information requested after excluding the information for which ADAMH Board has grounds for denying access.
      2. If the ADAMH Board does not maintain the information for which access has been requested, but knows where it is maintained, the ADAMH Board must inform the individual where to direct the request for access.
   7. Documentation: The ADAMH Board must document and retain for six (6) years from the date of its creation the designated record sets subject to access and the names or titles of persons responsible for receiving and processing requests for access.
2. RIGHT TO REQUEST RESTRICTIONS ON USES/DISCLOSURES OF PHI, AND TO REQUEST CONFIDENTIAL COMMUNICATIONS:
   1. Requests for Restrictions on Uses/Disclosures: The ADAMH Board must permit an individual to request that the ADAMH Board restrict uses and disclosures of PHI made for TPO or disclosures to family or others involved in the individual's care, though the ADAMH Board does not have to agree to the restriction requested.
      1. If the ADAMH Board agrees to the requested restriction(s), it must document the agreed upon restriction in writing, and abide by the restriction unless the individual is in need of emergency treatment, the information is needed for the treatment, and the disclosure is to another provider only for purposes of such treatment. The ADAMH Board must request that the provider agree not to further disclose the PHI.
      2. The ADAMH Board cannot agree to a restriction that prevents uses or disclosures permitted or required to the individual, for a facility directory, or where the use or disclosure does not require the individual's permission.
      3. The ADAMH Board may terminate an agreed upon restriction if the individual so agrees, as documented in writing, or the ADAMH Board informs the individual and the termination is only effective as to PHI created or received after such notice.
   2. Requests for Confidential Communications: The record keeping ADAMH Board must permit individuals to request to receive communications of PHI by alternative means or at alternative locations, and must accommodate all reasonable requests.
3. RIGHT TO REQUEST AMENDMENT OF PHI:
   1. Requests for Amendment of PHI: An individual has the right to have the ADAMH Board amend PHI or other information in the designated record set for as long as the ADAMH Board maintains the information. The ADAMH Board must act on the request within sixty (60) days of receipt, or within ninety (90) days if the ADAMH Board notifies the individual within the first 60 days of the reasons for delay and the date by which action will be taken. The ADAMH Board may deny the request if it determines that the record: was not created by the ADAMH Board (unless the individual provides reasonable basis to believe that the originator of the records is no longer available to act on the request); is not part of the designated record set; would not be available for inspection; or is accurate and complete.
   2. Accepting the Amendment: If the ADAMH Board accepts the amendment, in whole or in part, it must:
      1. Make the amendment by, at minimum, identifying the affected records and appending or otherwise providing a link to the location of the amendment;
      2. Inform the individual that the amendment is accepted, and obtain his/her identification of and agreement to have the ADAMH Board notify relevant persons with a need to know in a timely manner;
      3. Make timely and reasonable efforts to inform and provide the amendment to those persons and others, including business associates, that the ADAMH Board knows to have the affected PHI and that may have relied, or be foreseen to rely, on that information to the detriment of the individual.
   3. Denying the Amendment: If the ADAMH Board denies the amendment, in whole or part, it must:
      1. Provide the individual with a timely denial, written in plain language and including: the basis for denial; notice of the individual's right to submit a written statement of disagreement, and instructions on how to file the statement, or to request that future disclosures of the PHI include copies of the request and the denial; and a description of how the individual may complain about the decision to the ADAMH Board or to the U. S. Secretary of Health and Human Services;
      2. Permit the individual to submit a statement of disagreement (but the ADAMH Board may reasonably limit its length);
      3. Provide a copy of any rebuttal prepared to the individual;
      4. As appropriate, identify the part of the record subject to the disputed amendment and append or otherwise link the request, the denial, and any statement of disagreement or rebuttal to the record;
      5. For future disclosures of the record, include any statement of disagreement or, in response to the individual's request, the amendment request and the denial (or an accurate summary of either of the foregoing). If standard transaction format does not permit the appending of the additional information, it must be transmitted separately to the recipient of the standard transaction.
      If the ADAMH Board is informed by another covered entity about an amendment to the record, the ADAMH Board must amend the information in its record by, at a minimum, identifying the affected records and appending or otherwise providing a link to the location of the amendment.
      
      The ADAMH Board must document the titles of the persons or offices responsible for receiving and processing requests for amendments.
4. RIGHT TO AN ACCOUNTING OF DISCLOSURES: An individual has a right to receive an accounting of disclosures of his/her PHI in accordance with the policy "Accounting of Disclosures of Protected Health Information" (#8.00).