11.00 COMPLAINT/GRIEVANCE PROCESS FOR ALLEGED VIOLATIONS OF RIGHTS RELATING TO PROTECTED HEALTH INFORMATION

I. PURPOSE:
To issue instructions to all ADAMH workforce members regarding procedures for acceptance of, response to, and documentation of patients'/clients' complaints about alleged violations of their rights relating to protected health information (PHI).

II. APPLICABILITY:
This policy applies to all ADAMH workforce members.

III. AUTHORITY:
45 CFR Parts 160 & 164

IV. DEFINITIONS:

Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.

Use means with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

Protected Health Information (PHI) means individually identifiable information relating to past, present or future physical or mental health or condition of an individual, provision of health care to an individual, or the past, present or future payment for health care provided to an individual.

Designated Record Set means a group of records maintained by or for a covered entity that is: the medical and billing records relating to an individual maintained by or for a health care provider; the enrollment, payment, claims adjudication, and case or medical management systems maintained by or for a health plan, or; used, in whole or part, by or for a covered entity to make decisions about individuals.

Complaint means any concern communicated by a person questioning any act or failure to act relating to an individual's rights to access to his/her health information, to maintain the privacy of his/her health information, to request restrictions on uses or disclosures of his/her PHI, to request confidential communications regarding his/her PHI, to request amendment of his/her PHI, or to receive an accounting of disclosures of his/her PHI.

Grievance means a formal request for review of a complaint or for further review of any unresolved complaint that may be initiated orally or in writing.

Grievant means the person who initiates a complaint, grievance or appeal.

Workforce Members means Board of Trustees members, employees, volunteers, trainees, and other persons whose conduct, in the performance of work for ADAMH, is under the direct control of ADAMH, regardless of whether they are paid by ADAMH.

V. POLICY:

1. HIPAA grants individuals specific rights relating to their health information, many of which overlap with patient/client rights mandated by state law. Specifically, in addition to privacy rights related to their PHI, individuals are granted the right to access their designated record set, to request restrictions on uses or disclosures of their PHI, to request that communications related to PHI be confidential, to request amendment of their designated record set, and to receive an accounting of disclosures of their PHI. [for details, see 7.00 Individuals' Rights Related to Protected Health Information] HIPAA also mandates that a process be in place for individuals to complain about an entity's privacy related policies and procedures and/or the entity's compliance with those policies and procedures.
2. The ADAMH Board's Client Rights Officer shall be designated as the person/position title responsible for receiving complaints/grievances relating to individuals' privacy rights, and rights to access their designated record set, to request restrictions on the use or disclosure of their PHI, to request confidential communications of health related information, to request amendment of their designated record set, or to request an accounting of disclosures made of their PHI.
   1. When a HIPAA related complaint/grievance is communicated to any workforce member, that workforce member shall immediately notify the Client Rights Officer (CRO), and shall inform the grievant of the name and contact information for the CRO.
   2. If the CRO is a subject of the complaint/grievance, the grievant shall be referred directly to the ADAMH Board's Privacy Officer.
   3. If a contract service provider is the subject of the complaint, the CRO shall refer the grievant to the provider's designated contact.
   4. The CRO shall also give the grievant information about his/her right to file a complaint with the U.S. Secretary of Health and Human Services.
3. If the content of the complaint/grievance is an incident, as defined in Ohio Administrative Code 5122-2-06, an incident report must be immediately filed.
4. The CRO shall refer requests, complaints, or grievances about ADAMH or PHI within it's control, to the Privacy Officer who will investigate the circumstances of the alleged HIPAA rights violation in accordance with the grievance procedures set forth in Ohio Administrative Code sections 5122-2-04 and 5122:2-1-02 [to be replaced by 5122-26-18.1], and if appropriate, shall take all reasonable steps to mitigate the effects of any violation.
   1. The Privacy Officer shall communicate the results of the investigation and resolution of the complaint/grievance to the grievant.
   2. If the grievant is dissatisfied with the result, he/she shall be informed of the right to file the complaint/grievance with ADAMH's HIPAA Oversight Committee and/or the U.S. Department of Health & Human Services, and shall be given assistance in doing so, if requested.
   3. ADAMH's HIPAA Oversight Committee shall communicate the results of the investigation and resolution of the complaint/grievance to the grievant within thirty (30) working days unless a greater amount of time is necessary to complete the investigation.
   4. If greater time is necessary, the HIPAA Oversight Committee shall, within thirty (30) days, notify the grievant of the delay and inform the grievant of the expected time frame for completion of the investigation.
5. If the results of the Privacy Officer's investigation indicate that a workforce member made an unauthorized use or disclosure of PHI, or otherwise violated HIPAA Policies and Procedures, the Privacy Officer shall report such finding to Human Resources, who must also report such finding to the workforce member's supervisor.
6. The Privacy Officer shall document all HIPAA related complaints/grievances, their resolution, and any actions resulting there from. This documentation must be maintained for a minimum period of six (6) years from the date of final resolution. Complete copies of this documentation shall be submitted to ADAMH's HIPAA Oversight Committee quarterly for review. The HIPAA Oversight Committee shall review the logs to determine if any pattern or systematic problem(s) exist(s), and if so, shall take necessary steps to address the problem.
7. There shall be no retaliation against any individual or person served, workforce member, CRO, or Privacy Officer for having filed or assisted in the filing of a complaint/grievance, or for investigating or acting on a complaint/grievance. Any workforce member who becomes aware of any such retaliatory action shall immediately complete an incident report.
8. All workforce members shall receive training at the beginning of employment, and annually thereafter, regarding this procedure.