It is Community Service, Inc. policy to comply with the all Federal and State Regulations regarding privacy and confidentiality. To this end the organization will maintain compliance with the Federal Privacy requirements under the Health Insurance Portability and Accountability Act (HIPAA) as it relates to Protected Health Information
Community Service, Inc. shall consider Protected Health Information (PHI) to be individually identifiable health information. This includes information created or received by the organization including demographics that relate to past, present or future mental and physical health or treatment. PHI also includes the information related to and necessary to receive payments (past, present and future) which is transmitted or maintained in any electronic medium or any other form.
Community Services, Inc. recognizes that there is no legal restriction on the use or discloser of de-identified health information. De-identified health information is information that neither identifies nor provides a reasonable basis to identify and individual.
Community Service will not use or disclose PHI except under the following circumstance:
- The Privacy Rule allows or requires the use or disclose of PHI.
- When the individual who is the subject of the PHI authorizes the release in writing (NOTE: in the case of minors parent or legal guardian may provide the authorization)
Community Service, Inc. is required by the Privacy Rule to release information under the following to conditions:
- To the individuals or their personal representative when they request access to or and accounting of disclosures of their PHI.
- To The Federal Health and Human Services (HHS) when it is undertaking a compliance investigation or review or enforcement action.
Under the Privacy Rule, Community Service, Inc. is permitted but not required, to use and disclose PHI without an individual’s authorization for the following purposes:
- To the individual who is the subject of the PHI (Except when deemed counter-therapeutic by a Mental Health Professional)
- For the purpose of the following:
- It own coordination, provision and management of services and treatment.
- For the purpose of reimbursement and payment for said services and to fulfill responsibilities for coverage and provision of benefits.
- To provide Healthcare operations including
- Quality assessment and improvement activities
- Utilization review and care coordination
- Conducting medical reviews, audits or legal services including fraud and abuse detection and compliance programs.
- Business planning development and administration
- General and business administrative activities including de-identifying protected health information, creating limited data sets and certain fundraising activities for the benefit of the organization.
- Uses and Disclosers with Opportunity to agree or object. Due to the highly confidential ethic and standards in mental health there are few circumstances where informal agreements exist. An example may be a sibling’s participation in a family therapy session where the individual has the opportunity to object to the sibling being a part of the treatment.
- Incidental Use and Discloser does not have to be reported under the Privacy Rule provided the use or disclosure is a result of an otherwise permitted use or disclosure is permitted, the information was limited to the minimum nessesary as required by the Privacy Rule and the organizations safeguards are reasonable and effective.
- Community Service, Inc. can use and disclose PHI for the 12 national priority purposes. They are as follows:
- Use and discloser of PHI without individual authorization as required by Federal and State laws (statues, regulations and court orders).
- Use and discloser for Public health Activities as follows
- Public health agencies authorized by law to receive information for preventing and controlling disease, injury or disability and/or the reporting of child abuse or neglect.
- FDA regulations regarding FDA regulated products or activities for purpose of tracking and recall
- Individual who have been exposed to communicable disease when notification is allowed or required by law.
- Employers regarding employees health where said information is required by OHSA, MHSA or state law.
- Community Service, Inc. may disclose PHI to appropriate governmental authorities regarding victims of abuse, neglect or domestic violence.
- PHI can be released to health oversight agencies for the purpose of legally authorized activities such as audits and investigations of the health care system and government benefit programs.
- PHI may be released in a judicial or administrative proceeding if the request for the PHI is through an order from a court or administrative tribunal. Such information may be disclosed by a subpoena or other lawful provided notice is given to the individual or a protective order is provided.
- Community Services, Inc. may release PHI under the privacy rule to law enforcement officials for law enforcement purposes under the following conditions and subject to specified conditions:
- As required by law including court orders, warrants and subpoenas.
- To help identify a missing person, suspect, material witness or fugitive.
- In response to law enforcement officials request for information about a victim or suspected victim of a crime.
- To alert law enforcement officials of a persons death if the organization suspects that criminal activity caused the death.
- When the organization believes that PHI is evidence of a crime that occurred on premises.
- When it is necessary to inform law enforcement officials in an emergency medical situation not occurring on premises about the commission and nature of a crime, the location of the crime or crime victims and the perpetrator of the crime.
- Under certain circumstances PHI can be released to coroners and medical examiners (and in extreme cases funeral directors) for the purpose of identifying a deceased person, help determine the cause of death or perform other functions authorized by law.
- Under certain circumstance PHI may be released to help facilitate the donation of cadaveric organs, eyes and tissue (it should be noted that this would be an extremely rare circumstance and would need to be cleared through the President/CEO prior to release of information).
- Community Service, Inc. will only release PHI for research purposes with authorization from the individual or when the information is in a limited data set and/or de-identified any exceptions must be cleared through the President/CEO and comply with HIPAA, Federal and State regulations.
- Community Service, Inc. has a legal, ethical and moral obligation to release PHI when it is deemed by a Mental Health Professional that the information may help prevent or lessen a serious and imminent threat to a person or the public. This includes individuals who are deemed a danger to themselves (including self-harm and/or suicidal), other individuals or the public. The organization may also disclose PHI needed to help identify or apprehend an escapee or violent criminal.
- Community Service, Inc. may disclose PHI for certain essential government activities including providing protection for the President, national security activities, and intelligence activities authorized by law, and determining eligibility for or conducting enrollment in certain government benefit programs.
- Community Service, Inc. can release PHI to comply with workers compensation laws related to work related injuries or illnesses.
- Community Service, Inc. can release PHI in a limited data set provided the direct identifiers of the individuals, their relatives, household members, and employers have been removed. The data set may be used for certain research projects, healthcare operations and public health purposes provided the recipient of the data has an agreement with Community Service, Inc. promising specified safeguards for the PHI in the limited data set.
Each client will be given the Community Service, Inc. NOTICE OF PRIVACY PRACTICES upon as part of the intake and admission packet. A CSI staff member will go over the notice and the client will sign that he/she has read and understands the notice.
Community Service, Inc. must obtain a written authorization from the individual or their legally responsible party except under the circumstance describe above. The authorization shall appear on Consent for the Release of Information (CS-003a or CS-003b) form and filed in the clients chart. If there are any questions regarding this policy by staff or clients they are to be handled by the Privacy Officer. Should there be a conflict the matter will be brought to the attention of the Director of Operations and the President/CEO. The President /CEO shall have final say in the interpretation of the HIPAA, Federal and State regulations, as well as decisions the organization makes regarding individually identifiable health information, confidentiality, and release of information