HIPPA Policy

NOTICE OF PRIVACY PRACTICES

(Effective July 1, 2004)

PROTECTED HEALTH INFORMATION

THIS NOTICE DESCRIBES HOW MEDICAL AND HEALTH INFORMATION ABOUT YOU MAY BE USED AND SHARED AND HOW YOU CAN ACCESS THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

What is “Medical Information”?

The term “medical information” is synonymous with the terms “personal health information” and “protected health information” for purposes of this Notice. It essentially means any individually identifiable health information (either directly or indirectly identifiable), whether oral or recorded in any form or medium, that is created or received by a health care provider (me), health plan, or others and 2) relates to the past, present, or future physical or mental health or condition of an individual (you); the provision of health care (e.g., mental health) to an individual (you); or the past, present, or future payment for the provision of health care to an individual (you).

I am a mental health care provider. More specifically, I am a Licensed Marriage and Family Therapist, licensed by the State of North Carolina. I create and maintain treatment records that contain individually identifiable health information about you. These records are generally referred to as “medical records” or “mental health records,” and this notice, among other things, concerns the privacy and confidentiality of those records and the information contained therein.

Uses and Disclosures Without Your Authorization - For Treatment, Payment, or Health Care Operations

Federal privacy rules (regulations) allow health care providers (me) who have a direct treatment relationship with the patient (you) to use or disclose the patient’s personal health information, without the patient’s written authorization, to carry out the health care provider’s own treatment, payment, or health care operations. I may also disclose your protected health information for the treatment activities of any health care provider. This too can be done without your written authorization.

An example of a use or disclosure for treatment purposes: If I decide to consult with another licensed health care provider about your condition, I would be permitted to use and disclose your personal health information, which is otherwise confidential, in order to assist me in the diagnosis or treatment of your mental health condition.

Disclosures for treatment purposes are not limited to the minimum necessary standard. because physicians and other health care providers need access to the full record and/or full and complete information in order to provide quality care. The word “treatment” includes, among other things, the coordination and management of health care among health care providers or by a health care provider with a third party, consultations between health care providers, and referrals of a patient for health care from one health care provider to another.

An example of a use or disclosure for payment purposes: If your health plan requests a copy of your health records, or a portion thereof, in order to determine whether or not payment is warranted under the terms of your policy or contract, I am permitted to use and disclose your personal health information.

An example of a use or disclosure for health care operations purposes: If your health plan decides to audit my practice in order to review my competence and my performance, or to detect possible fraud or abuse, your mental health records may be used or disclosed for those purposes.

PLEASE NOTE: I, or someone in my practice acting with my authority, may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. Your prior written authorization is not required for such contact. 

Other Uses and Disclosures Without Your Authorization:

I may be required or permitted to disclose your personal health information (e.g., your mental health records) without your written authorization. The following circumstances are examples of when such disclosures may or will be made:

1.   If disclosure is compelled by a court pursuant to an order of that court

2.  If disclosure is compelled by a board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority

3.   If disclosure is compelled by a party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum (e.g., a subpoena for mental health records), notice to appear, or any provision authorizing discovery in a proceeding before a court or administrative agency.

4.   If disclosure is compelled by a board, commission, or administrative agency pursuant to an investigative subpoena issued pursuant to its lawful authority.

5.   If disclosure is compelled by an arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum (e.g., a subpoena for mental health records), or any other provision authorizing discovery in a proceeding before an arbitrator or arbitration panel.

6.   If disclosure is compelled by a search warrant lawfully issued to a governmental law enforcement agency.

7.   For Reporting Victims of Abuse, Neglect or Domestic Violence to government authorities, including a social service or protective service agency.

8.   If disclosure is compelled or permitted by the fact that you are in such mental or emotional condition as to be dangerous to yourself or to the person or property of others, and if I determine that disclosure is necessary to prevent the threatened danger.

9.   If disclosure is compelled or permitted by the fact that you tell me of a serious threat (imminent) of physical violence to be committed by you against a reasonably identifiable victim or victims.

10. If disclosure is compelled or permitted, in the event of your death, to the coroner in order to determine the cause of your death.

11. As indicated above, I am permitted to contact you without your prior authorization to provide appointment reminders or information about alternatives or other health-related benefits and services that may be of interest to you. Be sure to let me know where and by what means (e.g., telephone, letter, email, fax) you may be contacted.

12. If disclosure is required or permitted to a health oversight agency for oversight activities authorized by law, including but limited to, audits, criminal or civil investigations, or licensure or disciplinary actions.

13. If disclosure is compelled by the U. S. Secretary of Health and Human Services to investigate or determine my compliance with privacy requirements under the federal regulations (the “Privacy Rule”).

14. If disclosure is otherwise specifically required by law.

PLEASE NOTE: The above list is not an exhaustive list, but informs you of most circumstances when disclosures without your written authorization may be made. Other uses and disclosures will generally (but not always) be made only with your written authorization, even though federal privacy regulations or state law may allow additional uses or disclosures without your written authorization. Uses or disclosures made with your written authorization will be limited in scope to the information specified in the authorization form, which must identify the information “in a specific and meaningful fashion.” You may revoke your written authorization at any time, provided that the revocation is in writing and except to the extent that I have taken action in reliance on your written authorization. Your right to revoke an authorization is also limited if the authorization was obtained as a condition of obtaining insurance coverage for you. If North Carolina law protects your confidentiality or privacy more than the federal “Privacy Rule” does, or if North Carolina law gives you greater rights than the federal rule does with respect to access to your records, I will abide by North Carolina law. In general, uses or disclosures by me of your personal health information (without your authorization) will be limited to the minimum necessary to accomplish the intended purpose of the use or disclosure. Similarly, when I request your personal health information from another health care provider, health plan or health care clearinghouse, I will make an effort to limit the information requested to the minimum necessary to accomplish the intended purpose of the request. As mentioned above, in the section dealing with uses or disclosures for treatment purposes, the “minimum necessary” standard does not apply to disclosures to or requests by a health care provider for treatment purposes because health care providers need complete access to information in order to provide quality care.

Your Rights Regarding Protected Health Information

    You have the right to request restrictions on certain uses and disclosures of protected health information about you, such as those necessary to carry out treatment, payment, or health care operations. I am not required to agree to your requested restriction. If I do agree, I will maintain a written record of the agreed upon restriction.

2.  You have the right to receive confidential communications of protected health information from me by alternative means or at alternative locations.

3.  You have the right to inspect and copy protected health information about you by making a specific request to do so in writing. This right to inspect and copy is not absolute – in other words, I am permitted to deny access for specified reasons. For instance, you do not have this right of access with respect to my “psychotherapy notes.” The term “psychotherapy notes” means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical (includes mental health) record. The term excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

4.  You have the right to amend protected health information in my records by making a request to do so in a writing that provides a reason to support the requested amendment. This right to amend is not absolute – in other words, I am permitted to deny the requested amendment for specified reasons. You also have the right, subject to limitations, to provide me with a written addendum with respect to any item or statement in your records that you believe to be incorrect or incomplete and to have the addendum become a part of your record.

5.  You have the right to receive an accounting from me of the disclosures of protected health information made by me in the six years prior to the date on which the accounting is requested. As with other rights, this right is not absolute. In other words, I am permitted to deny the request for specified reasons. For instance, I do not have to account for disclosures made in order to carry out my own treatment, payment or health care operations. I also do not have to account for disclosures of protected health information that are made with your written authorization, since you have a right to receive a copy of any such authorization you might sign.

6.  You have the right to obtain a paper copy of this notice from me upon request.

PLEASE NOTE: In order to avoid confusion or misunderstanding, I ask that if you wish to exercise any of the rights enumerated above, that you put your request in writing and deliver or send the writing to me. If you wish to learn more detailed information about any of the above rights, or their limitations, please let me know. I am willing to discuss any of these matters with you. As mentioned elsewhere in this document, I am the Privacy Officer of this practice.

My Duties:

I am required by law to maintain the privacy and confidentiality of your personal health information. This notice is intended to let you know of my legal duties, your rights, and my privacy practices with respect to such information. I am required to abide by the terms of the notice currently in effect. I reserve the right to change the terms of this notice and/or my privacy practices and to make the changes effective for all protected health information that I maintain, even if it was created or received prior to the effective date of the notice revision. If I make a revision to this notice, I will make the notice available at my office upon request on or after the effective date of the revision and I will post the revised notice in a clear and prominent location.

As the Privacy Officer of this practice, I have a duty to develop, implement and adopt clear privacy policies and procedures for my practice and I have done so. I am the individual who is responsible for assuring that these privacy policies and procedures are followed not only by me, but by any employees that work for me or that may work for me in the future. I have trained or will train any employees that may work for me so that they understand my privacy policies and procedures. In general, patient records, and information about patients, are treated as confidential in my practice and are released to no one without the written authorization of the patient, except as indicated in this notice or except as may be otherwise permitted by law. Patient records are kept secured so that they are not readily available to those who do not need them.

Because I am the Contact Person of this practice, you may complain to me and to the Secretary of the U.S. Department of Health and Human Services if you believe your privacy rights may have been violated either by me or by those who are employed by me. You may file a complaint with me by simply providing me with a writing that specifies the manner in which you believe the violation occurred, the approximate date of such occurrence, and any details that you believe will be helpful to me. My telephone number is 919-795-0101. I will not retaliate against you in any way for filing a complaint with me or with the Secretary. Complaints to the Secretary must be filed in writing. A complaint to the Secretary can be sent to U.S Department of Health and Human Services:

Region IV, Office for Civil Rights, U.S. Department of Health and Human Services, Atlanta Federal Center, Suite 3B70, 61 Forsyth Street, SW., Atlanta, GA 30303-8909. Voice Phone (404) 562-7886. FAX (404) 562-7881. TDD (404) 331-2867.

If you need or desire further information related to this Notice or its contents, or if you have any questions about this Notice or its contents, please feel free to contact me. As the Contact Person for this practice, I will do my best to answer your questions and to provide you with additional information.

This notice first became effective on April 14, 2003.

                    MY OFFICE PRIVACY POLICIES AND PROCEDURES

Confidentiality and privacy are the cornerstones of the mental health professions. Patients have an expectation that their communications with therapists, and their treatment records, will generally be kept confidential and will not be released to others without the written authorization of the patient. One of the purposes of the Notice of Privacy Practices is to inform and educate patients about the fact that there are exceptions to the general rule of confidentiality. Many of these exceptions have existed for years, and many of them are the result of laws and regulations being passed by state legislatures and by the federal government. These laws and regulations are essentially statements of public policy. My office policies and procedures, as well as the ethical standards of my profession, are intended to shape my practice so that privacy and confidentiality are maintained, consistent with California law and the federal “Privacy Rule.”

1. Privacy Officer: I, Carole Cullen, LMFT, am the privacy officer for this practice. I am the one responsible for developing and implementing these policies and procedures.
2. Contact Person: I, Carole Cullen, LMFT, am the contact person for this practice. If a patient needs or desires further information related to the Notice of Privacy Practices, or if the patient has a complaint regarding these policies and procedures or our compliance with them, I am the person who should be contacted.
3. The effective date of these policies and procedures is (Client start date of services).
4. I will maintain documentation of all consents, authorizations, Notices of Privacy Practices, Office Policies and Procedures, trainings, and patient requests for records or for amendments to records. I will also document complaints received and their disposition.
5. I will train all employees of my practice regarding the importance of privacy and confidentiality. At a minimum, these Office Policies and Procedures will be reviewed and discussed, as will the content of the Notice of Privacy Practices. The training will take place as soon as possible after the person is hired. For those who are already in my employ, I will train them by April 14, 2003.
6. I will not maintain or use patient sign-in sheets.
7. Conversations regarding confidential material or information will take place in an area and in a manner where they will not be easily overheard. 
8. Patient records will be kept in locked file cabinets in my individual office. My individual office is locked when I am not there. Patient records will not be left in places in my office where others are able to see its contents. I will take steps to assure that patient records are accessed only by me or by those in my employ with my permission, who may need to access them on my behalf or on the patient’s  behalf.
9. Computers and fax machines will be placed appropriately so that access is limited to office personnel and so that confidential information transmitted or received is not seen by others.
10. With respect to electronic equipment such as computers, I will delete and change the passwords of terminated employees promptly upon their termination.
11. With respect to office keys, terminated employees will be asked to return all keys to the office that they may possess. I also realize that it may be necessary for me to change one or more locks within my office, depending on circumstances.
12. For those in my employ who violate these policies and procedures or who compromise the confidentiality or privacy of a patient, I will take such actions as I believe are warranted by the situation. Since I have a small private practice, I have not had the need to develop and implement a formal disciplinary policy. I will act in good faith and will do my best to correct errors or deficiencies that become known to me.
13. Information and records concerning a patient may be disclosed as described in the Notice of Privacy Practices and in accordance with applicable law or regulation.  Generally, I will obtain a written authorization from the patient before releasing information to third parties for purposes other than treatment payment, and health care operations, unless disclosure is required by law or permitted by law.
14. If mental health records are subpoenaed by an adverse party I will assert the psychotherapist-patient privilege on behalf of the patient and will thereafter act according to the wishes of the patient and the patient’s attorney, unless I am ordered by a Court or other lawful authority to release records or portions thereof.
15. To the extent that I keep patient records electronically (e.g. on my computer), I will backup the computer files on a daily basis and will store the backup offsite. By doing so, I will be prepared in the case of an incident of some kind that causes  destruction, deletion, or damage to electronically stored patient records.
16. I keep patient records for at least seven years from the date of last treatment. With respect to the records of a minor, I keep those records for at least seven years or until the patient is twenty-one years old, whichever is longer. Thereafter, I may destroy patient records. When records are destroyed, they will be destroyed in a manner that protects patient privacy and confidentiality.
17. I will attempt to find out from patients, as early as possible, whether they have any objection to me or others in my office sending correspondence to their residence (e.g., claim forms, bills) and whether I am permitted to call them at their residence or elsewhere to change appointment times or dates, or to discuss matters related to their treatment.
18. If I share protected health information about a patient with third party business associates as part of my health care operations (e.g., a billing or transcription service), I will have a written contract with that business associate that contains terms that will protect the privacy of the patient’s protected health information.
19. My duty of confidentiality and the psychotherapist-patient privilege survive the death of a patient.

20. With respect to email communications, I will do my best to ensure that communications are encrypted and can only be opened by the person to whom they are being sent.

• I will do my best to ensure that electronic information, such as billing records and correspondence, is protected from computer viruses and unauthorized intruders.

If you would like to set up an appointment please contact Carole at 919-795-0101.