Privacy Policy - DeKalb County Rehab & Nursing Center

DeKalb County Rehab & Nursing Center
HIPAA Privacy Summary

Updated September 2021

DeKalb County Rehab & Nursing Center’s (DCRNC’s) HIPAA Privacy practices are summarized below.

DCRNC has HIPAA Privacy Policies and Procedures describing our HIPAA practices in detail. These Policies and Procedures are available [on the intranet; in the Employee Handbook; on the bulletin board; in the Privacy Officer’s office, etc.]. Please consult them or check with the Privacy Officer if you need more information about HIPAA Privacy.

PHI

The HIPAA Privacy Rule protects Protected Health Information (PHI): information that can identify a patient and relates to the patient’s health condition, treatment, and/or payment for treatment. PHI can be paper, electronic, or spoken.

Privacy Officer

DCRNC’s Privacy Officer is Cindy Holt. Her contact information is: (815) 217-0329
cholt@dekalbcounty.org. Please contact the Privacy Officer with any HIPAA questions.

Sharing PHI for Treatment, Payment, Health Care Operations

DCRNC can share PHI for treatment, payment, and health care operations. Examples:

Treatment: Two physicians consult with each other about how to care for a patient.
Payment: A provider sends a bill to a patient’s insurance company, or calls the insurance company to determine coverage.
Health Care Operations: A provider uses PHI when evaluating its health care professionals, or resolving patient complaints.

Patient opportunity to agree or object

DCRNC may use or disclose PHI in the following circumstances, if the patient is first given an opportunity to agree or object:

DCRNC may share a limited amount of PHI with DCRNC’s directory.
DCRNC may share information about a patient’s care with a family or friend involved with the patient’s care.

DCRNC’s HIPAA Privacy Policies and Procedures explain what information can be shared, and how to give the patient an opportunity to agree or object.

Patient authorization

DCRNC may disclose PHI to a third party if a patient first signs a valid HIPAA authorization. If DCRNC isn’t required or permitted to share PHI by the Privacy Rule, an authorization must be obtained. With some exceptions, authorizations are required if PHI will be used for marketing or sold, or includes psychotherapy notes. All authorizations will be reviewed by the Privacy Officer and, if necessary, by legal counsel, before PHI is released.

Special situations

The Privacy Rule has rules for special situations when providers can share PHI. If you ever encounter one of these situations, contact the Privacy Officer. DCRNC has policies and procedures that will need to be followed. These special situations include uses/disclosure of PHI:

When required by law
To avert a serious threat to health or safety
To a coroner or medical examiner to identify a deceased person or determine the cause of death
To disclose PHI about an abuse, neglect or domestic violence victim to the authorities
For organ donation
For health oversight activities
For judicial and administrative proceedings
For law enforcement purposes
For public health activities
For research
For specialized government functions
For workers’ compensation

Business associates

DCRNC may disclose PHI to a contractor if a business associate agreement is in place. The Privacy Officer manages business associate agreements. If you plan on working with a new contractor or vendor, be sure to tell the Privacy Officer.

When we must share PHI

DCRNC must share PHI with an individual if it is his or her own PHI. DCRNC also must share PHI with the Secretary of Health and Human Services, Office of Civil Rights (OCR), which enforces HIPAA, if the OCR is investigating DCRNC’s compliance with HIPAA.

Minimum Necessary

When using or disclosing PHI, DCRNC will limit the use or disclosure to the minimum necessary. In other words, HIPAA keeps us on a “need to know basis:” Only share the minimum PHI needed to accomplish the task at hand. The minimum necessary rule does not apply to disclosures of PHI for treatment, to the patient, pursuant to an authorization, and in certain other situations required by law.

Notice of Privacy Practices

DCRNC has a Notice of Privacy Practices that explains to patients how DCRNC uses patients’ PHI, and explains patients’ rights under HIPAA. This Notice is given to all new patients, and is also available on our website and from the Privacy Officer. If a patient asks you for the Notice, the Privacy Officer can help you provide it.

Verifying Identity

Lots of people ask DCRNC for patient information, such as: other health care providers, lawyers, personal representatives and family members. When someone requests PHI, always verify their identity. If you aren’t sure someone is entitled to receive PHI, ask the Privacy Officer.

Patient Rights

HIPAA gives patients the following rights:

The right to receive the Notice of Privacy Practices
The right to access their own PHI
The right to request to amend their PHI
The right to request restrictions to how their PHI is used
The right to request confidential communication (e.g. cell phone or office number only)
The right to request an accounting of disclosures of their PHI
The right to give permission to discuss PHI with family and friends
The right to have their PHI protected when they are deceased.

For more information about how to comply with these rights, please see the Privacy Officer. DCRNC has policies and procedures addressing each of these rights.

Personal Representatives

HIPAA requires DCRNC to treat a patient’s personal representative the same as DCRNC would treat the patient. In other words, if the patient is entitled to information, so is the personal representative. First, verify the personal representative’s authority. If you need help, contact the Privacy Officer.

Complaints

If you suspect HIPAA has been violated, or have a HIPAA complaint, please contact the Privacy Officer immediately. You may also make a complaint by contacting the Compliance Officer; using the compliance hotline; or using the drop box. HIPAA prohibits retaliation for complaints. DCRNC encourages reports of HIPAA non-compliance, as they help DCRNC mitigate any harm, and improve practices. It is also possible that a breach investigation will need to be conducted, and strict timelines might apply.

Documentation

HIPAA requires DCRNC to maintain documentation of HIPAA compliance for 6 years from the date the documentation was created or the date it was last in effect, whichever is later. If you have any questions about what to document under HIPAA or how records should be stored or discarded, contact the Privacy Officer.

Sanctions

It is the policy of DCRNC to discipline workforce members who fail to comply with Provider’s HIPAA Privacy Policies and Procedures. It is also the policy of DCRNC to investigate all alleged HIPAA violations and to document the findings with the Privacy Officer.

HIPAA Penalties

HIPAA has steep penalties: civil penalties of $58,490 per violation ($1,754,698 annual maximum per type of violation), and criminal penalties ($250,000 penalty and 10 years’ imprisonment). Plus, HIPAA violations can lead to private lawsuits brought by patients, license implications, and, in some cases, criminal charges.

Acknowledgment

I have read the HIPAA Privacy Summary and agree to follow it. If I need further direction for complying with the HIPAA Privacy Rule, I will consult the HIPAA Privacy Policies and Procedures, and/or the Privacy Officer.

Signature

Name

Date

Date Implemented: 2015
Date Last Updated: September 1, 2021