PURPOSE: To establish the organization’s process for assuring that all patients receive the Notice of Privacy Practices as required in the Privacy Rule.

POLICY: As required under the Privacy Rule, and in accordance with law and regulation, the organization will provide adequate Notice of Privacy Practices to patients. The organization will inform patients of their rights with respect to protected health information (PHI) as well as the organization’s legal duties. The patient must acknowledge receipt of the notice.

DEFINITIONS:

Affiliated Covered Entity–Entities under common ownership or control may designate themselves as an Affiliated Covered Entity. Hospitals which are in a shared Clinical Patient Care System market and share patient information for purposes of payment and healthcare operations will automatically be designated as an affiliated covered entity under the rule.

Direct treatment relationship–A relationship between a healthcare provider and patient where the healthcare provider delivers healthcare directly to the individual.Organized

Health Care Arrangement–A clinically integrated care setting in which individuals typically receive healthcare from more than one healthcare provider. The organization and its medical staff are an Organized Health Care Arrangement under the rule.

RESPONSIBILITIES AND PROCEDURES:

1. The organization will provide a notice that is written in plain language and that includes, at a minimum, the organization’s standard notice language.

2.The patient must be presented the Notice of Privacy Practices on the first encounter at the clinic. This presentation can be in either the Conditions of Admission/Consent for Treatment form or in another format as deemed appropriate by the Privacy Officer. Although facilities are encouraged to get the patient’s signature or initials as acknowledgement of the patient’s receipt of the Notice of Privacy Practices, it is also recognized that the provision of healthcare services must come first. There is no need to either obtain an acknowledgement or present the Notice of Privacy Practices for subsequent encounters with the same patient unless there has been a substantive change to the organization’s Notice of Privacy Practices.The patient may acknowledge receipt of the notice either by signing and dating a copy of the notice which will be maintained in the Medical Records or by signing and dating an Acknowledgement Form.For emergency treatment situations, acknowledgement of the notice is not required.

3. Required Elements:

a. The header statement must state: “This notice describes how health information about you may be used and disclosed and how you can get access to this information. Please review it carefully.”

b. A description, including at least one example, of the types of disclosures for the purposes of treatment, payment and healthcare operations.

c. A description of each of the other purposes for which the organization is permitted or required to use or disclose the information without an individual’s consent or authorization (e.g., State Reporting).

d. A statement that if a use or disclosure is prohibited or materially limited by other applicable law, the description of such use or disclosure must reflect the more stringent law.e.A statement that other uses or disclosures will be made only with the individual’s written authorization and that the individual may revoke this authorization.

f. A statement of the patient’s rights with respect to protected health information. The right to access protected health information. The right to amend protected health information. The right to receive confidential communications. The right to an accounting of disclosures. The right to request restrictions on certain uses and disclosures. The right to obtain a copy of the notice. The right to request that the individual not be contacted for marketing and fundraising activities

g. A statement of the organization’s duties with respect to PHI. The organization is required by law to maintain the privacy of PHI and to provide this notice with respect to PHI. The organization must abide by the terms of the notice. The organization may apply a change to the notice and make the new notice effective for the entire PHI it maintains. The statement will also include how it will provide the revised notice to individuals.

h. A statement that patients may complain to the Privacy Officer or the Secretary of the U.S. Department of Health and Human Services if they believe their privacy rights have been violated, a brief description of how the individual may file a complaint, and a statement that the individual will not be retaliated against for filing a complaint.

i. A statement that includes the name or title and telephone number of the Privacy Officer.

j. The effective date of the notice.k.A statement that the notice may change.

4. Provision of notice:The notice will be provided to all patients no later than the date of the first treatment service delivery subsequent to the effective date of the Privacy Standards, April 14, 2003; except in an emergency situation, in which case the organization must deliver the notice as soon as practicable after the emergency situation.The notice will be posted clearly and prominently in our lobby waiting area; andCopies of the notice will be available in English and in Spanish for individuals to take with them.

5.The organization’s Notice of Privacy Practices is available for review on our website at: www.panaceatherapyco.com.

6. The organization may choose to provide the notice by email; however, a paper copy must be provided at the request of the patient or if the email transmission fails.

7.If the first treatment service delivery to a patient is delivered electronically, the organization will provide the notice automatically and immediately. The individual may obtain a paper copy at his or her request.

8. For recurring patients the notice may be provided at the initial interaction and does not need to be provided again unless a change has been made.

9.The organization must document compliance by retaining copies of the notices issued.

10.The organization may review and update the notice but shall distribute its notice whenever there is a material change to the uses or disclosures, individual’s rights, legal duties or other privacy practices stated in the notice. A material change to any term of the notice may not be implemented prior to the effective date of notice in which a material change is reflected.