Patient Notification of Privacy Rights
The Health Insurance Portability and Accountability Act (HIPAA) provides new regulations regarding the use of protected health information. This law is commonly referred to as the “medical records privacy law,” and specifically provides patient protections related to the electronic transmission of data (‘the transaction rules”), the keeping and use of patient records (“privacy rules”), and the storage and access of health care records (“the security rules”). HIPAA applies to all health care providers, including mental health providers. Health care providers and agencies are now required to give patients a notification of their privacy rights as it relates to their health care records.
The HIPAA law is very detailed and difficult to grasp without formal legal training. We will attempt to inform you of your rights in a simple, yet comprehensive way. Please read this document to help you understand what protections are provided to all of us under the HIPPA regulations. In your mental health treatment confidentiality and privacy are important elements of the therapeutic relationship we establish, and as such, you will find that I will make every effort to protect the privacy of your mental health records. If you have any questions about any of the matters addressed in this document, please let me know and I will attempt to clarify any concern you may have.
I am required by law to secure your signature indicating that you have received this Patient Notification of Privacy Rights Document. Thank you for your thoughtful consideration of these matters.
Malinda Davenport Crisp, PhD, MA, LPC - MHSP
Licensed Professional Counselor
Mental Health Services Provider
I, _____________________________, understand and have received a copy of the Patient Notification of Privacy Rights Document which provides a detailed description of the potential uses and disclosures of my protected health information, as well as my rights on these matters. I understand I have the right to review this document before signing this acknowledgment form.
Patient Signature or Parent if Minor or Legal Charge Date
If Legal Charge, please describe representative authority:_________________________
THIS NOTICE DESCRIBES HOW YOUR MENTAL HEALTH RECORDS MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY.
I. Preamble and Definitions
The laws of the state of Tennessee provide for privileged communication between you and your therapist for conversations which occur in the context of your therapist-client relationship. It is important to understand the difference between communication and documentation in your mental health records. Records are kept documenting your care as required by law, professional standards, and other review procedures. HIPAA clearly defines what kind of information is to be included in your “designated medical record” as well as some material, known as “Psychotherapy Notes”, which is not accessible to insurance companies and other third-party reviewers and in some cases, not to the patient himself/herself.
HIPAA provides privacy protection about your personal health information, which is called, “protected health information”, which could personally identify you. Personal Health Information (PHI) consists of three (3) components: treatment, payment, and health care operations.
Treatment refers to activities in which I provide, coordinate, or manage your mental health care or other services related to your mental health care. Examples include a psychotherapy (counseling) session, talking with your primary care physician about medications or your overall medical condition, and/or referring to or consulting with a psychiatrist regarding your treatment.
Payment refers to reimbursement received for your mental health care treatment. This includes filing insurance claims on your behalf to help pay for some of the costs the mental health care services provided to you.
Health care operations are activities related to the performance of my practice such as quality assurance. In mental health care, the best example of health care operations is when utilization review occurs, a process in which your insurance company reviews our work together to see if your care is really “medically necessary.”
The use of your protected health information refers to activities my office conducts for filing your claims, scheduling appointments, keeping records, and other tasks within my office related to your care. Disclosures refer to activities you authorize which occur outside my office such as the sending of protected health information to other parties (i.e., your primary care physician, the school your child attends, etc.).
II. Uses and Disclosures of Protected Health Information Requiring Authorization
Tennessee law requires authorization and consent for treatment, payment, and healthcare operations. With your consent I can disclose certain PHI for purposes of treatment, payment and healthcare operations. Your signed consent authorizes me to file insurance claims, provide treatment, and to conduct other administrative operations associated with your care.
If you request that PHI of any sort be sent to anyone outside my office, you will need to sign a specific authorization to release said information to this particular party. A copy of that authorization form is available upon request. This means that we cannot accept a general release of information without the specific recipient being designated on the release of information form. This step provides added protection for your protected health information. An example of this type of release might be your request that I talk with your child’s teacher about his conduct or his emotional problems. Before I talk to that teacher, you will have to first sign the proper authorization for me to do so.
Of special interest to both therapists and clients alike is a provision included in the HIPAA pertains to “psychotherapy notes”. In recognition of the importance of the confidentiality of conversations between therapists and patients in treatment settings, HIPAA permits therapists to keep separate “psychotherapy notes” from the overall “designated medical record.” Psychotherapy notes cannot be secured by insurance companies nor can they insist upon their release for payment of services as in the past. “Psychotherapy notes” are my notes, defined as notes “recorded in any medium by a mental health provider documenting and analyzing the contents of a conversation during a private, group, or joint family counseling session and that is separated from the rest of the individual’s medical record.” Psychotherapy notes are necessarily more private and contain much more personal information about you, hence, the need for increased security of those notes. Psychotherapy notes are not the same as your “progress notes” which provide the following information about your care each time you have an appointment at my office: medication prescriptions and monitoring, assessment/treatment start and stop times, the modalities of care, frequency of treatment furnished, results of any assessment instruments used, and any summary of your diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date.
Certain payors may require release of both your progress notes and my psychotherapy notes in order to pay for your care. Medicare and Workers Compensation are examples of such payors who can require the release of both sets of notes. If I am forced to submit both sets of notes you will be asked to sign an additional authorization directing me to release my psychotherapy notes. Most of the time I will be able to limit the reviews of your protected health information to include your “designated record set” only, which includes the following: all identifying information you completed when you first started treatment here, all billing information, a summary of our first appointment, your mental status evaluation, your individualized, comprehensive treatment plan, your discharge summary, progress notes, reviews of your care by managed care companies, results of assessment instruments, and any authorization letters or summaries of care you have authorized me to release on your behalf. Please note that the actual test questions or raw data of psychological tests which are protected by copyright laws and the need to protect patients from unintended, potentially harmful use are not part of your “designated mental health record” and may not be released.
You may revoke all authorizations to disclose protected health information at any time. You cannot revoke an authorization for an activity already done that you instructed me to do or if the authorization was obtained as a condition for obtaining insurance and Tennessee law provides the insurer the right to contest the claim under the policy.
III. Business Associates Disclosures
HIPAA requires that I train and monitor the conduct of those performing ancillary administrative services for my practice and refers to these people as “Business Associates”. In my practice, “business associates” includes our office manager, secretaries, receptionists, or other such individuals who provide services such as typing, making phone calls, obtaining authorizations for services, filing insurance claims – all activities which bring them into some measure of contact with your protected health information. My clerical staff does not access those areas of your designated medical record that contains the particulars of your mental health concerns; ONLY I access your full designated mental health record as I have purposefully separated your clinical records in an attempt to further enhance your privacy. My partner(s) in practice may provide certain backup services or ancillary services necessary to running my practice and/or managing patient care. In addition, my answering service has signed a business associates agreement to maintain confidential any information you may share with them in order to schedule appointments, change appointments, or otherwise contact me. In keeping with our agreement and the privacy requirements of HIPAA, I monitor their compliance, and correct any errors, if they should occur.
IV. Uses and Disclosures Not Requiring Consent nor Authorization
By law, protected health information may be released without your consent or authorization:
· Child abuse
· Suspected sexual abuse of a child
· Adult and Domestic Abuse
· Health Oversight Activities (i.e., licensing board)
· Judicial or administrative proceedings (i.e., if you are ordered to see me by the Court for an evaluation or assessment related to abuse, custody, or divorce)
· Serious Threat to Health or Safety (i.e., our “Duty to Warn” Law, national
· Workers Compensation Claims (if you seek to have your care reimbursed under Workers Compensation, all of your care is automatically subject to review by your employer and/or insurer(s).
I never release patient information of any kind for marketing purposes.
V. Patient’s Rights and My Duties
You have a right to the following:
· The right to request restrictions on certain uses and disclosures of your protected health information which I may or may not agree to but if I do, such restrictions shall apply unless our agreement is changed in writing;
· The right to receive confidential communications by alternative means and at alternative locations. For example, you may not want your bills sent to your home address, but to another location of your choosing.
· The right to inspect and request a copy of your protected health information in my designated mental health record set and any billing records for as long as protected information is maintained in the record;
· The right to amend material in your protected health information, although I may deny any improper request and/or respond to any amendment(s) you make to your record of care;
· The right to an accounting of non-authorized disclosures of your protected health information;
· The right to a paper copy of notices/information from me, even if you have previously requested electronic transmission of notices/information; and
· The right to revoke your authorizations of the release of your health information except to the extent that action has already been taken.
I am required by law to maintain the privacy of your protected health information and to provide you with a notice of your Privacy Rights and my duties regarding your protected health information. I reserve the right to change my policies and practices as needed with these current designated practices being applicable unless you receive a revision my policies when you come to your future appointment(s). My duties as a psychotherapist on these matters include maintaining the privacy of your protected health information, to provide you this notice of your rights and my privacy practices with respect to your PHI, and to abide by the terms of this notice unless it is changed and you are so notified. If you have further questions regarding your privacy rights, please let me know.
If you have any concerns of any kind regarding the possible compromise of your privacy rights, please do not hesitate to speak directly to me immediately about this matter. You will find that I am willing to talk with you about preserving the privacy of your protected mental health information. It is our goal to protect your PHI and to resolve any concerns you may have in a timely manner. We request your assistance in notifying us of any suspected breech in this policy so we can take corrective action accordingly. You also have the right to send a written complaint to the Secretary of the U.S. Department of Health and Human Services.
VII. This notice shall go into effect April 14, 2003, and remain so unless new notice provisions effective for all protected health information are enacted immediately.