Policy:
2.1 Notice Requirement
All patients must be given a Notice of Privacy Practices (the "Notice"), which will provide notice of the following:
* The ways in which the provider will use and disclose the patient's presonal health information
* The patient's right under HIPAA
* The provider's duties under HIPAA
2.2 Provision of Notice
The Notice must be provided on or before the first encounter with the patient (e.g., the first office visit). The Notice does not have to be provided on subsequent visits, but copies must be available on later visits and provided to patients upon request.
The Notice may be delivered electronically (e.g., by e-mail) but the patient must first agree to receive notice in this manner. If the provider receives information that the electronic Notice was not deliverable, a paper copy must be provided.
2.3 Posting of Notice
The Notice must be posted in a clear and prominent location in the office (in such a place where the patient would reasonably be expected to look).
If the provider has a website, a copy of the Notice must be displayed on the website.
2.4 Acknowledgment of Notice
At the time of the patient is provided with the Notice, the provider must make a good faith effort to obtain a signed or initialed Acknowledgement from the patient or the patient's personal representative (for a discussion of who can be a patient's personal representative, see Policy No. 1). The Acknowledgement is a statement that the patient has received the Notice. If a signed or initialed Acknowledgement cannot be obtained, the provider must document the good faith efforts that were made to obtain the Acknowledgement and the reason why the Acknowledgement could not be obtained. If the Acknowledgement cannot be obtained because of an emergency, the provider must make good faith efforts to obtain the signed or initialed Acknowledgement as soon as practicable after the emergency situation has ended.
2.5 Revisions to Notice
The Notice must be revised if there are material changes affecting any of the following:
* The provider's uses and disclosures of the patient's informaiton
* The individual's rights
* The provider's duties
* Any other change to the provider's privacy pratices
If revisions are made to the Notice becuase of a material change discussed above, the revised Notice must be redistributed to patients at their next office visit. The revised Notice must also be made available in the office upon request of patients or other persons and must be posted (to replace the existing Notice)
It is the policy of this provider that the Privacy Officer will coordinate the redistribution of the Notice to all patients either by mass mailing or by distributing the Notice on the patient's next visit.
2.6 Retention of Notice
The Privacy Officer must keep copies of all versions of the Notice for at least six years. Signed Acknowledgements and "Good Faith Effort" forms must also be kept for at least six years.
Procedure:
1. The Privacy Officer will be responsible for posting the Notice in the waiting area, or other location where patients will seeit, as well as on the provider's website, if applicable.
2. When a patient signs in for an office visit, front office staff is responsible for checking to see if there is a signed or initialed Acknowledgement in the front of the patient's chart.
3. If the patient does not have a signed or initialed Acknowledgement employees are responsible for giving the patient a copy of the current Notice and obtaining a signed or initialed Acknowledgement.
4. Employees will place a copy of the signed or initialed Acknowledgement in the front of the patient's chart.
5. If an employee is unable to get a signed or initialed Acknowledgement, he or she is responsible for completing a "Good Faith Effort" Form (HIPAA Toolkit Form D) and placing a copy in the front of the patient's chart (with copy to Privacy Officer)
6. If the Acknowledgement cannot be obtained because of an emergency, employees will obtain the signed Acknowledgement as soon as practicable after the emergency situation has ended. If the Acknowledgement cannot be obtained on that date of service, a "Good Faith Effort" Form will be completed and an attempt will be made to get the Acknowledgement signed on the next date of service.
7. If the Notice is revised because of a material change in the provider's privacy practices, the Privacy Officer will coordinate the mailing and/or in person distribution of the revised Notice to all patients and will replace the existing Notice form posted in the organization and on the wesbsite.
8. The Privacy Officer is responsible for retaining copies of the Notice and all revisions in a file for at least six years.
9. The Privacy Officer is responsible for ensuring that the provider retains a copy of the Acknowledgement of "Good Faith Effort" forms for at least six years.
Table of Related Authorities:
1. 45 CFR$164.520 (Notice)
2. 45 CFR$164.530 (Documentaiton and retention)
Davenport Medical Business