This notice describes how medical information about Walker clients and employees can be used and disclosed and how the client and employee can obtain access to this information. Please review this policy carefully.
The federal Health Insurance Portability and Accountability Act (HIPAA)'s privacy regulations provide clients with important rights regarding access to and disclosure of medical records. Effective April 14, 2003, this policy describes procedures used by Walker to protect the privacy of clients and family members who receive services from Walker. By law, Walker must maintain the privacy of certain health information and provide clients with a notice about Walker’s legal duties and privacy practices regarding this information. Walker will use protected health information only as stated in this notice.
Protected health information (“PHI”) includes any health information collected or received by Walker that personally identifies a client concerning past, present, or future physical or mental health conditions or payment for health care.
Unless otherwise permitted by law, a client’s PHI cannot be disclosed to anyone or used for any purpose not expressly authorized by the client or client’s guardian in writing. However, the law recognizes that obtaining written authorization for certain types of disclosures and uses of PHI would prove to be impractical or unduly cumbersome. In particular, no written authorization is required to use and disclose PHI as needed for medical treatment, payment of medical bills, and health care operations. In addition, a number of limited exceptions allow disclosure of PHI without written consent for certain legal, public health, and medical purposes.
Walker does not need a client’s or a client’s guardian’s written permission to disclose and use PHI for the following reasons:
- Treatment: Walker may use and/or disclose the client’s health information without prior authorization in order to provide health care and or related services to the client. Due to the complex nature of treatment and education services at Walker, the client’s health information will be shared among the members of the client’s treatment teams, i.e., Walker’s clinicians, educators, case, managers, doctors and direct care staff and others involved in the client’s care, in order to coordinate and manage treatment services. Walker may also disclose health information to other health care providers (such as the client’s primary care physician, a laboratory, a pharmacy) external to Walker only as it relates to treatment.
- Payment. Walker may use and disclose the client’s personal health information without the client or client’s guardian’s authorization for the purpose of billing and collecting payment from the client’s insurer or third party payer for treatment services received by the client. The insurer or third party payer may need a client’s health information in order to approve payment for services received by the client from Walker. These actions might include:
- Making a determination of eligibility or coverage for health insurance;
- Reviewing services to determine medical necessity according to the client’s health plan’s rules;
- Reviewing services that a client receives to determine if those services were appropriately authorized or certified in advance of care; or
- Reviewing services received by a client for the purpose of utilization review, to ensure appropriateness of care, or to justify charges for that care.
- Health care operations. Walker may use and disclose a client’s personal health information without authorization for the purpose of conducting those activities necessary for regular health care service administration and ensuring quality of care; for example, for conducting quality assessments and improvement activities, evaluating staff performance and qualifications, training professional students in clinical activities, in licensing or accreditation procedures, business planning and development, and carrying out general administrative activities.
Walker may combine the health information data of clients in order to review, refine and redesign services, and for planning new services. Walker may also combine its health information data with that of other providers in order to assess how well Walker provides services and to determine which service areas need improvement. When doing so, Walker will remove any and all identifying information in order to protect the client’s anonymity. We may also use and disclose a client’s health information for the purpose of scheduling and providing reminders for treatment service appointments.
Besides allowing use and disclosure of PHI for treatment, payment, and health operations, the law permits certain other uses and disclosures of PHI without written consent. Under these exceptions, Walker can use and disclose PHI without written authorization to certain individuals for particular purposes or under specific conditions:
- Legal compliance. Walker can use and disclose PHI as required by federal, state, or local law or regulation, or to comply with valid legal requests, such as subpoenas, discovery requests, and other court or administrative orders. Walker also must disclose PHI to the Secretary of the U.S. Department of Health and Human Services for HIPAA compliance purposes.
- Law enforcement. Walker can disclose PHI to law enforcement officials when reporting a suspected workplace crime or a death due to a suspected crime. Law enforcement officials can request and receive PHI for purposes of locating or identifying a suspect, fugitive, witness, or missing person. Law enforcement officials also can receive limited PHI when needed to identify a crime victim, but only when the client’s guardian is unable to give consent to the disclosure and when certain other conditions are met. In addition, correctional facilities can receive PHI when needed for medical or safety reasons.
- Public health and safety. Various federal public health agencies and certain individuals can receive PHI to address a serious and imminent safety and health threat to a client or to the general public. Walker also can disclose PHI to appropriate authorities when required to comply with Food and Drug Administration regulations, or to prevent or control the spread of disease, injury, or disability. Walker may disclose health information as necessary for public health activities, including disclosures to:
- Report to public health authorities for the purpose of preventing or controlling disease, injury or disability;
- Report vital events such as birth or death;
- Conduct public health surveillance or investigations;
- Report child abuse or neglect;
- Report certain events to the Food and Drug Administration (FDA) by a person subject to the jurisdiction of the FGD including information about defective products or problems with medications;
- Notify clients and consumers about FDA initiated product recalls.
- Notify a person who may have been exposed to a communicable disease or who is at risk of contracting or spreading a disease or condition;
- Notify the appropriate government agency if we believe an adult has been a victim of abuse, neglect or domestic violence. Walker will only notify an agency if we obtain your agreement or if we are required or authorized by law to report such abuse, neglect or domestic violence.
- Health oversight committees. In general, government health agencies can receive a client’s PHI for necessary and authorized oversight activities, including audits, investigations, licensing activities, criminal or administrative proceedings, and inspections.
- Medical examiners and funeral directors. Medical examiners can receive a client’s PHI for identification purposes, determinations of the cause of death, or other authorized reasons; funeral directors also can receive a client’s PHI for carrying out specific duties.
- Organ and tissue donation. If a client is an organ or tissue donor, Walker can provide the client’s PHI to organ procurement organizations or other entities for facilitating organ or tissue donation or transplants.
- Research purposes. Walker can provide client PHI for authorized research purposes. The Walker Institutional Review Board (“IRB”) must approve all research that seeks to collect data from the staff or clients of Walker. All research proposals are reviewed to ensure that they respect the confidentiality of clients and staff, address issues relevant to the population of Walker, and take into account the unique characteristics of the place and its people.
- Workers' compensation. Walker can disclose a client’s PHI for workers' compensation or related purposes.
- Military or national security functions. If a consumer currently serves in, has been discharged from, or is a veteran in a U.S or foreign military service, Walker can provide the consumer’s PHI as required by appropriate military authorities.
- National security and intelligence activities. Walker also can disclose the consumer’s PHI for authorized national security and intelligence activities.
While the client’s or client’s guardian’s written authorization is not required for the above-listed disclosures and uses of PHI, Walker is legally obligated to release only the minimum details necessary to carry out these authorized functions. In addition, the exceptions to obtaining written authorization do not apply to disclosures of certain types of PHI and certain uses of any type of PHI. In particular, a client or client’s guardian’s express written authorization almost always is required in these situations:
- Disclosure of psychotherapy notes. Walker must receive the client’s or client’s guardian’s authorization in most cases before releasing PHI involving the client’s psychotherapist’s notes taken during mental health sessions.
- Use of PHI for marketing purposes. Walker must receive the client’s or client’s guardian’s authorization for using or disclosing PHI for certain marketing purposes.
Clients have certain rights regarding their protected health information. These rights include the following:
- The right to designate a relative or representative to access the client’s PHI. The client’s guardian can provide written notice to Walker to designate a relative, friend, lawyer, or other individual as someone closely involved in the client’s health care to whom Walker can disclose PHI for any purpose the client’s guardian specifically permits. This authorization allows Walker to release all appropriate records to the client’s designated representative, without obtaining a separate authorization from the client’s guardian for each record request. The client’s guardian can revoke this authorization at any time.
- The right to request restrictions on certain uses and disclosures of PHI. A client can ask Walker to restrict any use or disclosure of PHI for carrying out treatment, payment, or health care operations or to a personal representative, including family members. Walker does not have to agree, however, to a restriction and can disclose a client’s PHI as allowed or required by law or if an emergency arises.
- The right to receive confidential communications of PHI. A client can receive PHI communications through alternative means or at alternative locations if the communication channels normally used would jeopardize the client’s physical safety. To exercise this right, the client must give Walker a written statement indicating that disclosing all or part of PHI through normal channels could endanger the client.
- The right to inspect and copy PHI. A client can make a written request to inspect and copy any PHI that Walker retains. Information compiled for use in any legal proceeding, or records otherwise restricted or exempted from disclosure under federal law or regulation. The client can be charged a nominal fee for copying costs, mailing, and preparation of PHI information. Walker will provide access to the requested record in a timely manner or issue a written denial within mandated deadlines, usually 30 or 60 days depending on how recently the record was created and whether it is maintained on site. If the request is denied, a review of the denial will be available in most cases.
- The right to amend protected health information. A client can amend their PHI by sending Walker a written request explaining the need for changing the PHI. The client’s request can be denied if the PHI is not available for inspection by law or if Walker did not create the PHI record, does not maintain the record, or determines that the record is complete and accurate. Walker also will amend the client’s PHI if it receives amended PHI from an appropriate entity covered by the law.
- The right to receive an accounting of disclosures of protected health information. Walker will provide the client with a statement of certain PHI disclosures for up to six years prior to the date of a written request, except for PHI disclosures made before April 14, 2003. However, Walker does not have to supply an accounting of certain routine or permitted PHI disclosures, such as disclosures made to a client’s designated representative or to carry out treatment, payment, or health care operations. No charge applies to the client’s first request for an accounting of disclosures in a given year. A nominal administrative fee applies if the client submits additional requests within the same 12-month period; however, the client can reduce or avoid extra charges by modifying or withdrawing additional requests. Walker will supply this accounting within 60 days of the client’s request, unless it notifies the client in writing of the need for a 30-day extension.
- The right to receive a privacy notice. Walker clients receive a copy of this notice upon admission and can request additional copies at any time. The client also can request a printed version of this privacy notice if the first notice was received electronically. By law, Walker must issue reminders at least every three years informing participants of their right to receive this notice and where to obtain copies of it.
Walker can change policy provisions at any time for compliance or other reasons. In general, changes to this policy will be effective on the date the policy is revised. Walker clients will receive information regarding changes to this policy within 60 days after the revision is made and can request a revised copy of the policy.
Clients can submit written complaints regarding violations of this policy to Walker's HIPAA Compliance officer, Walker’s managing director, or to the Secretary of the U.S. Department of Health and Human Services at http://www.os.dhhs.gov
Clients will not be retaliated against or penalized in any manner for filing a complaint, participating in any legal proceeding regarding this policy, or opposing any unlawful act or practice conducted by Walker. For more information on this policy or client privacy rights, contact: