Initial Notice Effective April 14, 2003
Revised September 3, 2013
The Arc Gateway, Inc. and Pearl Nelson Child Development Center
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice is provided to you in compliance with the requirements of the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, Title XIII of the American Recovery and Reinvestment Act of 2009 (the HITECH Act) and associated regulations, as may be amended (collectively referred to as “HIPAA”) describing Arc Gateway’s legal duties and privacy practices with respect to your Protected Health Information (PHI).
Please note that when this notice refers to “you” and “your”, we are referring to your child who is receiving services at Arc Gateway, Inc. and Pearl Nelson Child Development Center and his/her protected health information. All references to Arc Gateway, Inc. include the Pearl Nelson Child Development Center.
If you have any questions concerning this notice, please contact:
Director of Children’s Services
916 E. Fairfield Drive
Pensacola, FL 32503
In order to provide health care services, Arc Gateway must obtain and maintain protected health information from you. This Notice of Privacy Practices describes the types of information that is collected and your rights with regards to that information. ARC Gateway, Inc. is required by law to maintain the privacy of protected health information and to provide you with this notice of our legal duties and privacy practices with respect to that protected health information.
Our pledge regarding health information
We understand that medical information about you and your child’s health is personal. We are committed to protecting such medical information about your child. We create a record of the care and services your child receives here at Arc Gateway, Inc. We need this record to provide your child with quality care and to comply with certain legal requirements. This notice applies to all records of your child’s care generated by Arc Gateway, Inc.
This notice describes how we may use and disclose your child’s protected health information in order to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your child’ protected health information.
Protected Health Information
“Protected health information” is information about your child, including demographic information, that may identify your child and that relates to your child’s past, present or future physical or mental health or condition and related health care services.
Protected health information includes the following:
¨ Your child’s health history
¨ Your child’s medical records
¨ Your child’s name, address and date of birth
¨ Your child’s gender
¨ Your child’s social security number
¨ Other similar information that relates to past, present, or future medical care
Health information is any information, whether oral or recorded in any form or medium, that:
Who Will Follow This Notice
The following people will be required to follow the requirements of this Policy Notice:
¨ All employees of Arc Gateway, Inc.
¨ All therapists included in your care and treatment at Arc Gateway, Inc.
¨ Any volunteers we allow to work with you
¨ Any Business Associate allowed access to your Protected Health Information
Sources of Protected Medical Information
Your child’s protected medical information is obtained from a variety of places. These sources include (but are not limited to):
¨ Applications you have completed for health care coverage
¨ Reports and correspondence from your physician(s) or other health care provider
¨ Information obtained from your pharmacist
¨ Information from you, obtained in writing or over the telephone, or in person
¨ Information from your health insurance company/plan or their representative
¨ Information and correspondence from Sacred Heart Hospital or other hospitals
¨ Evaluations and other information from your child’s therapists
¨ Information from your child’s Infant/Toddler Developmental Specialist
¨ Information obtained from your child’s support coordinator
¨ Information obtained from anyone involved in your child’s referral to our agency
¨ Information from other entities involved in your child’s health care
¨ Information from the Escambia School District
¨ Information from the Department of Children and Families
¨ Information from the Agency for Persons with Disabilities
¨ Information from the Social Security Administration
¨ Information from Medicaid
¨ Information from the program serving your child at ARC Gateway
¨ Information from other service providers
¨ Information from the billing department at Pearl Nelson Child Development Center
Uses and Disclosures of Protected Health Information
Arc Gateway will, as allowed by privacy regulations, use and disclose your child’s personal health information for the treatment, payment and health care operations.
Your child’s protected health information may be used and disclosed by Arc Gateway in order to provide your child with services, obtain payment for services and in the health care (business) operation of Arc Gateway.
These treatment, payment, and health care operations include (but are not limited to):
¨ Treatment of your child’s health condition
¨ Provision of your child’s special instruction or other service(s)
¨ Billing for your child’s services to the following sources:
¨ Your insurance company
¨ Sacred Heart Hospital/Early Steps
¨ Part C
¨ Other funding sources
¨ Coordination of benefits/services with other providers
¨ Eligibility for coverage issues
¨ Business planning and development
¨ Budget meetings
¨ Complaint review
¨ Safety Committee Reviews
¨ Staff meetings
¨ Board of Directors meetings
¨ Board of Directors committee meetings
¨ Regulatory review and legal compliance
¨ Quality Assurance review
¨ Family Support Plan meetings
¨ Multi-Disciplinary Team meetings
¨ Review by Service Coordinator
¨ Discussions with Service Coordinator
¨ Funding Source monitoring/reviews
The following categories describe different ways that we may use and disclose medical information about your child. For each category of use/disclosure, we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.
Use and disclosures for treatment and services: We may use medical information about your child to provide therapy treatment, special instruction and other services. Your child’s protected health information may be disclosed to health care providers including doctors, nurses, therapists, pharmacists, laboratory technicians, and other health care personnel involved in your child’s services. It will be disclosed to your child’s Infant/Toddler Developmental Specialist (ITDS) and other staff and therapists as necessary. It will be disclosed to the insurance companies funding your child’s service and your service coordinator. It may also be disclosed to other service providers involved in your child’s care.
Uses and disclosures for payment: Your protected health information will be used, as needed, to obtain payment for your child’s health care services. This may include certain activities that your health insurance plan or funding source may undertake before it approves or pays for the health care and other services. This includes making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity and eligibility, and undertaking utilization review activities. For example, approval for a therapy service may require that your child’s relevant protected health information be disclosed to your health plan. Approval for your child’s services here at Arc Gateway may require disclosure of your child’s protected health information to insurance companies and other payers of services and your service coordinator. Your child’s protected health information may be used, as needed to obtain payment through Medicaid, Sacred Heart Hospital/Early Steps/Part C, private insurance companies and other funding sources.
Uses and disclosures for health care operations: We may use and disclose medical information about your child for operational and business purposes. These uses and disclosures are necessary to provide our services and make sure all the people we serve receive quality care. The information may be used and disclosed for assessments, evaluations, business planning, staffings, Family Support Plan meetings, multi-disciplinary team meetings, monitoring by funding sources and their agents, conferences with Service Coordinator, supervisor/peer review of consumer files for accuracy, audits, legal services, Board of Directors meetings, committee meetings, Managers’ meetings, nursing assessments, medication reviews, or administrative services. We may list your child’s name and demographic information in lists of children served, which are shared with other personnel in the agency (such as the accounting office, HR office, administration, managers meetings, etc.).
We may share your child’s protected health information with our business associates who are hired by us to perform various services for us. These business associates include accreditation agencies, consultants, auditors, attorneys, software and computer support and others as necessary to carry out treatment, billing and health care operations. Whenever an arrangement between our agency and a business associate involves the use or disclosure of your child’s protected health information, we will require the business associate to sign an agreement that contains terms that will protect the privacy of your child’s protected health information.
We may combine your child’s medical information with other medical information so others may use it to study health care, health care delivery and services without being able to identify individuals.
In order to ensure the privacy of your child’s protected health information, Arc Gateway has developed privacy policies and procedures. Procedures are based on appropriate administrative, technical and physical safeguards necessary to maintain confidentiality of your protected health information. Such information is limited to those individuals that have a legitimate business need for that information. This protection extends to use of your child’s protected health information by Arc Gateway business partners.
Non-routine disclosures of personal health information
Other uses and disclosures of your child’s protected health information will be made only with your written authorization, unless otherwise permitted or required by law as described below. For example, if we use your child’s personal health information for marketing/solicitation of funds from agencies such as United Way, City of Pensacola, or Escambia County, we will obtain your authorization. If we use your child’s information for public relation purposes or reporting purposes (such as the monthly newsletter, the staff newsletter, the annual report, brochures), we will obtain your authorization. Arc Gateway will not sell your child’s personal health information without obtaining your authorization. We may use your child’s personal health information to contact you to let you know about any new services or products that we offer and other fund raising activities. In the event that we are using your child’s personal health information to contact you, and you do not wish to receive these fund raising communications, you may opt out of receiving them. If we receive financial remuneration for a marketing communication from the third party whose product or service we are marketing, we will obtain your authorization. For most uses or disclosures of psychotherapy notes (other than for treatment, training or in a legal action or required by law) an authorization will be required. Arc Gateway will use or disclose information in these circumstances pursuant to the specific purpose contained in your authorization and will only use or disclose the minimum amount of information necessary to perform the non-routine function. You may revoke this authorization, at any time, in writing, except to the extent that Arc Gateway has taken action in reliance on the use or disclosure indicated in the authorization or if the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself.
In most circumstances, authorization may only be made by the person to whom the protected health information pertains (or parent or other legal guardian). In some circumstances, authorization may be obtained from a person representing your interests (such as in the case where you may be too incapacitated to make an informed authorization) or in emergency situations where authorization would be impractical to obtain.
Other uses or disclosures of personal health information not covered above or below will be made only with your authorization.
Other Permitted and Required Uses and Disclosures That May be Made With Your Authorization or Opportunity to Object
We may use and disclose your child’s protected health information in the following instances. You have the opportunity to agree or object to the use or disclosure of all or part of your child’s protected health information. If you are not present or able to agree or object to the use or disclosure of the protected health information, as in the case of an emergency, we will rely on our professional judgement. In this case, only the protected health information that is relevant to your child’s health care will be disclosed.
In the following instances, we may use and disclose your child’s protected health information if you have not objected:
Others Involved in Your Healthcare or Services:
Unless you object, we may disclose to a member of your family, a relative, a close friend, your child’s caretaker or any other person that you identify, your child’s protected health information that directly relates to that person’s involvement in your child’s health care/services. If you are unable to agree to or object to such a disclosure, we may disclose such information as necessary if we determine based on our professional judgement that it is in your best interest. We may use or disclose protected health information to notify or assist in notifying a family member, personal representative or any other person that is responsible for your child’s care of your child’s location, general condition or death. Finally, we may use or disclose your child’s protected health information to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your child’s health care/services.
We may use or disclose your child’s protected health information in an emergency treatment situation. If this happens, the staff/therapists will try to obtain your consent as soon as reasonably practicable after delivery of treatment.
We may use and disclose your child’s protected health information if the therapist, ITDS or other staff attempts to obtain consent from you but is unable to do so due to substantial communication barriers and the therapist or ITDS or other staff determines, using professional judgement, that you intend to consent to use or disclosure under the circumstances.
Other Permitted and Required Uses and Disclosures That May be Made Without Your Authorization or Opportunity to Object
We may use or disclose your child’s protected health information in the following situations without your authorization. The following list is covered in greater detail below.
Non-routine disclosures may be made without your authorization for:
¨ As required by law
¨ For public health activities
¨ Regarding victims of abuse, neglect or domestic violence
¨ For health oversight activities
¨ For judicial and administrative proceedings
¨ For law enforcement purposes
¨ About decedents
¨ For cadaveric organ, eye or tissue donation purposes
¨ For research purposes
¨ To avert a serious threat to health or safety
¨ For specialized government functions
Required by Law:
We may use or disclose your child’s protected health information to the extent that the use or disclosure is required by federal, state, or local law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, if required by law, of any such uses or disclosures.
We may disclose your child’s protected health information for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury or disability. We may also disclose your child’s protected health information, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority.
We may disclose your child’s protected health information to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, track products; to enable product recalls, to make repairs or replacements, or to conduct post marketing surveillance, as required.
We may disclose your child’s protected health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
Abuse or Neglect:
We may disclose your child’s protected health information to a public health authority that is authorized by law to receive reports of child (or disabled adult) abuse or neglect. In addition, we may disclose your child’s protected health information if we believe that your child has been a victim of abuse, neglect, or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of the applicable federal and state laws.
We may disclose protected health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Judicial and Administrative proceedings
We may disclose protected health information in the course of a court or administrative tribunal or in response to a subpoena, discovery request, or other lawful process.
We may also disclose medical information, so long as applicable legal requirements are met, for law enforcement purposes. These law enforcement purposes include:
¨ Legal processes and as otherwise required by law
¨ Limited information requests for identification and location purposes
¨ Pertaining to victims of a crime
¨ Suspicion that death has occurred as a result of criminal conduct
¨ In the event that a crime occurs on our premises
¨ In response to emergencies
We may release medical information to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose medical information to a funeral director, as authorized by law, in order to permit the funeral director to carry out their duties.
Protected health information may be used and disclosed for organ, eye or tissue donation purposes.
Under certain circumstances, we may use and disclose medical information about your child to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your child’s protected health information.
Avert Serious Threat to Health or Safety:
We may use and disclose medical information about your child when necessary to prevent a serious threat to your child’s health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat. We may also disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual.
Specialized Government Functions:
Military and Veterans
If you are a member of the armed forces, we may release medical information as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority. If you are a member of the Armed Forces, we may disclose medical information to the Department of Veterans Affairs upon your separation or discharge from military services. This disclosure is necessary for the Department of Veterans Affairs to determine if you are eligible for certain benefits. If you are enrolled for community based services through the Department of Veteran Affairs, we may use and disclose to the Department of Veterans Affairs medical information to determine whether you are eligible for certain benefits, for treatment, for payment and for agency operations.
National Security and Intelligence Activities
We may release medical information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
Protective Services for the President and Others
We may disclose protected health information to authorized federal officials for the provision of protective services to the President or others as required by law.
Correctional Institutions and Other Law Enforcement Custodial Situations
If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for safety and security of the correctional institution.
Required Uses and Disclosures:
Under the law, we must make disclosures about your child when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of Section 164.500 et.seq. (HIPAA regulations).
Your Rights Regarding Medical Information About You
You have the following rights regarding medical information we maintain about your child:
Right to Inspect and Copy:
You have the right to review your child’s protected health information maintained by Arc Gateway and to obtain a copy of such information. You have the right to receive an electronic copy of your child’s protected health information if that information is maintained in an electronic format. If we cannot provide you with the requested electronic format, we will provide you with another format. For instance, if you request an Excel format and the information cannot be converted to Excel, we will provide you with another format such as PDF. If no other electronic format is acceptable to you, we will provide a paper copy of the information. If you request that the electronic protected health information be emailed to you, please be advised that email is not secure and the information may be viewed by other persons.
The request for electronic medical records should be in writing. If you request that we send the information to a third party, that must be included in the written request, along with the address, email address, etc. of the third party. You must clearly identify the third party. You must sign the request.
Under federal law, however, you may not inspect or copy the following records: 1) psychotherapy notes; 2) information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding, and protected health information that is subject to law that prohibits access to protected health information. There are also limited circumstances where we may deny access. The denial would be for such circumstances as: 1) if a licensed health care professional has determined that the access requested is reasonably likely to endanger the life or physical safety of the person served or another individual; 2) the protected health information makes reference to another person (other than Arc staff, Service Coordinator or other provider) and a licensed health care professional has determined that access is reasonably likely to cause substantial harm to such other person; 3) the information revealed will reveal protected health information about another child/person served; or 4) the request was made by the individual’s personal representative and a licensed health care professional has determined that access to such personal representative is reasonably likely to cause substantial harm to the person served or another person.
To inspect and copy medical information, you must submit your request in writing to our Privacy Contact. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.
If we deny your request for access for the reasons stated above, we will notify you in writing. You have the right to have the request reviewed by a licensed health care professional who is designated by Arc Gateway to act as a reviewing official and who did not participate in the original decision to deny.
Right to Amend:
You also have the right to request amendments to your child’s protected health information if you feel the information is incorrect or incomplete. Requests for amendments must be made in writing and must include a reason for the requested amendment. You must submit the request to the Privacy Contact listed on the first page of this notice. You have the right to request an amendment for as long as the information is kept by our agency.
We may deny your request for an amendment if it is not in writing, or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:
¨ Was not created by us, unless that person or entity that created the information is no longer available to make the amendment
¨ Is not part of the medical information kept by or for our agency
¨ Is not part of the information which you would be permitted to inspect and copy; or
¨ Is accurate and complete
Right to an Accounting of Disclosures:
You have a right to request an accounting of disclosures made by Arc Gateway during the period of up to six (6) years prior to the date on which you make your request. Any accounting you request will not include: 1) those for treatment, billing and business operations, 2) those authorized by you, 3) those made to you, 4) those made to other people involved in your care or made for notification purposes, 5) those made for national security or intelligence purposes, 6) those made to correctional institutions or law enforcement officials or 7) those made prior to April 14, 2003 made by Arc Gateway. This request must be made in writing and submitted to the Privacy Contact listed on page one of this notice. Your request must state a time period. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to an Access Report for Electronic Protected Health Information:
You have a right to request a written access report that indicates who has accessed protected health information about your child in a designated record set, if applicable, that is maintained by Arc Gateway. This request must be made in writing and submitted to the Privacy Contact listed on page one of this notice. Your request must state a time period, which may not be longer than three years prior to the date on which the access report is requested. The first report you request within a 12-month period will be free. For additional reports, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to Request Restrictions:
You have the right to request a restriction or limitation on the medical information we use or disclose about your child for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about your child to someone who is involved in your child’s care or the payment for your child’s care, like a family member or friend. For example, you could ask that we not use or disclose information about a surgery that your child had.
We are not required to agree to your request with one exception discussed below. If we do agree to the restriction, we may not use or disclose your protected health information in violation of that restriction unless it is needed to provide emergency treatment.
We are required to agree to your request to restrict or limit the information we use or disclose to your funding source/payer IF you have paid for the service in full yourself. The agreement to restrict or limit the information we use or disclose would be for only that service/month that you paid for the service in full yourself. In the event that we are required by law to allow the use or disclosure, the agreement would not apply. We may require full payment for the service in advance if we agree to your request.
To request restrictions, you must make your request in writing to the Privacy Contact listed on the first page of this notice. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; (3) to whom you want the limits to apply, (for example, disclosures to your spouse).
Right to Request Confidential Communications:
We routinely use the phone numbers you or your Service Coordinator have given us when we contact you. If you want us to contact you elsewhere, you have the right to request that communications regarding your protected health information from Arc Gateway be made at a certain time during normal working hours or location if you do not want us to use the numbers we have on file for you. If you want us to contact you elsewhere, you must specify how or where you wish to be contacted. You may also request that meetings be held in a confidential setting. This request must be in writing to the Privacy Contact listed on page one of this notice. For example, if you prefer not to get reminders of appointments at work, you may make that request. We will accommodate all reasonable requests.
Right to be Notified of Breach of Protected Health Information:
You have the right to be notified of any breach of your child’s protected health information. If there is a breach, we will notify you of the circumstances of the breach as well as recommend steps that you should take to protect yourself from potential harm resulting from the breach.
Changes to Privacy practices
We are required to abide by the terms of this Notice of Privacy Practices. We may change the terms of our notice at any time. We reserve the right to make the revised or changed notice effective for medical information we already have about your child as well as any information we receive in the future. We will post a copy of the current notice at your program. The notice will contain, on the first page, in the right hand corner, the effective date. You may request a copy of the current notice at any time from your Program Manager/Director.
Up-to-date privacy notices are maintained on the Arc Gateway web site at www.arc-gateway.org.
If you feel your rights under this Notice of Privacy Practices have been violated in any way, please contact the Privacy Contact (see page one), or the Arc Gateway Privacy Official below:
Administrative Services Director
The Arc Gateway, Inc.
3932 N. 10th Avenue
Pensacola, FL 32503
All complaints must be in writing, explaining how we have violated your Privacy Rights.
You may also contact the Secretary of the Department of Health and Human Services. However, we request that you allow Arc Gateway the opportunity to resolve any issue concerning your privacy before contacting the Secretary.
There will be no retaliation of any kind for complaints submitted under this Privacy Notice.
By law, we are required to make available to you a copy of our Notice of Privacy Practices. By signing below you acknowledge that you received, or been offered and declined, a copy of this Notice.
Acknowledgement of Receipt of Notice of Privacy Practices (Effective April 14, 2003, revised September 3, 2013)
“I acknowledge receipt of this Notice of Privacy Practices from The Arc Gateway, Inc. and acknowledge that I have had the opportunity to read this Notice of Privacy Practices (or it has been explained to me), and ask questions regarding the privacy practices of The Arc Gateway. I was also provided a copy of this Notice.”
Signature of Individual/Parent/Guardian
The individual was provided a copy of this Notice of Privacy Practices and has either been unable to sign, or has refused to sign the acknowledgment of receipt.
The Arc Gateway Representative.
NOTE: This copy of the acknowledgement is to be retained by Arc Gateway, Inc. It will be kept for 6 years.
By law, we are required to make available to you a copy of our Notice of Privacy Practices (Notice). By signing below you acknowledge that you received, or been offered and declined, a copy of this Notice.
Acknowledgement of Receipt of Notice of Privacy Practices (Effective April 14, 2003, revised September 3, 2013)
“I acknowledge receipt of this Notice of Privacy Practices from Arc Gateway, Inc. and acknowledge that I have had the opportunity to read this Notice of Privacy Practices (or it has been explained to me), and ask questions regarding the privacy practices of Arc Gateway. I was also provided a copy of this Notice.”
Signature of Individual/Parent/Guardian
The individual was provided a copy of this Notice of Privacy Practices and has either been unable to sign, or has refused to sign the acknowledgment of receipt.
Arc Gateway Representative.