HIPAA-No Surprises Act-Non Discrimination
HIPAA Protecting Patient Privacy
In accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), our office must ensure the confidentiality, integrity and availability of all the protected health information (“PHI”) it creates, receives, maintains, or transmits. Our office must also protect against any reasonably anticipated hazards to the security and integrity of PHI. The following information and guidelines should provide all employees with the information needed to properly handle and maintain PHI.
What is considered protected health information?
PHI is generally any individually identifiable information that is transmitted or maintained by electronic or other media that relates to an individual’s past, present or future physical or mental health, treatment, payment for services or healthcare operations. To be PHI the information must identify the individual or provide a reasonable basis for identifying the individual (ex. name, address, DOB, email, medical/billing records, etc.). We must protect all PHI items (records, diagnosis, x-rays, photos, billing information, etc.
Who is authorized to access confidential PHI?
Information that our office collects or creates that relates to a patient’s health/care can only be used in limited ways without patient authorization. Patient authorization is not required when doctors/staff use information to determine what services they should receive or reviewing quality of care. PHI may also be used without authorization to bill (or insurance) for the services they received or to fulfill other administrative and support functions.
▪ Healthcare providers are required to report certain communicable diseases to state health agencies, even if the patient does not want information reported.
▪ Courts have the right to order health care providers to release patient information with appropriate court orders.
▪ Under limited circumstances, providers may disclose PHI to police
▪ Child/elderly abuse must be reported to state agencies.
These disclosures are further explained in Notice of Privacy Practices. For other uses/disclosure, our office must get a signed authorization/email from the patient.
What is the “minimum necessary” standard?
When a covered entity discloses PHI or requests PHI from another covered entity, the covered entity must make reasonable effort to limit PHI which is reasonably necessary to accomplish the intended purpose of the use, disclosure, or request.
What rights do patients have to their PHI?
▪ Right to reserve a paper copy of the “Notice of Privacy Practices” (informs of rights and how to use them).
▪ Right of access: patients may request to inspect medical records and/or request copies (paper or electronic).
▪ Right to request an amendment: patients may file a request for an amendment to their medical records.
▪ Right to an accounting of disclosures: patients have the right to receive an accounting of disclosures which documents those disclosures for which patient has not signed an authorization.
▪ Right to request restriction: patients have the right to request restrictions on how we will communicate with patients or release information.
▪ Right to complain: patients have the right to complain if they feel their privacy rights have been violated.
▪ Right to receive notice of security breach
What steps must I take to safeguard PHI?
→ be careful what you disclose on phone (closed quarters)
→ close patient doors when discussing treatments, etc.
→ avoid discussions about patients in public areas
→ do not allow patients access to computer screen with other patient information viewable
What if I see someone violate HIPAA?
If you become aware of any HIPAA violations, including a security breach, immediately report to your supervisor or our Privacy Officer.
Non-Discrimination Notice
DHSC complies with applicable Federal Civil Rights laws and does not exclude/deny benefits to or otherwise discriminate against any person on the basis of race, color, national origin, disability, sex, religion, or age in admission to, or receipt of the services and benefits.
No Surprises Act
The No Surprises Act is a federal law that took effect in 2022, protecting patients from most instance of “surprise balance billing”.
Surprise balance billing happens when patients unknowingly receive care from an out-of-network provider in an emergency or at an in-network facility, and the provider then bills the patient for the portion of their bill that’s above the amount allowed by the patient’s health plan.
DHSC is an out of network/non-participating provider. You have the right to receive services at a participating facility with your insurance company in order to obtain full benefits under your health coverage.
DHSC informs patients of OON status…
♦ Intake Link ♦ Welcome Email ♦ OON Form
♦ Phone ♦ Consultation ♦ Wall Display
***DHSC is an out of network provider***
