The Neurology Foundation, Inc.

Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

WE HAVE A LEGAL DUTY TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (“PHI”)

Federal law requires that we provide you with this notice of our privacy practices.  In this notice, we describe the ways that we may use and disclose your health information.  We are required by law to protect the privacy of health information that identifies, or can be used to identify, a patient.  This information is called “protected health information” (“PHI”).  This notice describes your rights as our patient, and our obligations regarding the use and disclosure of your PHI.

We are required by law to maintain the privacy of your PHI, give you this Notice of our legal duties and privacy practices with respect to PHI, and comply with the terms of this Notice of Privacy Practices.

We reserve the right to make changes to this notice and to make such changes effective for all PHI we may already have about you.  If and when this notice is changed, we will post a copy in our office (or facility) in a prominent location.  We will also provide you with a copy of the revised notice upon your request to our Privacy Officer.

HOW WE MAY USE AND DISCLOSE YOUR PHI

Use of PHI for Treatment, Payment or Health Care Operations:

Treatment:  We may use and disclose your PHI to provide, coordinate or manage your health care and related services; consult with other health care providers regarding your treatment or to coordinate and manage your health care; when you need a prescription, lab test, x-ray, or other health care service; or when referring you to another health care provider for treatment.  For example, we may disclose your PHI to a physician we refer you to regarding whether you are allergic to any medications, or we may send a report about your care from us to a physician that we refer you to so that the other physician may treat you.

Payment:  We may use and disclose your PHI so that we can bill and collect payment for the treatment and services we provide to you.  For example, before providing treatment or services, we may share details with your health plan concerning the services you are scheduled to receive, or we may ask for payment approval from your health plan before we provide care or services.  We may also use and disclose your PHI to find out if your health plan will cover the cost of care and services we provide; to confirm you are receiving the appropriate amount of care to obtain payment for services; for billing, claims management, and collection activities; or to insurance companies providing you with additional coverage.  We may also disclose limited PHI to consumer reporting agencies relating to collection of payments owed to us, or to another health care provider for the payment activities of that health care provider.

Health Care Operations:  We may use and disclose your PHI to perform routine business activities (“health care operations”).  Health care operations include practices that allow us to improve the quality of care we provide and to reduce health care costs.  For example, we may use and disclose your PHI to review and improve the quality, efficiency and cost of care that we provide; to improve health care and lower costs for groups of people who have similar health problems and to help manage and coordinate the care for these group of people; to review and evaluate the skills, qualifications, and performance of health care providers who take care of you; to provide training programs for students, trainees, or health care providers to help them practice or improve their skills; to cooperate with outside organizations that assess the quality of the care that we provide or evaluate, certify, or license health care providers or staff in a particular field or specialty; to cooperate with various professionals who review our activities, including doctors that review the services provided to you, accountants, lawyers, and others who assist us in complying with the law and managing our business; to assist us in making plans for our future operations; to resolving complaints within our practice (facility); for business planning and development, such as cost-management analyses; and for use in sign-in sheets where you may be asked to sign your name.  We may also call you by name in the waiting room when your doctor is ready to see you and call you to remind you of an appointment.

Uses and Disclosures for Which You Have the Opportunity to Agree or Object
Disclosures to Family, Friends or Others:  We may disclose your PHI to a family member, close friend, or any other person that is involved in your care or the payment for your health care, unless you object.

Other Uses and Disclosures We Can Make Without Your Written Authorization or Opportunity to Agree or Object:
We may use and disclose your PHI in the following circumstances without your authorization or opportunity to agree or object:

Required By Law:  We may use and disclose PHI when we are required to do so by federal, state or local law.

Public Health Activities:  We may use or disclose PHI to public health authorities or other authorized persons to carry out certain activities related to public health, including activities designed to prevent or control disease, injury, or disability; report disease injury, birth, or death; report reactions to medications or problems with products or devices regulated by the Federal Food and Drug Administration or other activities related to quality, safety, or effectiveness of FDA- regulated products or activities; or to notify a person who may have been exposed to a communicable disease in order to control who may be at risk of contracting or spreading the disease.

Abuse, Neglect or Domestic Violence:  We may disclose PHI in certain cases to government authorities if we reasonably believe that a patient has been a victim of domestic violence, abuse or neglect.

Health Oversight Activities:  We may disclose PHI to a health agency for oversight activities such as audits, investigations, inspections, licensure or disciplinary activities.

Lawsuits and Other Legal Proceedings:  We may use or disclose PHI when required by a court or administrative order.  We may also disclose PHI in response to subpoenas, discovery requests, or as otherwise required by law.

Law Enforcement:  Under certain conditions, we may disclose PHI to law enforcement officials.  These law enforcement purposes include legal processes required by law; limited requests for identification and location purposes; suspicion that death has occurred as a result of criminal conduct; in the event that a crime occurs on the premises of the practice; pertaining to victims of a crime; or in response to a medical emergency not occurring at the office, where it is likely that a crime has occurred.

Coroner, Medical Examiners, Funeral Directors:  We may disclose PHI to a coroner or medical examiner to identify a deceased person and determine the cause of death, or to funeral directors so that they may carry out their jobs.  (????We will need our legal advice to pay particular attention to this since I don’t think in RI we can give to Funeral Directors, even if infectious disease, etc, without consent)

Organ and Tissue Donation:  If you are an organ donor, we may use or disclose PHI to organizations that help procure, locate, and transplant organs in order to facilitate an organ, eye, or tissue donation and transplantation.

Research:  We may use and disclose PHI for research purposes under certain limited circumstances.  We must obtain your written authorization to use and disclose your PHI for research purposes except in situations where a research project meets specific, detailed criteria established by law.

To Avert a Serious Threat to Health or Safety:  We may use or disclose PHI in limited circumstances when necessary to prevent a threat to the health or safety of a person or to the public.  This disclosure can only be made to a person or organization that is able to help prevent the threat.

Specialized Government Functions:  We may disclose PHI under the following circumstances:

• Per certain military and veteran activities, including determinations of eligibility for veterans benefits and where deemed necessary by military command authorities
• For national security and intelligence activities
• To help provide protective services for the president and others
• For the health or safety of inmates and others at correctional institutions

Disclosures required by law:  We are required to disclose PHI to the Secretary of the United States Department of Health and Human Services, upon request, to review our compliance with the privacy regulations.

Worker’s Compensation:  We may disclose PHI as authorized by workers’ compensation laws or other similar programs that provide benefits for work-related injuries or illness.

All Other Uses and Disclosures of PHI Require Your Authorization

All other uses and disclosures of your PHI will only be made with your written authorization.  If you have authorized us to use or disclose your PHI, you may revoke your authorization at any time, except to the extent we have taken action based on the authorization.

YOUR RIGHTS REGARDING YOUR PHI

Under federal law, you have the following rights regarding PHI about you:

Right to Request Restrictions:  You have the right to request additional restrictions on the PHI that we may use for treatment, payment and health care operations.  You may also request additional restrictions on our disclosure of PHI to certain individuals involved in your care that otherwise are permitted by the Privacy Rule.  We are not required to agree to your request.  If we agree to your request, we will comply with our agreement except in certain cases, including where the information is needed to treat you in the case of an emergency.  To request restrictions, you must make your request in writing to our Privacy Officer.  In your request, please include (1) the information that you want to restrict; (2) how you want to restrict the information (for example, restricting use to this office, only restricting disclosure to persons outside this office, or restricting both); and (3) to whom you want those restrictions to apply.

Right to Receive Confidential Communications:  You have the right to request that you receive communications regarding PHI in a certain manner or at a certain location.  For example, you may request that we contact you at home, rather than work.  You must make your request in writing to (our Privacy Officer).  You must specify how you would like to be contacted (for example, by e-mail instead of regular mail).  We are required to accommodate reasonable requests.

Right to Inspect and Copy:  You have the right to inspect and receive a copy of your PHI in certain records that we maintain.  This includes your medical and billing records but does not include psychotherapy notes.  Please contact our Privacy Officer if you have questions about access to your medical record.  If you request a copy of your PHI, we may charge you a reasonable fee for the copying, postage, labor and supplies used in meeting your request.  We will respond to your request within 30 days.

Right to Amend:  You have the right to request that we amend your PHI, as long as such information is kept by or for our office.  To do so, you must submit your request in writing to our Privacy Officer.  You must also give us a reason for your request.  We may deny your request in certain cases.  For example, if the request is not in writing or if you do not provide a reason for the request.

Right to Receive a Listing of Disclosures:  You have the right to request a listing of certain disclosures that we have made of your PHI.  This is a list of disclosures made by us other than disclosures made for treatment, payment, and health care operations.  It excludes disclosures made to you or to family members and friends involved in your care.  You have the right to receive specific information regarding these disclosures that occurred after April 14, 2003.  The first list that you request in a 12-month period will be free, but we may charge you for our reasonable costs of providing additional lists in the same 12-month period.  We will tell you about these costs, and you may choose to cancel your request at any time before costs are incurred.

Right to a Paper Copy of this Notice:  You have a right to receive a paper copy of this notice at any time.  You are entitled to a paper copy of this notice even if you have previously received this notice electronically.  To obtain a paper copy of this notice, please contact our Privacy Officer.

PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO FILE A COMPLAINT ABOUT OUR PRIVACY PRACTICES

If you think that we have not properly respected the privacy of your health information, you are free to complain to us or the U.S. Department of Health and Human Services, Office for Civil Rights.  We will not retaliate against you if you make a complaint and your compliant will not alter or affect the care we provide to you.  If you want to complain to us, send a written complaint to the Privacy Officer,  __________________________at _________________________.  If you prefer, you can discuss your complaint in person or by phone.

EFFECTIVE DATE OF THIS NOTICE

This Notice is in effect as of April 14, 2003.

NF Policy – Accounting of Disclosures of PHI

PURPOSE

Federal HIPAA regulations (45 C.F.R.&164.528) allow individuals to ask that we provide an accounting of disclosures of the individual’s protected health information (“PHI”) made by us in the six years prior to the date of the individual’s request for the accounting.

POLICY

It is our policy to provide individuals of an accounting of disclosures of PHI, upon request.

PROCEDURES

1. Disclosures for which No Accounting is Required

Covered entities do not have to account for disclosures:

• For the purpose(s) of treatment, payment, or health care operations;
• To the individual;
• Pursuant to an authorization;
• For the facility’s directory or other notification purposes (e.g., to family or friends);
• For national security or intelligence purposes;
• To correctional institutions for law enforcement officers regarding inmates;
• As part of a limited data set; or
• Prior to the compliance date (April 14, 2003).

In addition, under certain circumstances, we must temporarily suspend an individual’s right to an accounting of disclosures of the individual’s PHI to a health oversight agency or law enforcement official, if we receive official notice that such an accounting would impede the agency’s activities and which specifies the time for which such a suspension is required.

2. Contents of the Accounting

The accounting must include, for each disclosure:

• The date of the disclosure;
• The name and, if known, the address of the recipient;
• A brief description of the PHI disclosed; and
• A brief statement of the purpose of the disclosure or a copy of the written request for a disclosure.

However, there are also special rules for multiple disclosures to the same person for a single purpose and for disclosures for research involving more than fifty records.

3. Time Frame for Responding to a Request for an Accounting

The accounting must be provided no later than 60 days after the request for the accounting of disclosures.  If we are not able to provide the accounting within that time frame, we may extend the response time an additional thirty days if we inform the individual in writing of the reasons for the delay and the date by which the accounting will be provided.

4. Fees for Accountings

The first accounting in any twelve-month period must be provided without charge.  We may charge a reasonable cost-based fee for subsequent accountings in the same twelve-month period, provided that we tell the individual of the fee in advance and give the individual the opportunity to withdraw or modify his/her request in order to reduce or eliminate the fee.

5. Documentation of Compliance

In addition, we must retain for six years:

• Copies of all requests for accountings;
• Copies of all accountings provided;
• Copies of all notifications regarding accountings; and
• Written documentation of title(s) of person(s) or office(s) responsible for receiving and processing requests for accountings.

NF POLICY – AMMENDMENT OF PHI

PURPOSE

Federal HIPAA regulations (45 C.F.R. & 164.526) allow individuals to ask that we amend protected health information (“PHI”) or a record about the individual in a designated record set.

POLICY

It is our policy that if an individual requests that we amend PHI or a record about the individual in a designated record set, we must amend the information, unless the information;

• Is accurate and complete;
• Was not created by us (except if the individual requesting the amendment provides a reasonable basis to believe that the originator of the information is no longer available to act on the requested amendment); or
• Is not available for inspection under the Privacy Rule provisions dealing with an individual’s access to his/her own psychotherapy notes.

PROCEDURES

1. Time Frame for Responding to a Request for Amendment

We must respond to a request for an amendment no later than sixty days after the receipt of the request.  If we are not able to act on the amendment within that time frame, we may extend the response time an additional thirty days if we inform the individual in writing of the reasons for the delay and the date by which we will complete our action on the request.

2. Agreeing to a Requested Amendment

If we agree to make, in whole or in part, the requested change(s) we must:

• Make the appropriate amendment to the PHI or record by, at a minimum, identifying the records affected by the amendment and appealing, or otherwise providing a link to the location of the amendment;
• Inform the individual in a timely manner that his/her request is accepted;
• Obtain from the individual a list of people who should be notified of the changes and his/her permission to notify them; and
• Make reasonable efforts to notify, within a reasonable time: (1) people whom the individual has identified as receiving the PHI and needing the amendment; and (2) anyone (including business associates) that we know has the PHI that is the subject of the amendment who may rely on the information to the detriment of the individual.

3.Denying a Requested Amendment

If we deny the request for amendment we must provide to the individual a timely explanation, written in plain language, of the following:

• The basis for the denial;
• The individual’s right to submit a written statement of disagreement and how the individual may file the statement of disagreement;
• The individual’s right, if he/she does not submit a statement of disagreement, to request that we provide a copy of the individual’s request for an amendment and our denial with any future disclosures of the PHI that is the subject of the amendment request; and
• The individual’s right to complain to us or HHS, including the name, title and telephone number of the contact person designated by us to receive complaints.

We must also identify the information that is the subject of the disputed amendment and append or otherwise link to it:

• The individual’s request for amendment;
• Our denial;
• The individual’s statement of disagreement (if any); and
• Our rebuttal (if any).

If the individual submits a statement of disagreement we may:

• Reasonably limit the length of a statement of disagreement; and
• Prepare a written rebuttal to the statement of disagreement. (If a rebuttal statement is prepared, we must provide a copy of it to the individual.)

4. Subsequent Disclosures

If the individual has not submitted a statement of disagreement and requests that we include the individual’s request for amendment and our denial in any subsequent disclosures, any subsequent disclosures by us of the PHI at issue must include the individual’s request for amendment and our denial (or an accurate summary of this information).

If the individual has submitted a statement of disagreement, any subsequent disclosures by us of the PHI at issue must include:

• The statement of disagreement;
• Our rebuttal (if any);
• The individual’s request for amendment; and
• Our denial; or
• An accurate summary of all this information.
5. Other Responsibilities
• We must amend our own information if it is informed by another Covered Entity of an amendment to an individual’s PHI;
• We must document the titles of the people or offices responsible for receiving and processing requests for amendments; and
• We must retain all documentation as required by 45 C.F.R. & 164.530 (j). (Of course, any amendments to an individual’s medical record should be retained for as long as we maintain the record.)

NF POLICY – NOTICE OF PRIVACY PRACTICES

PURPOSE

Federal HIPAA regulations (45 C.F.R. & 164.520) require that healthcare providers develop and distribute a Notice of Privacy Practices to all individuals.

POLICY

It is our policy to provide all patients with adequate notice of the uses and disclosures of protected health information (“PHI”) that may be made by us as well as notice of the individual’s rights and our legal duties with respect to PHI.

PROCEDURES

1. Contents of the Notice

The notice must contain the following statement as a header or otherwise prominently displayed:

This notice describes how medical information about you may be used and disclosed and how you can get access to this information.  Please review it carefully.

In addition, the notice must contain the following, written in sufficient detail to place the individual on notice of the uses and disclosures that are permitted by law:

• A description, including at least one example, of the types of uses and disclosures that we are permitted to make for each of the following purposes: treatment, payment, and health care operations (e.g., for treatment purposes, PHI may be disclosed to a consulting physician; for payment purposes, PHI may be disclosed to an insurer to obtain prior approval; and for the purposes of health care operations, PHI may be disclosed for quality improvement activities);
• A description of each of the other purposes for which we are permitted or required by law to use or disclose PHI without the individual’s written consent or authorization (e.g., public health reporting requirements); and
• The statement that other uses and disclosures will be made only with the individual’s written authorization and that the individual may revoke such authorization as provided by law.

If we intend to engage in either of the following activities we must describe them separately and in sufficient detail to place the individual on notice of the uses and disclosures that are permitted by law:

• Contacting the individual to provide appointment reminders or information about treatment alternatives or other health-related benefits and services; or
• Fund raising.

This Notice must also contain a statement of the individual’s rights under the Privacy Rule with respect to PHI and a brief description of how the individual may exercise those rights, including rights regarding:

• Requesting restrictions on certain uses and disclosures of PHI;
• Receiving confidential communications of PHI;
• Inspecting and copying PHI;
• Receiving an accounting of disclosures of PHI;
• Obtaining from us, on request, a paper copy of our Notice of Privacy Practices, even if an individual has previously agreed to receive the notice electronically; and
• Complaining to us and/or HHS if an individual believes his/her privacy rights have been violated. The Notice of Privacy Practices must contain a brief description of how a complaint may be filed with us (including the name or title and telephone number of the person or office designated by us to receive complaints) and a statement that the individual will not be retaliated against for filing a complaint.

The Notice of Privacy Practices must also contain statements saying that we:

• Are required by law to maintain the privacy of PHI and to provide individuals with notice of our legal duties and privacy practices;
• Are required to abide by the terms of the Notice of Privacy Practices currently in effect; and
• We reserve the right to change the terms of our Notice of Privacy Practices and to make the new Notice of Privacy Practices provisions effective for all PHI that we maintain. We will always have an updated copy of our policy hanging in our waiting room and a copy will be provided to patients upon request.

The Notice of Privacy Practices must indicate that date on which it becomes effective.

2. Delivery of the Notice

We must make the Notice of Privacy Practices available to anyone who asks for it.

For any individual with whom we have a direct treatment relationship, we must give our Notice of Privacy Practices to the individual no later than the date of the first service.  In an emergency treatment situation, we must provide this Notice as soon as reasonably practical after the emergency.

We also must:

• Have our Notice available on-site for individuals to request and take with them;
• Post the Notice in a clear and prominent location where it is reasonable to expect individuals seeking services from us to be able to read the Notice; and
• Whenever the Notice is revised, to make the Notice available on request on or after the effective date of the revision.
3. Written Acknowledgment of Receipt of the Notice

For any individual with whom we have a direct treatment relationship, we must make a good faith effort to obtain a written acknowledgment of receipt of the Notice of Privacy Practices.  If written acknowledgment is not obtained, we must document our efforts to obtain written acknowledgment and the reason(s) why the acknowledgment was not obtained.

4. Electronic Notice

Our Notice of Privacy is also available on our website.  (???We will also provide the Notice to an individual by e-mail if the individual agrees to electronic notice and such agreement has not been withdrawn.)

5. Revisions to the Notice

The Notice must also be promptly revised and distributed whenever there is a material change to the uses or disclosures, individuals’ rights, our legal duties, or other privacy practices stated in the Notice.  Except when required by law, a material change to any term of the Notice may not be implemented until the effective date of the revised Notice in which the material change is reflected.

6. Documentation of Compliance

We must retain:

• A copy of each version of the Notice of Privacy Practices issued by us (i.e., if we revise our Notice, we must keep a copy of the old Notice and a copy of the new one);
• Written acknowledgments of receipt of Notices of Privacy Practices; and
• Documentation of our good faith effort to obtain written acknowledgment if written acknowledgment is not obtained.

NF POLICY – REQUESTING PRIVACY PROTECTION FOR PHI

PURPOSE

Federal HIPAA regulations (45 C.F.R. 7 164.522) allow individuals to ask that we restrict the use or disclosure of protected health information (“PHI”).

POLICY

It is our policy to allow individuals to request a restriction on the use or disclosure of PHI

• For the purposes of carrying our treatment, payment or health care operations; and/or
• To family members or other relatives.

We are not required to agree to these restrictions.

PROCEDURES

If we do agree to such a restriction we may not use or disclose PHI in violation of that restriction (even if such a use or disclosure would otherwise be permitted under the Privacy Rule or state law), except in specific instances set out in the Privacy Rule, the most important being that if the individual who requests the restriction is in need of emergency treatment and the restricted information is needed to provide the emergency treatment, we may use the restricted information or may disclose the information to another health care provider to provide such treatment.  In the latter case, we must request of the third-party health care provider that it abide by the restriction as well.  We must also document any restrictions to which we agree.  (However, we are not required to document or keep copies of all requests made or our denials of requests.)

We may terminate our agreement to a restriction if the individual agrees orally (and we document the agreement) or requests or agrees to the termination in writing.  In addition, even if the individual declines to withdraw the restriction, we may treat information obtained after our notice of termination as not falling within the restriction.

We will also accommodate reasonable requests by patients to receive PHI by alternative means or at alternative locations (e.g., sending information to work as opposed to home).