HIPAA Policies & Privacy Practices

1. Purpose

This Notice of Privacy Practices (NPP) describes how health information about staff and persons served may be used and disclosed and how staff and persons served can get access to this information. Questions about this NPP should be directed to the Supported Living Partners (SLP) Executive Director or Program Administrator.

1.1 This NPP will explain

a. How SLP may use and disclose Protected Health Information.

b. SLP obligations related to the use and disclosure of Protected Health Information.

c. Individual rights related to any Protected Health Information that SLP receives and retains.

1.2 This NPP describes how SLP may use and disclose Protected Health Information to carry out treatment, payment and/or health care operations and for other purposes that are permitted or required by law. It also describes one's rights to access and control Protected Health Information. Protected Health Information is information about individuals, including demographics; past, present, or future physical or mental health or conditions; and related health care services.

2. Use and Disclosure of Protected Health Information

2.1 Staff and individuals served may be asked to complete and sign an information form to acknowledge they have received and read this NPP.

2.2 SLP may obtain, but is not required to, consent for the use or disclosure of Protected Health Information for treatment, payment and/or health care operations. SLP is required to obtain authorization for the use or disclosure of information for other specific purposes or reasons. SLP has listed some of the types of uses or disclosures in this NPP. Not every possible use or disclosure is covered, but all the manners that SLP is allowed to use and disclose information will fall into one of the categories. Protected Health Information may be used and disclosed by SLP, SLP staff and others outside of our Agency that are involved in care and treatment for the purpose of providing health care services to staff or person served. Protected Health Information may also be used and disclosed to pay health care bills and to support the operations of SLP.

2.3 Following are examples of the types of uses and disclosures of Protected Health Information that SLP is permitted to make

a. Treatment: SLP will use and disclose Protected Health Information to provide, coordinate, or manage health care and any related services. This includes the coordination or management of Protected Health Information with a third party that has already obtained permission to have access to Protected Health Information. For example, SLP would disclose Protected Health Information, as necessary, to a home health agency that provides care to an individual. SLP will also disclose Protected Health Information to other providers or health facilities that may treat individuals when it has the necessary permission from said individuals to disclose their Protected Health Information. For example, Protected Health Information may be provided to a health provider to whom an individual has been referred to ensure that the provider has the necessary Protected Health Information for diagnosis and treatment. In addition, SLP may disclose Protected Health Information from time-to-time to another health care provider (e.g., a specialist or laboratory) who, at the request of an individual becomes involved in their care by helping with their health care diagnosis or treatment.

b. Operations: SLP may use or disclose, as needed, Protected Health Information to support the business activities of SLP. These activities include but are not limited to quality assessment activities; licensing; and employee review activities. In addition, SLP may use a sign-in sheet at the registration desk where visitors will be asked to sign their name. SLP may also call individuals by name in a lobby when a provider is ready to see them. SLP may use or disclose Protected Health Information, as necessary, to contact individuals to remind them of their appointment. SLP will share Protected Health Information with third party “business associates" that perform various activities (e.g., billing, reading of x-rays, performing lab tests, transcription services). Whenever an arrangement between our office and a business associate involves the use or disclosure of Protected Health Information, will have a written contract that contains terms that will protect the privacy of Protected Health Information.

3. Written Authorization

3.1 Other uses and disclosures of Protected Health Information will be made only with an individual's written authorization, unless permitted or allowed by law as described below. may revoke this authorization, at any time, in writing, except to the extent that their provider has taken an action in reliance on the use or disclosure indicated in the authorization.

Research: To comply with laws and regulations other than HIPAA, SLP will not allow Protected Health Information collected by their staff, to be used in research projects without individuals' written consent. Under certain circumstances, SLP may use and disclose Protected Health Information for research purposes when the Institutional Review Board has approved a waiver of authorization for the Protection of Human Subjects. For example, a research project may involve comparing the health and recovery of all persons served who received one medication to those who received another for the same condition. This process evaluates a proposed research project and its use of health information, trying to balance the research needs with the individual’s need for privacy of their health information. Before we use or disclose Protected Health Information for research, the project will have been approved through this research approval process. SLP may, however, disclose Protected Health Information to people preparing to conduct a research project, for example, to help them look for persons served with specific medical needs, so long as the health information they review does not leave the facility.

4. No Consent Required

4.1 SLP can use or disclose Protected Health Information about individuals without consent or authorization when:

a. There is an emergency or when SLP is required by law to treat an individual.

b. When SLP is required by law to disclose certain information.

c. When SLP is required by law to use or disclose certain information; or

d. When SLP is required by law to disclose certain information.

4.2 SLP can also use or disclose Protected Health Information without consent or authorization for:

a. Appointment Reminders: SLP may use and disclose Protected Health Information to contact individuals to reminder them about appointments for treatment or services at the Agency.

b. Individuals Involved in Disaster Relief: Should a disaster occur, SLP may disclose Protected Health Information about individuals to any agency assisting in a disaster relief effort so that family can be notified about an individual's condition, status, or location.

c. As Required by Law: SLP will disclose Protected Health Information when required by law.

d. To Avert a Serious Threat to Health or Safety: SLP may use and disclose Protected Health Information when necessary to prevent a serious threat to the health and safety of staff, persons served, the public, or any other person. However, any such disclosure would only be to someone who is able to help prevent the threat.

e. Workers' Compensation: SLP may release Protected Health Information to comply with workers' compensation or similar programs. These programs provide benefits for work- related injuries or illnesses.

f. Public Health Risks: SLP may disclose Protected Health Information for public health activities. These activities generally include the following: to prevent or control disease, injury or disability; to report births and deaths; to report child abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; or to notify the appropriate government authority if we believe a person served has been the victim of abuse, neglect or domestic violence. However, SLP will only make this disclosure by agreement of the individual or when required or authorized by law.

g. Lawsuits and Disputes: If an individual is involved in a lawsuit or a dispute, SLP may disclose Protected Health Information in response to a court or administrative order as required by law.

h. Law Enforcement: SLP may release Protected Health Information if asked to do so by a law enforcement official; however, if the material is protected by 42 CFR Part 2 (a federal law protecting the confidentiality of drug and alcohol abuse treatment records), a court order is required. SLP may also release limited Protected Health Information to law enforcement in the following situations:

1. about a person served who may be a victim of a crime if, under certain limited circumstances, SLP is unable to obtain the agreement of the person served.

2. about a death SLP believes may be the result of criminal conduct.

3. about criminal conduct at SLP.

4. about a person served where a person served commits or threatens to commit a crime on the premises or against program staff (in which case SLP may release the name of the person who is being served, their address, and last known whereabouts).

5. in emergency circumstances, to report a crime, the location of the crime or victims, and the identity, description and/or location of the person who committed the crime; and

6. when a person served is a forensic person served and SLP is required to share with law enforcement by Oregon statute.

i. Other Uses or Disclosures: Other uses or disclosures not covered in this NPP will not be made without written authorization, unless otherwise permitted or required by law. Individuals who provide SLP with written authorization to use or disclose information may change their mind and revoke authorization at any time if it is in writing. If authorization is revoked, SLP will no longer use or disclose the information. However, SLP will not be able to take back any disclosures that have been made pursuant to the previous authorization.

j. Individual Rights: Individuals have the following rights regarding Protected Health Information maintained by SLP

k. Right to Inspect and Copy: Individuals have the right to inspect and receive a copy of their Protected Health Information (apart from psychotherapy notes and information compiled in anticipation of litigation). To inspect and receive a copy of one's Protected Health Information, a request in writing must be made to the SLP Executive Director or designee. SLP may charge a fee for the costs of copying, mailing or other supplies associated with the request. SLP may deny a request to inspect and copy Protected Health Information in certain limited circumstances. If denied access to Protected Health Information because of a threat or harm issue, an individual may request that the denial be reviewed. Another licensed health care professional chosen by SLP will review the request and the denial. The person conducting the review will not be the person who denied the original request. SLP will comply with the outcome of the review.

l. Right to Request an Amendment: Anyone who feels that their Protected Health Information Is incorrect or incomplete may ask to have their information amended. They have the right to request an amendment for as long as the information is kept by or for SLP. Requests for an amendment must be made in writing and submitted to the Executive Director or designee. A reason to support the request for an amendment must be provided. SLP may deny the request if it is not in writing or if it does not include a reason supporting the request. In addition, SLP may deny the request if it seeks to amend information that:

a.) Was not created by SLP, unless the person or entity that created the information is no longer available to make the amendment

b.) Is not part of the Protected Health Information kept for or by SLP

c.) Is not part of the information which one would be permitted and inspected and copy, or d.) Is accurate and complete

d.) Is accurate and complete

m. Right to an Accounting of Disclosures: Anyone has the right to request an "accounting of disclosures," a list of the disclosures made by SLP of ones Protected Health Information. To request an accounting of disclosures, individuals must submit their request in writing to the SLP Executive Director or designee. The request must state a period which may not go back more than six years and cannot include dates before April14, 2003. The request should indicate in what form the list is wanted (for example, on paper or electronically). The first list requested within a twelve-month period will befree. For additional lists in a twelve-month period, SLP may charge for the cost of providing the list. SLP will notify the requestor of the cost and the opportunity to withdraw or modify the request before being charged. There are some disclosures that SLP does not have to track. For example, when SLP is given an authorization to disclose some information, SLP is not required to track that disclosure.

n. Right to Request Restrictions: You have the right to request a restriction or limitation on the Protected Health Information SLP uses or discloses about you for treatment, payment and/or health care operations. For example, you could ask that SLP not use or disclose information about your family history to a particular community provider is not required to agree to your request. If SLP does agree, it will comply with your request unless the information is needed to provide you emergency treatment. To request restrictions on the use or disclosure of your Protected Health Information for treatment, payment, or healthcare operations, you must make your request in writing to the SLP Privacy Officer or designee. In your request, you must include the following information:

a.) What information you want to limit

b.) Whether you want to limit our use, disclosure, or both; and

c.) To whom you want the limits to apply (for example, disclosures to your spouse).

o. Right to Request Confidential Communications: You have the right to request that SLP communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that that SLP only contact you at work or by mail. To request confidential communications, you must make your request in writing to the SLP Privacy Officer or designee. Your request must specify how or where you wish to be contacted. SLP will not ask you the reason for your request and will accommodate all reasonable requests.

p. Right to a Paper Copy of This Notice: You have the right to a paper copy of this notice even if you have agreed to receive the notice electronically. You may ask SLP to give you a copy of this notice at any time by contacting the SLP Executive Director or Program Manager or designee.

q. Changes to This Notice: SLP reserves the right to change this NPP. SLP may make the revised notice effective for Protected Health Information SLP already has about you as well as any information SLP receives in the future. SLP will post a copy of the current NPP in all Facilities. The NPP will contain on the first page, in the top right-hand corner, the effective date. In addition, each time you register at or are admitted or apply for services to SLP for treatment and/or services, you will be offered a copy of the current NPP in effect. If you want to request any revised NPP, you may contact the Executive Director or Program Administrator.

Complaints: If you believe your privacy rights have been violated you may:

File a complaint with SLP by contacting its Executive Director by dialing the SLP main number, 971-899-1328 or mailing to Supported Living Partners LLC 19096 Beaver Falls Rd., Clatskanie, Oregon 97016. Email may be sent to Daveslpllc@gmail.com

All complaints must be submitted in writing. You will not be penalized for filing complaint.

Health Insurance Portability and Accountability Act (HIPAA)

1. The purpose of this policy is to describe mandatory training as required by the Health Insurance Portability and Accountability Act (HIPAA).

2. All employees of SLP shall attend training on the privacy and security provisions of HIPAA.

3. HIPAA training curriculum must remain consistent agency-wide to assure appropriate implementation of the HIPAA Privacy and Security regulations. To maintain that important consistency, no local customization at a facility level shall be permitted. Any variation in content may be subject to the sanctions provision.

Mandatory privacy training shall be scheduled whenever there is a material change in SLP privacy policies or procedures as determined by SLP management and Security Officer.

Periodic mandatory security training shall be scheduled as determined by the Security Officer.

4. Unless otherwise noted, SLP employees shall receive HIPAA training as part of their initial employee orientation with annual reviews.

5. Documentation of mandatory HIPAA training shall be recorded and placed in employee's file.

HIPAA POLICY

1. Individual Access to Health Information:

Purpose: It is the policy of Supported Living Partners LLC to protect the privacy of individually identifiable Protected Health Information in compliance with federal and state laws governing the use and disclosure of Protected Health Information (PHI). SLP recognizes the rights of individuals to access PHI pertaining to them in a designated record set forth in OAR 323-0060. SLP further recognizes the access to PHI may be limited or restricted as defined in this policy, in the Notice of Privacy Practices ("NPP") and as allowed by law. In cases where the individual has been civilly adjudicated, or incapacitated, the parent, legal guardian, or personal representative may request access. There may be additional exceptions as allowed by law.

Application: Supported Living Partners LLC.