Health Insurance Portability & Accountability Act (HIPAA)
In addition to protecting our own confidential business information, it is also extremely important that we are protecting the confidential information of our participants. All employees are to ensure that at all times participants protected health information (PHI) is protected at all times, this includes storing, maintaining, transmitting and providing it to third parties.
All employees of SCSCPA are required to comply with HIPAA regulations and are subject to civil and criminal penalties for violations. Violations of privacy rules can result in termination.
The information a participant gives to SCSCPA regarding their PHI is to carry out their duties, are to be protected. This information can be oral, recorded, on paper (such as Service Plans) or sent electronically. This also includes information that associates the participant to his personal health information such as; his address, social security number, phone number or financial information.
SCSCPA staff who receive to PHI, the category or categories of PHI to which access is needed, and any conditions appropriate to such access and will not disclose PHI information beyond the needs the participant and the waiver from which services are provided.
For any non-routine request for disclosure of PHI that does not meet an exception, SCSCPA will review the request for disclosure on an individual basis and confer with the participant.
SCSCPA Service Coordinators discloses PHI to those within the Waiver spectrum of services for the following reasons:
a. To plan and provide and describe participant care and treatment.
b. To communicate with health care professionals who care for participants.
c. To obtain reimbursement from private insurers or other government programs.
d. To verify that services billed were actually provided.
e. To educate health professionals regarding participant care.
f. To inform public health officials charged with improving participant healthcare.
g. To administer the Commonwealth’s programs, which provide public benefits, and/or health or human services to SCSCPA participants.
h. To assess and improve the participant services provided and the outcomes achieved.
i. To pay for participant services received.
j. To inform participants about other public programs and services.
Service Coordination of South Central PA and its programs will not use or disclose your PHI except as described in this notice, or otherwise authorized by law.
The following personnel and agencies have access to your PHI without additional consent from the participant due to the participant’s participation in a Waiver or other DHS program: Department of Human Services, Department of Health, Office of Medical Assistance and any agents thereof.
Others who may receive your health information:
Business associates: there are some services provided in our organization through contracts with business associates. When these services are contracted, we may disclose your health information to our business associate so that they can perform the job we have asked them to do. However, we require the business associate to appropriately safeguard your information.
The following are guidelines for SCSCPA staff:
a. To maintain the privacy of participant PHI.
b. To provide the participant with a notice as to SCSCPA legal duties and privacy practices with respect to PHI collected and maintained.
c. To abide by the terms of this HIPAA Policy.
d. To notify a participant if SCSCPA is unable to agree to a requested restriction
e. To accommodate reasonable requests a participant may have to communicate PHI by alternative means or at an alternative address.
f. To provide an accounting of disclosures of your PHI.
The following are guidelines for SCSCPA participant’s access and rights:
g. To request a restriction on certain uses and disclosures of PHI.
h. To obtain a paper copy of this HIPAA Policy upon request.
i. To inspect and copy PHI.
j. To request amendments to PHI.
k. To obtain an accounting of disclosures of PHI.
l. To request communications of PHI by alternative means or at an alternative address.
m. To revoke consent to use or disclose PHI to the extent that it has not already been relied upon.
n. To file a complaint to Service Coordination of South Central PA and/or Secretary of the U.S. Department of Health and Human Services if a violation of privacy rights has occurred.
The following are guidelines for requests that are not on a routine or recurring basis SCSCPA shall evaluate the request according to the following criteria:
o. Is the purpose for the request stated with specificity?
p. Is the amount of PHI to be disclosed limited to the intended purpose?
q. Have the requirements for supporting documentation, statements, or representations been satisfied? (See policy “Uses and Disclosures of Protected Health Information” for specific requirements.)
r. Have all applicable requirements of the HIPAA Privacy Rule been satisfied with respect to the request?
The following personnel and agencies have access to your PHI without additional consent from you: Department of Human Services, Department of Health, Office of Medical Assistance and any agents thereof.
Service Coordination of South Central PA and its programs will not use or disclose your protected health information except as described in this notice, or otherwise authorized by law.
YOUR HEALTH INFORMATION RIGHTS
You have the right to:
a. Request a restriction on certain uses and disclosures of your protected health information
b. Obtain a paper copy of this Notice of Information Practices upon request
c. Inspect and copy your protected health information
d. Request amendments to your protected health information
e. Obtain an accounting of disclosures of your protected health information
f. Request communications of your protected health information by alternative means or at an alternative address
g. Revoke your consent to use or disclose protected health information to the extent that it has not already been relied upon
h. File a complaint to Service Coordination of South Central PA and/or Secretary of the U.S. Department of Health and Human Service if you believe your privacy rights have been violated
i. Receive an electronic copy of your records with the understanding any information shared electronically has the risk of being shared with outside parties
THE COMMONWEALTH PROGRAM DUTIES
Service Coordination of South Central PA has a duty to:
a. Maintain the privacy of your protected health information
b. Provide you yearly or at your request with a notice as to our legal duties and privacy practices with respect to protected health information we collect and maintain about you
c. Abide by the terms of this notice
d. Notify you if we are unable to agree to a requested restriction
e. Accommodate reasonable requests you may have to communicate health information by alternative means or at an alternative address
f. Provide an accounting of disclosures of your protected health information
g. Post a copy of the agency disclosure on the agency website and in the agencies offices
h. Inform a participant and the proper authorities if there is a violation
i. Provide your copy of the notice in the form (language, large print written or spoken)
For more information or to report a problem:
If you believe your privacy rights have been violated, you can file a complaint with Human Resources covered by the Executive Director, or with the Secretary of the U.S. Department of Health and Human Services. There will be no retaliation for filing a complaint.