Privacy Notice

  Patient Privacy Procedures and Policies

A consent form will be given to each patient before any treatment is initiated and this consent form must be read, signed and returned by the patient to this chiropractic office and placed in that patients' file before any treatment, payment, or health care operations.

Background

The Privacy Rule establishes a federal requirement that most doctors, hospitals, or other health care providers obtain a patient's written consent before using or disclosing the patient's personal health information to carry out treatment, payment, or health care operations (TPO). Today, many health care providers, for professional or ethical reasons, routinely obtain a patient's consent for disclosure of information to insurance companies or for other purposes. The Privacy Rule builds on these practices by establishing a uniform standard for certain health care providers to obtain their patients' consent for uses and disclosures of health information about the patient to carry out TPO.

General Provisions      

 Patient consent is required before a covered health care provider that has a direct treatment relationship with the patient may use or disclose protected health information (PHI) for purposes of TPO. Exceptions to this standard are shown in the next bullet.

    Uses and disclosures for TPO may be permitted without prior consent in an emergency, when a provider is required by law to treat the individual, or when there are substantial communication barriers.       

 Health care providers that have indirect treatment relationships with patients (such as laboratories that only interact with physicians and not patients), health plans, and health care clearinghouses may use and disclose PHI for purposes of TPO without obtaining a patient's consent. The rule permits such entities to obtain consent, if they choose.

      If a patient refuses to consent to the use or disclosure of their PHI to carry out TPO, the health care provider may refuse to treat the patient.

       A patient's written consent need only be obtained by a provider one time.

        The consent document may be brief and may be written in general terms. It must be written in plain language, inform the individual that information may be used and disclosed for TPO, state the patient's rights to review the provider's privacy notice, to request restrictions and to revoke consent, and be dated and signed by the individual (or his or her representative).

Individual Rights

      An individual may revoke consent in writing, except to the extent that our chiropractic office has taken action in reliance on the consent.

       An individual may request restrictions on uses or disclosures of health information for TPO. Our office is not required to agree to the restriction requested, but is bound by any restriction to which it agrees.

        An individual will have access to a notice of our office privacy practices and may review (but is not required to review) that notice prior to signing a consent.

Administrative Issues

       Our chiropractic office must retain the signed consent for 6 years from the date it was last in effect. The Privacy Rule does not dictate the form in which these consents are to be retained by our office.

       Certain integrated covered entities may obtain one joint consent for multiple entities.

        If our office obtains consent and also receives an authorization to disclose PHI for TPO, we may disclose information only in accordance with the more restrictive document, unless the covered entity resolves the conflict with the individual.

      Transition provisions allow our office to rely on consents received prior to April 14, 2003 (the compliance date of the Privacy Rule for most covered entities), for uses and disclosures of health information obtained prior to that date.

General Requirement

The Privacy Rule generally requires our chiropractic office to take reasonable steps to limit the use or disclosure of, and requests for protected health information (PHI) to the minimum necessary to accomplish the intended purpose.

The minimum necessary provisions do not apply to the following:

        Disclosures to or requests by a health care provider for treatment purposes.

       Disclosures to the individual who is the subject of the information.

      Uses or disclosures made pursuant to an authorization requested by the individual.

     Uses or disclosures required for compliance with the standardized Health Insurance Portability and Accountability Act (HIPAA) transactions.

       Disclosures to the Department of Health and Human Services (HHS) when disclosure of information is required under the rule for enforcement purposes.

      Uses or disclosures that are required by other law.

The implementation specifications for this provision require a chiropractor to develop and implement policies and procedures appropriate for its own organization, reflecting the entity's business practices and workforce.

Uses and Disclosures of, and Requests for PHI

For uses of PHI, the policies and procedures must identify the persons or classes of persons within the chiropractic office who need access to the information to carry out their job duties, the categories or types of PHI needed, and conditions appropriate to such access. For routine or recurring requests and disclosures, the policies and procedures may be standard protocols and must limit PHI disclosed or requested to that which is the minimum necessary for that particular type of disclosure or request. Individual review of each disclosure or request is not required.

For non-routine disclosures, chiropractors must develop reasonable criteria for determining, and limiting disclosure to, only the minimum amount of PHI necessary to accomplish the purpose of a non-routine disclosure. Non-routine disclosures must be reviewed on an individual basis in accordance with these criteria. When making non-routine requests for PHI, the chiropractor must review each request so as to ask for only that information reasonably necessary for the purpose of the request.