PRIVACY POLICY AND PROCEDURES	Policy #: 2100.1
LSU Health Sciences Center New Orleans Date Effective: April 14, 2003	Table of Contents

Privacy Notice Policy

Notice of Privacy Practices

SCOPE:

All Louisiana State University (LSU) System health care facilities and providers including, but not limited to hospitals, physician practices, clinics, schools, etc. on the LSU Health Sciences Center New Orleans Academic Campus.

Nota Bene: All LSU System health care facilities and providers including, but not limited to hospitals, physician clinics, schools, etc. on the LSU Health Sciences Center New Orleans Academic Campus, are referred to in this policy as LSUHSC-NO.

PURPOSE:

To provide guidance to the health care facilities and providers affiliated with the LSU System on a patient’s right to adequate notice of privacy practices as required by the Health Insurance Portability and Accountability Act, Standards for Privacy of Individually Identifiable Health Information (HIPAA Privacy Regulations), and any other applicable state or federal laws or regulations.

POLICY:

All LSU System health care facilities and providers must provide an adequate Notice of Privacy Practices to patients. LSUHSC-NO must also inform the patients of their rights with respect to Protected Health Information and LSUHSC-NO legal duties. LSUHSC-NO must obtain the patient’s acknowledgment of receipt of the notice.

DEFINITIONS:

Protected Health Information (sometimes referred to as PHI) – for purposes of this policy means individually identifiable health information, that relates to the past, present or future health care services provided to an individual. Examples of Protected Health Information include the medical and billing records of a patient.

Direct Treatment Relationship – means a treatment relationship between an individual and a health care provider that is not an indirect treatment relationship.

Indirect Treatment Relationship – means a relationship between an individual and a health care provider in which health care provider delivers health care to the individual based on the orders of another health care provider, and the health care provider typically provides service products, or reports the diagnosis or results associated with the health care, directly to another health care provider who provides the services or products or reports to the individual.

Organized Health Care Arrangement (OHCA) – means in part a clinically integrated care setting in which individuals typically receive health care from more than one health care provider. An example is a hospital setting where physicians are on staff at the hospital.

Privacy Officer - person designated by LSUHSC-NO to be the Privacy Official and who is responsible for the development and implementation of the patient privacy policies and procedures.

PROCEDURE:

1.0

LSUHSC-NO should provide a Notice of Privacy Practices that is written in plain language and includes the required elements or information identified in this policy. See Attachment A.

1.1

In instances that LSUHSC-NO has a Direct Treatment Relationship with a patient LSUHSC-NO must:

1.1.1	Provide the Notice of Privacy Practices to the patient no later than the date of the first service delivery after the compliance date of the HIPAA Privacy Regulations, which is April 14, 2003;
1.1.2	In an emergency treatment situation, provide the Notice of Privacy Practices as soon as reasonably practicable after the emergency treatment situation; and
1.1.3	Except in an emergency treatment situation, make a good faith effort to obtain a written acknowledgement of receipt of the Notice, and if not obtained, document the good faith efforts by LSUHSC-NO to obtain an acknowledgement and the reason why the acknowledgement was not obtained. See Attachment B.

1.2

If LSUHSC-NO maintains a physical delivery site, the Facility or Clinic must:

1.2.1	Have the Notice of Privacy Practices available at the service delivery site for individuals to request to take with them;
1.2.2	Post the Notice of Privacy Practices in a clear and prominent location where it is reasonable to expect individuals seeking service from the facility to read the notice; and
1.2.3	Whenever the Notice of Privacy Practices is revised, make the Notice available upon request on or after the effective date of the revision and promptly post the revised Notice at their physical delivery site.

1.3

LSUHSC-NO must make a good faith attempt to obtain a written acknowledgement of receipt of the Notice, and if not obtained, then document the effort to obtain this acknowledgement. See Attachment B.

2.0

Required Elements of the Notice

2.1

The header statement must state: “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY”

2.2

A description, including at least one example, of the types of uses and disclosures for the purposes of treatment, payment and health care operations. (e.g., contact to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to the patient; fundraising; disclosure of PHI to the sponsor of a group health plan or a health insurance issuer or HMO).

2.3

A description of each of the other purposes for which LSUHSC-NO is permitted or required to use or disclose the information without the individual’s written authorization (e.g., state reporting).

2.4

If use of disclosure for any purpose in 2.2 or 2.3 is prohibited of materially limited by other applicable law, the description of such use or disclosure must reflect the more stringent law.

2.5

A statement that other uses or disclosures will be made only with the individual’s written authorization and that the individual may revoke this authorization.

2.6

Separate statements that LSUHSC-NO may contact its patients to provide appointment reminders or information about treatment alternatives or other health-related benefits and services, or that LSUHSC-NO may contact individuals to raise funds for LSUHSC-NO if the facility or clinic intends to engage in these activities.

2.7

A statement of the patient’s rights with respect to Protected Health Information, including:

The right to inspect and copy Protected Health Information;
The right to amend Protected Health Information;
The right to receive confidential communications;
The right to an accounting of disclosures;
The right to request restrictions on certain uses and disclosures;
The right to obtain a paper copy of the notice, upon request even if the patient has agreed to receive notice electronically.

2.8

A statement of LSUHSC-NO’S legal duties with respect to PHI.

2.8.1	LSUHSC-NO is required by law to maintain the privacy of PHI and to provide this notice with respect to PHI;
2.8.2	LSUHSC-NO must abide by the terms of the notice currently in effect;
2.8.3	LSUHSC-NO may apply a change to the notice and make the new notice effective for the entire PHI it maintains. Any revised notice must be distributed whenever there is a material change to the uses or disclosures, individual's rights, legal duties or other privacy practices state in the notice.

2.9	The statement will also include how it will provide the revised notice to individuals.
2.10	A statement that patients may complain to the Privacy Officer or the Secretary of the U.S. Department of Health and Human Services if they believe their privacy rights have been violated, a brief description of how the individual may file a complaint, and a statement that the individual will not be retaliated against for filing a complaint.
2.11	A statement that includes the name, title and telephone number of person or office to contact.
2.12	The effective date of the notice, which may not be earlier than date on which the notice is printed or otherwise published.
2.13	Any LSUHSC-NO facility or clinic that maintains a website must prominently post its notice on the website and make the notice available electronically through the website.
2.14	LSUHSC-NO may provide the notice by e-mail, if the patient agrees to electronic notice and such agreement has not been withdrawn. A paper copy must be provided at the request of the patient or if the mail transmission fails.
2.15	If the first service delivery to a patient is delivered electronically, the facility must provide the notice automatically and immediately, in response to the patient's first request for services. There must be a procedure in place to notate this electronic delivery. The individual may obtain a paper copy at his or her request.
JOINT NOTICE
2.16	If LSUHSC-NO is involved in an Organized Health Care Arrangement, then LSUHSC-NO may use a joint Notice for the facility and any physicians on its medical staff. LSUHSC-NO must provide the joint Notice to the patient upon the initial interaction with the patient. This joint Notice must describe the hospitals and physicians to which the joint Notice applies and must explain that Protected Health Information will be shared as necessary to carry out treatment, payment, and health care operations.
2.17	For recurring patients, the Notice may be provided at the initial interaction and does not need to be provided again unless a change has been made to the notice.
2.18	LSUHSC-NO must document compliance by retaining copies of the notices issued and if applicable, any written acknowledgements of receipt of notice or documentation of good faith efforts to obtain such written acknowledgement.

REFERENCE:

45 C.F.R. § 164.520