Arkansas Administrative Code › Agency 016 - DEPARTMENT OF HUMAN SERVICES › Division 14 - Department of Finance (Administrative Services) › Rule 016.14.13-005 - Publication 408 - Notice of Privacy Practices

Current through Register Vol. 49, No. 6, June, 2024
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT
				YOU
MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS
				TO
THIS INFORMATION. PLEASE REVIEW IT
				CAREFULLY.
The Department of Human Services (DHS) provides many
				types of services, such as health and social services. DHS staff must collect
				information about you to provide these services. DHS knows that information
				collected about you and your health is private. DHS and all associates at all
				locations are required by law to maintain the privacy of patients' Protected
				Health Information (PHI) and to provide individuals with the Notice of the
				legal duties and privacy practices with respect to PHI.
DHS is required to give you a notice of our privacy
				practices for the information we collect and keep about you. We are required to
				abide by the terms of this Notice. We reserve the right to change the terms of
				this Notice and these new term will affect all PHI that we maintain at that
				time.
Revised notices may be picked up at any office or online at:
http://humanservices.arkansas.gov.
In certain circumstances, DHS may use and disclose PHI
				without written consent.
For Treatment:
We will use your health information
				to provide you with medical treatment or services. We will disclose PHI to
				doctors, nurses, technicians, students in health care training programs, or
				other personnel who are involved in taking care of you. Example-a doctor
				treating you for a broken leg may need to know if you have diabetes because
				that might slow the healing process. In addition, he/she may need to tell the
				dietitian to arrange for appropriate meals. Different departments of DHS may
				share health information about you in order to coordinate the services you
				need, such as prescriptions, lab work and x-rays. We may disclose health
				information to people outside DHS who provide your medical care like nursing
				homes or other doctors. We may tell your health insurer about treatment your
				doctor has recommended to obtain prior approval to determine whether your plan
				will cover the cost of the treatment. We may contact you to provide reminders
				of appointments.
For Payment:
DHS will use and disclose PHI to
				other health care providers to assist in payment of your bills. We will use it
				to send bills and collect payment from you, your insurance company, or other
				payers, such as Medicare, for the care, treatment, and other related services
				you receive.
Business Associates:
We may use or disclose your
				PHI to an outside company that assists us in operating our health system and
				performs various services for us. This includes, but is not limited to,
				auditing, accreditation, legal services, and consulting services. These outside
				companies are called "business associates" and contract with us to keep PHI
				received confidential in the same way we do. These companies may create or
				receive PHI for us.
For Health Care Operations:
DHS may use or
				disclose your PHI for the purpose of our business operations. These uses and
				disclosures are necessary to insure our patients receive quality care. For
				example, we may use PHI to review the quality of our treatment and services,
				and to evaluate the performance of staff, contracted employees and students in
				caring for you.
For Public Health Activities:
DHS may use or
				disclose your PHI for public health activities that are permitted or required
				by law. Example-we may disclose PHI in certain circumstances to control or
				prevent a communicable disease; injury; disability; to report births and
				deaths; and for public health oversight activities or interventions. We may
				disclose PHI to the Food and Drug Administration (FDA) to report adverse events
				or product defects, to track products, to enable product recalls, or to conduct
				post-market surveillance as required by law or to state or federal government
				agencies. We may disclose PHI, if directed by a public health authority, to a
				foreign government agency that is collaborating with the public health
				authority.
For Health Oversight Activities:
DHS may disclose
				PHI to a health oversight agency for activities authorized by law. For example,
				these oversight activities may include audits; investigations; inspections;
				licensure or disciplinary actions; or civil, administrative, or criminal
				proceedings or actions. Agencies seeking this information include government
				agencies that oversee the health care system, benefit programs, other
				regulatory programs, and government agencies that ensure compliance with civil
				rights laws.
As Required by Law and For Law Enforcement:
DHS
				will use and disclose PHI when required or permitted by federal, state, and
				local laws, or by court order. Under certain conditions, we may disclose PHI to
				law enforcement officials for law enforcement purposes. Example-these may
				include (1) responding to a court order or similar process; (2) as necessary to
				locate or identify a suspect, fugitive, material witness, or missing person;
				(3) reporting suspicious wounds, burns or other physical injuries; or (4) as
				relating to the victim of a crime
Lawsuits and Other Legal Proceedings:
DHS may
				disclose PHI in the course of any judicial or administrative proceeding or in
				response to an order of a court or administrative tribunal (to the extent such
				disclosure is expressly authorized). If certain conditions are met, we may
				disclose your PHI in response to a subpoena, a discovery request, or other
				lawful process.
Abuse or Neglect:
We may disclose your PHI to a
				government authority that is authorized by law to receive reports of abuse,
				neglect, or domestic violence. Additionally, as required by law, if we believe
				you have been a victim of abuse, neglect, or domestic violence, we may disclose
				your PHI to a governmental entity authorized to receive it.
For Government Programs:
DHS may use and disclose
				PHI for public benefits under other government programs. For example, DHS may
				disclose PHI for the determination of Supplemental Security Income (SSI)
				benefits.
To Avoid Harm:
DHS may disclose PHI to law
				enforcement in order to avoid a serious threat to the health and safety of a
				person or the public.
For Research:
DHS may use and share your health
				information for certain kinds of research. Example: a research project may
				involve comparing the health and recovery of patients who received one
				medication to those who received another for the same condition. All research
				projects, however, are subject to a special approval process. In some
				instances, the law allows us to do some research using your PHI without your
				approval.
Family Members and Friends:
If you agree, do not
				object, or we reasonably infer that there is no objection, DHS may disclose PHI
				to a family member, relative, or other person(s) whom you have identified to be
				involved in your health care or the payment of your health care. If you are not
				present, or are incapacitated, or it is an emergency or disaster relief
				situation, we will use our professional judgment to determine whether
				disclosing limited PHI is in your best interest. We may disclose PHI to a
				family member, relative, or other person(s) who was involved in the health care
				or the payment for health care of a deceased individual if not inconsistent
				with prior expressed preferences of the individuals known to DHS. You also have
				the right to request a restriction on our disclosure of your PHI to someone who
				is involved in your care.
Coroners, Medical Examiners and Funeral Directors:
DHS may release your PHI to a coroner or medical examiner. Example-this
				may be necessary to identify a deceased person or to determine cause of death.
				We may also release your PHI to a funeral director, as necessary, to carry out
				his/her duties.
Organ Donations:
We will disclose PHI to
				organizations that obtain, bank or transplant organs or tissues.
National Security and Protection of the President:
DHS may release your PHI to an authorized federal official or other
				authorized persons for purposes of national security, for providing protection
				to the President, or to conduct special investigations, as authorized by
				law.
Correctional Institution:
If you are an inmate of
				a correctional institution or under the custody of a law enforcement officer,
				DHS may release your PHI to them. The PHI released must be necessary for the
				institution to provide you with health care, protect your or other's health and
				safety, or for the safety and security of the correctional institution.
Military:
If you are a veteran or a current member
				of the armed forces, DHS may release your PHI as required by military command
				or veteran administration authorities.
Workers' Compensation:
DHS will disclose your
				health information that is reasonably related to a worker's compensation
				illness or injury following written request by your employer, worker's
				compensation insurer, or their representative.
Employer Sponsored Health and Wellness Services:
We maintain PHI about employer sponsored health and wellness services we
				provide our patients, including services provided at their employment site. We
				will use the PHI to provide you medical treatment or services and will disclose
				the information about you to others who provide you medical care.
Shared Medical Record/Health Information Exchanges:
We maintain PHI about our patients in shared electronic medical records
				that allow the DHS associates to share PHI. We may also participate in various
				electronic health information exchanges that facilitate access to PHI by other
				health care providers who provide you care. Example-if you are admitted on an
				emergency basis to another hospital that participates in the health information
				exchange, the exchange will allow us to make your PHI available electronically
				to those who need it to treat you.
Other Uses and Disclosures of PHI
Most uses and disclosures of psychotherapy notes, uses and
				disclosures of PHI for marketing purposes and disclosures that constitute the
				sale of PHI require your written authorization.
Other uses and disclosures of your PHI that are not described
				above will be made only with your written authorization. If you provide DHS
				with an authorization, you may revoke it in writing, and this revocation will
				be effective for future uses and disclosures of PHI. The revocation will not be
				effective for information that we have used or disclosed in reliance on the
				authorization.
Your PHI Privacy Rights
The Right to Access to Your Own Health Information:
You have the right to inspect and copy most of your protected health
				information for as long as we maintain it as required by law. All requests for
				access must be made in writing. We may charge you a nominal fee for each page
				copied and postage if applicable. You also have the right to ask for a summary
				of this information. If you request a summary, we may charge you a nominal
				fee.
Right to Inspect and Copy:
You have the right to
				inspect and receive a copy of PHI about you that may be used to make decisions
				about your health. A request to inspect your records may be made to your nurse
				or doctor while you are an inpatient or to the DHS Privacy Officer while an
				outpatient. For copies of your PHI, requests must go to the DHS Privacy
				Officer. For PHI in a designated record set that is maintained in an electronic
				format, you can request an electronic copy of such information.There may be a
				charge for these copies
Right to Amend:
If you feel that PHI we have about
				you is incorrect or incomplete, you may ask us to amend the information, for as
				long as DHS maintains the information. Requests for amending your PHI should be
				made to the DHS Privacy Officer. The DHS personnel who maintain the information
				will respond to your request within 60 days after you submit the written
				amendment request form. If we deny your request, we will provide you a written
				explanation. You may respond with a statement of disagreement to be appended to
				the information you wanted amended. If we accept your request to amend the
				information, we will make reasonable efforts to inform others, including people
				you name, of the amendment and to include the changes in any future disclosures
				of that information.
Right to Request Confidential Communications:
If
				you believe that a disclosure of all or part of your PHI may endanger you, you
				may request in writing that we communicate with you in an alternative manner or
				at an alternative location. For example, you may ask that all communications be
				sent to your work address. Your request must specify the alternative means or
				location for communication with you. It also must state that the disclosure of
				all or part of the PHI in a manner inconsistent with your instructions would
				put you in danger. We will accommodate a request for confidential
				communications that is reasonable and that states that the disclosure of all or
				part of your protected health information could endanger
				you
.
Right to Get a List of Disclosures:
You have the
				right to ask DHS for a list of disclosures made after April 14, 2003. You must
				make the request in writing. With some exceptions, you have the right to
				receive an accounting of certain disclosures of your PHI. A nominal fee will be
				charged for the record search
.
Right to Request Restrictions:
You have the right
				to request certain restrictions of our use or disclosure of your PHI. We are
				not required to agree to your request in most cases. But if DHS agrees to the
				restriction, we will comply with your request unless the information is needed
				to provide you emergency treatment. DHS will agree to restrict disclosure of
				PHI about an individual to a health plan if the purpose of the disclosure is to
				carry out payment or health care operations and the PHI pertains solely to a
				service for which the individual, or a person other than the health plan, has
				paid DHS for in full. For example, if a patient pays for a service completely
				out of pocket and asks DHS not to tell his/her insurance company about it, we
				will abide by this request. A request for restriction should be made in
				writing. To request a restriction you must contact the DHS Privacy Officer. We
				reserve the right to terminate any previously agreed-to restrictions (other
				than a restriction we are required to agree to by law). We will inform you of
				the termination of the agreed-to restriction and such termination will only be
				effective with respect to PHI created after we inform you of the
				termination.
Right to Revoke Permission:
If you are asked to
				sign an authorization to use or disclose PHI, you can cancel that authorization
				at any time. You must make the request in writing. This will not affect PHI
				that has already been shared.
Right to File a Complaint:
You have the right to
				file a complaint if you do not agree with how DHS has used or disclosed PHI
				about you.
Right to Get a Paper Copy of this Notice:
You have
				the right to ask for a paper copy of this notice at any time
Right to be notified of a Breach:
You have the
				right to be notified in the event that we (or one of our Business Associates)
				discover a breach of unsecured protected health information involving your
				medical information.
See the contact information below:
to View, Inspect, Copy, or Amend your PHI,
to Request Confidential Communications,
to Request an accounting (list) of
				disclosures,
to Request Restrictions,
to Revise Authorizations, or
to File a Complaint.
This privacy notice is also available @
http://humanservices.arkansas.gov/Pages/DHS%20Notice%20of%20Privacy%20Practi
ces.aspx
You may contact your local DHS office or the DHS Privacy
				Officer at the address listed below.
Arkansas Department of Human Services
DHS Privacy Officer
Department of Human Services
P.O. Box 1437, Slot S260
Little Rock, Arkansas 72203-1437
Telephone: 1-855-283 -0835
TDD: (501) 682-8933
Email: DHSPrivacyOfficer@arkansas.gov.
Office for Civil Rights
U.S. Department of Health & Human
				Services
1301 Young Street-Suite 1169
Dallas, TX 75202
(214) 767-4056; (214) 767-8940(TDD)
(214) 767-0432 Fax
ACKNOWLEDGEMENT OF RECEIPT of NOTICE OF PRIVACY
				PRACTICES
I, ___________________________ (print client's name or legal
				representative) have been given a copy of DHS' Notice of Privacy Practices and
				have had a chance to ask questions about how my PHI will be used.
Client's Signature
Date
Legal or Personal
Relationship
Representative of Client (if applicable)
File the original signed copy in the case record; give the
				recipient of this notice a copy of this document.