DATA PRIVACY AND PRIVACY OF PROTECTED HEALTH INFORMATION/HIPAA

Private data includes all information on a person that Mains’l has gathered for the purpose of offering supports.

Notice of Privacy Rights

1. On the day services begin, and annually thereafter, the manager gives the Notice of Privacy Practices for Persons Receiving Service document to the person/legal representative and has the person/legal representative sign the Notice of Privacy Practices Acknowledgment of Receipt. 
2. The manager files this in the legal/consent section of the person’s Support Plan.

Sharing Information: Mains’l employees are allowed to share information with only the following persons or entities without a release:

• Person receiving services 
• The person’s legal representative 
• Mains'l employees and consultants on a need-to-know basis:
• Representatives of responsible federal, state, and local agencies; i.e. case managers, licensors, state or federal investigators.
• Representatives of responsible contracting agencies such as managed care organizations

A person receiving services or their legal representative has a right to access and review the individual record and may request copies of pages in their record.

Besides the person receiving services and their legal representative, the people identified above do not automatically have access to private data about a person receiving services or about other staff or agency employees.  Need-to-know basis means that the person must have a specific work reason requiring access to the information. Private data about a person is available only to those employees whose work assignments reasonably require access to the data; or who are authorized by law to have access to the data.

Any written or verbal exchanges about a person's private information by staff with other staff or any other persons will be done in such a way as to preserve confidentiality, protect data privacy, and respect the dignity of the person whose private data is being shared. As a general rule, if a person is unsure about sharing information regarding a person, they should contact their supervisor or reference this policy and procedure. 

Sharing Information with Other Parties
Information regarding a person receiving service from Mains'l may be released to outside persons/agencies only after the person or their legal representative authorizes the release by signing the Consent to Exchange Information. 

Obtaining Informed Consent and Authorization for Release of Information
Upon starting services and annually after that, the Mains’l manager or their designee will obtain informed consent and authorization to release information. There may be other times when a representative of Mains’l provides informed consent and requests authorization for release of information. The following procedures are to be followed at any time information is requested:

1. At the time informed consent is being obtained, the manager informs the person or the legal representative individual about the following:

• why the data is being collected;
• how Mains’l intends to use the information;
• whether the individual may refuse or is legally required to furnish the information;
• what known consequences may result from either providing or refusing to disclose the information, and with whom the collecting agency is authorized by law to share the data;
• what the person can do if they believe the information is incorrect or incomplete;
• how the person can see and get copies of the data collected about them; and any other rights that the individual may have regarding the specific type of information collected.

2. The manager maintains all informed consent documents in the person’s individual record.

    The following will be observed when completing the Consent to Exchange Information:

• The form is initially completed at the time services begin. It is updated annually thereafter (automatic one-year expiration). If additional information is to be released during the period of the authorization that is in addition to or other than that initially included, an additional or revised form will be completed.
• The type of information to be released, to whom, and for what purpose must be specified on the form in order for the authorization to be valid.
• If the person receiving service is under 18 but has been given the legal right of an adult (emancipated adult) they must sign the form.  If they are not, the legal guardian must sign the form.
• Informed consent must be obtained to validate the authorization to release information.  The senior manager or manager must review with the person or their legal representative what information is being requested and/or released, by whom, and the purpose for which it will be used.  It is advisable to have the person who is authorizing the release then repeat what has been explained to assure their understanding and ability to give informed consent.

Requesting Information from Other Licensed Caregivers or Primary Health Care Providers
Mains’l may need to request information about the person from other licensed providers. When this is needed, the manager will:

1. Complete a Release of Information form.  The manager will carefully list all the consults, reports or assessments needed, giving specific dates whenever possible.  Also, the manager will identify the purpose for the request.
2. Clearly identify the recipient of information.  If information is to be sent to the program's health care consultant or other staff at the program, include Attention: (name of person to receive the information), and the name and address of the program.

Release of Written Documents to Persons Receiving Service or Legal Representative

The following process is used when a person receiving supports or their legal representative wishes to obtain copies of written records:

•  A written request from the person or legal representative, which specifies the information requested, shall be given to the senior manager.
• The senior manager makes the requested material available within three (3) working days after the request.
• The senior manager is available to discuss the content and meaning of the data with the individual receiving service and/or the legal representative if this is requested.
• The person is informed that the agency is not required to release additional data within six (6) months of the first release of information.
• The person making the request signs a statement verifying the requested data was received and, if desired, discussed.
• If a person wishes to contest the accuracy of the information, they must notify the senior manager in writing.  The senior manager and director review the information and respond in writing to the person within thirty (30) days of the request for clarification.
• The person may submit additional written information to be placed in their data file at any time.

Release of photographs or video to other parties: Photographs or video of people supported by Mains'l are displayed or released to outside persons/agencies only if the person receiving service or their legal representative has authorized the release by signing an Authorization for Release of Photographs.

The following is observed when completing the release of photographs form:

1. The general nature of the photo/s to be used, to whom, and for what purpose is specified on the form in order for the authorization to be valid.  The authorization remains valid until the person requests in writing their desire to have the photo removed from future reproduction.
2. Informed consent is obtained to validate authorization.  The manager reviews with the person/legal representative what photograph/video is being requested/ released, by whom, and for what purpose it will be used.