Appendix A

Appendix A: Notice of Privacy Practices

The following sample Notice of Privacy Practices is published by the Rhode Island Department of Human Services, Cranston, Rhode Island.

Sample Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Our Duty to Safeguard Your Protected Health Information. Individually identifiable information about your past, present, or future health or condition, the provision of health care to you, or payment for the health care is considered "Protected Health Information" (PHI). As part of our normal business operations, we encounter your PHI as a result of your treatment, our payment and other related health care operations. We also receive your PHI via the application and enrollment process, from healthcare providers and health plans, and by a variety of other activities. Accordingly, we are required to extend certain protections to you and your PHI, and to give you this Notice about our privacy practices that explains how, when and why we may use and/or disclose your PHI. Except in specified circumstances, we are required to use and/or disclose only that minimum amount of your PHI necessary to accomplish the purpose of our use and/or disclosure.

We are required to follow the privacy practices described in this Notice, although we reserve the right to change our privacy practices and the terms of this Notice at any time. In the event that we change our privacy practices, we will post our updated Notice on our Rhode Island DHS web site located at http://www.dhs.state.ri.us/dhs/dheacre.htm where you may also obtain more detailed information regarding the topics addressed in our Notice. In addition to viewing our Notice online, you may request a hard copy of our Notice by writing our Privacy Contact Office at our address provided in Paragraph 5 below.

How We May Use and Disclose Your Protected Health Information. In accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its HIPAA Privacy Rule (Rule), we may use and/or disclose your PHI for a variety of reasons. Generally, we are permitted to use and/or disclose your PHI for the purposes of your treatment, the payment for services you receive, and for our normal health care operations. For most other uses and/or disclosures of your PHI, you will be asked to grant your permission via a signed Authorization. However, the Rule provides that we are permitted to make certain other specified uses and/or disclosures of your PHI without your Authorization. The following discussion offers more descriptive examples of our potential use and/or disclosure of your PHI:

¨ Uses and/or disclosures related to your treatment, the payment for services you receive, or our health care operations (TPO):

For treatment (T): We may use and/or disclose your PHI with doctors, nurses, and other health care personnel involved in providing health care services to you. For example, your PHI may be shared with your primary care physician, medical specialists to whom you are referred, members of your treatment team, your pharmacist, your dentist, and other similarly situated health care personnel involved in your treatment.

For payment (P):We may use and/or disclose your PHI for billing and collection activities and related data processing; for actions by a health plan or an insurer to obtain premiums or to determine or fulfill its responsibilities for coverage and the provision of benefits under its health plan or insurance agreement; to make determinations of eligibility or coverage, adjudication or the subrogation of health benefit claims; for medical necessity and appropriateness of care reviews, utilization review activities; and related payment activities so that individuals involved in delivering health care services to you may be properly compensated for the services they have provided.

For health care operations (O): We may use and/or disclose your PHI in the course of operating the various business functions of the Rhode Island Department of Human Services Programs. For example, we may use your PHI to evaluate the quality of medical services provided to you; develop clinical guidelines; contact you with information about treatment alternatives or communications in connection with your case management or care coordination; to review the qualifications and training of health care professionals; for medical review, legal services, and auditing functions; and for general administrative activities such as customer service and data analysis.

Appointment reminders: Unless you request that we contact you by other means, the Rule permits us to send appointment reminders and other similar materials to your address.

¨ Uses and/or disclosures requiring your Authorization: Generally, our use and/or disclosure of your PHI for any purpose that falls outside of the definitions of treatment, payment and health care operations identified above will require your signed Authorization. The Rule does grant us permission for certain specified uses and/or disclosures of your PHI that fall outside of the treatment, payment and health care operations definition as itemized below. However, for all other uses and/or disclosures of your PHI by any other person or entity, you retain the power to grant your permission via your signed Authorization. Additionally, if you grant your permission for such use and/or disclosure of your PHI, you retain the right to revoke your Authorization at any time except to the extent that we have already undertaken an action in reliance upon your Authorization.

¨ Uses and/or disclosures not requiring your Authorization: The Rule provides that we may use and/or disclose your PHI without your Authorization in the following circumstances:

When required by law: We may use and/or disclose your PHI when existing law requires that we report information including each of the following areas:

- Reporting abuse, neglect or domestic violence: We may use and/or disclose the PHI of suspected victims of abuse, neglect, or domestic violence including reporting the information to social service or protective services agencies.

- Public health activities: We may use and/or disclose your PHI to prevent or control the spread of disease or other injury, public health surveillance or investigations, reporting adverse events with respect to food, dietary supplements, product defects and other related problems to the Food and Drug Administration, medical surveillance of the workplace or to evaluate whether you have a work-related illness or injury, in order to comply with Federal or state law.

- Health oversight activities: We may use and/or disclose your PHI to designated activities and functions including, audits, civil, administrative, or criminal investigations, inspections, licensure or disciplinary actions, or civil, administrative, or criminal proceedings or actions, or other activities necessary for appropriate oversight of government benefit programs.

- Judicial and administrative proceedings: We may use and/or disclose your PHI in response to an order of a court or administrative tribunal, a warrant, subpoena, discovery request, or other lawful process.

- Law enforcement activities: We may use and/or disclose your PHI for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person, or reporting crimes in emergencies, or reporting a death.

- Relating to decedents: We may use and/or disclose the PHI of an individual’s death to coroners, medical examiners and funeral directors. Additionally, we may disclose a decedent’s PHI to human organ procurement organizations relating to organ, eye, or tissue donations or transplants.

- For research purposes: In certain circumstances, and under the supervision of an Internal Review Board, we may disclose your PHI to assist in medical/psychiatric research.

- To avert a serious threat to health or safety: We may use and/or disclose your PHI in order to avert a serious threat to health or safety.

- For specific government functions: We may disclose the PHI of military personnel and veterans in certain situations. Similarly, we may disclose the PHI of inmates to correctional facilities in certain situations. We may also disclose your PHI to governmental programs responsible for providing public benefits, and for workers’ compensation. Additionally, we may disclose your PHI, if required, for national security reasons.

¨ Uses and disclosures requiring you to have an opportunity to object: We may disclose your PHI in the following circumstance if we inform you about the disclosure in advance and you do not object. However, if there is an emergency situation and you cannot be given your opportunity to object, disclosure may be made if it is consistent with any prior expressed wishes and disclosure is determined to be in your best interests. You must be informed and given an opportunity to object to further disclosure as soon as you are able to do so.

To families, friends or others involved in your care: We may share your PHI with those people directly involved in your care, or payment for your care. We may also share your PHI with these people to notify them about your location, general condition, or death.

Your Rights Regarding Your Protected Health Information (PHI). The HIPAA Privacy Rule grants you each of the following individual rights:

Right to request restrictions on PHI uses and/or disclosures: You have the right to request restrictions on certain uses and/or disclosures of your PHI, such as to carry out treatment, payment, or health care operations; instances in which you are not present or your permission can not practicably be obtained due to your incapacity or an emergency circumstance; permitting other persons to act on your behalf to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of PHI; and disclosure to a public or private entity authorized by law or by its charter to assist in disaster relief efforts. While we are not required to agree to any requested restriction, if we agree to a restriction, we are bound not to use or disclose your PHI in violation of such restriction, except in certain emergency situations. We will not accept a request to restrict uses and/or disclosures that are otherwise required by law.

Right to request confidential communications: You have the right to receive confidential communications of your PHI. We may require written requests. We may condition the provision of confidential communications on you providing us with information as to how payment will be handled and specification of an alternative address or other method of contact. We may require that your request contain a statement that disclosure of all or a part of the information to which the request pertains could endanger you. We may not require you to provide an explanation of the basis for your request as a condition of providing communications to you on a confidential basis. However, we must accommodate your reasonable requests to receive communications of your PHI from us by alternative means or at alternative locations.

Right to access and copy your PHI: Your designated record set is a group of records we maintain that include PHI such as your medical and billing records, your enrollment, payment, claims adjudication, medical management records, and other related PHI. You have the right of access to your designated record set in order to inspect and obtain a copy the PHI it contains, except for psychotherapy notes; information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding; and PHI maintained by us to the extent to which the provision of access to you would be prohibited by law.

We may require you to provide us with a written request for access to your PHI. We will respond to your written request within 30 days of its receipt. If we deny your access request, we will give you written reasons for our denial and explain your right to have our denial reviewed. However, if we agree to your request for access, we must provide you with access to your PHI in the form or format requested by you, if it is readily producible in such form or format. We may provide you with a summary of your requested PHI, in lieu of providing access to your PHI or we may provide you with an explanation of your PHI if you agree in advance to such a summary or explanation and agree to the fees imposed for such summary or explanation. We will provide you with access as requested in a timely manner, including arranging a convenient time and place for you to inspect or obtain copies of your PHI or mailing a copy of your PHI to you at your request. If you request a copy of your PHI or agree to a summary or explanation of your PHI, we are permitted to charge a reasonable cost based fee for copying, postage, mailing, and the costs of preparing an explanation or summary as agreed upon in advance.

We reserve the right to deny you access and copies of certain PHI as permitted or required by law. In the event that we must deny you access to the PHI you seek, we will reasonably attempt to accommodate your request for access to other portions of your PHI that may satisfy your request. Upon denial of a request for access, we will provide you with a written denial specifying the legal basis for our denial, a statement of your rights, and a description of how you may file a complaint with us. If we are not in possession of the PHI you have requested, but we know where the requested PHI is maintained, we will inform you of where to direct your request for access.

Right to request amendment of your PHI: If you believe that an error or omission exists within our record of your PHI, you have the right to request that we amend the PHI contained in your designated record set, for as long as we maintain your record. We have the right to deny your request for amendment if we determine that the PHI or record that is the subject of your request was not created by us (unless you provide a reasonable basis to believe that the originator of the PHI is no longer available to act on your requested amendment), the PHI is not part of your designated record set maintained by us, the PHI is prohibited from inspection by law, or the PHI is accurate and complete.

We may require that you submit your request in writing and provide a reason to support the requested amendment. We will respond to your written request within 60 days of its receipt. If we deny your request, we will provide you with a written denial stating the basis of our denial, your right to submit a written statement disagreeing with our denial, and a description of how you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services ("DHHS"). Our denial will also include a notice that if you do not submit a statement of disagreement, you may request that we include your request for amendment and our denial with any future disclosures of your PHI that is the subject of the requested amendment. Copies of all requests, denials, and statements of disagreement will be included in your designated record set. If we accept your request for amendment, we will make reasonable efforts to inform and provide the amendment within a reasonable time to persons identified by you as having received your PHI prior to its amendment and persons that we know are in possession of the PHI that is the subject of your amendment and that may have relied, or could foreseeably rely, on the PHI to your detriment. All written requests for amendment of your PHI must be forwarded to the address provided in Paragraph 5 below.

Right to an accounting of disclosures of your PHI: You have the right to receive a written accounting of our disclosures of your PHI for any period of time up to a six (6) year period immediately preceding the date on which you provide your request, except for disclosures made prior to the Rule’s compliance date of April 14, 2003. The accounting of disclosures we provide will include the date of each disclosure, the name and, if known, the address of the entity or person who received your PHI, a brief description of the PHI disclosed, and a brief statement of the purpose and basis of the disclosure or, in lieu of such statement, a copy of your written authorization or written request for disclosure pertaining to such information. We are not required to provide an accounting of disclosures for the following purposes: treatment, payment, and health care operations; disclosures made in accordance with your signed authorization; disclosures made to you; disclosures to persons directly involved in your health care or the payment for your health care; disclosures for national security or intelligence purposes; and disclosures to correctional institutions. We reserve our right to temporarily suspend your right to receive an accounting of disclosures to health oversight agencies or law enforcement officials, as required by law.

We will respond to your written request within 60 days of its receipt. If we are unable to fulfill your request within the 60 days, we reserve the right to extend the time for up to an additional 30 days. We will provide your first accounting within any rolling twelve (12) month period without charge. However, we will impose a reasonable, cost-based fee for responding to each subsequent request for accounting within that same rolling twelve (12) month period. All written requests for an accounting of the disclosures of your PHI must be forwarded to the address provided in Paragraph 5 below.

How to Complain About Our Privacy Practices. If you believe that we may have violated your individual privacy rights, you may submit your written complaint to our Privacy Compliance Officer at the address provided in this paragraph. Your written complaint must name the entity that is the subject of your complaint and describe the acts and/or omissions you believe to be in violation of the Rule or of the provisions outlined in our Notice of Privacy Practices. If you prefer, you may file your complaint with the Secretary of the U.S. Department of Health and Human Services (Secretary). However, any complaint you file must be received by us, or filed with the Secretary, within 180 days of when you knew, or should have known, the act or omission occurred. We will take no retaliatory action against you if you make such complaints. If you wish to file any complaints, please forward your written correspondence to:

RI Department of Human Services

Privacy Compliance Officer

600 New London Avenue – LP

Cranston, RI 02920

(401) 462-2130 – Telephone

(401) 462-6239 – TTY (or 711) For Hearing Impaired

(401) 462-6165 – Fax

Contact Person for Information.

For more information about this Notice or to obtain a hard copy of this Notice, please forward your request to:

RI Department of Human Services

Privacy Contact Office

600 New London Avenue – Forand

Cranston, RI 02920

(401) 462-6312

Effective Date: This notice is effective April 14, 2003.

	For treatment (T): We may use and/or disclose your PHI with doctors, nurses, and other health care personnel involved in providing health care services to you. For example, your PHI may be shared with your primary care physician, medical specialists to whom you are referred, members of your treatment team, your pharmacist, your dentist, and other similarly situated health care personnel involved in your treatment.
	For payment (P):We may use and/or disclose your PHI for billing and collection activities and related data processing; for actions by a health plan or an insurer to obtain premiums or to determine or fulfill its responsibilities for coverage and the provision of benefits under its health plan or insurance agreement; to make determinations of eligibility or coverage, adjudication or the subrogation of health benefit claims; for medical necessity and appropriateness of care reviews, utilization review activities; and related payment activities so that individuals involved in delivering health care services to you may be properly compensated for the services they have provided.
	For health care operations (O): We may use and/or disclose your PHI in the course of operating the various business functions of the Rhode Island Department of Human Services Programs. For example, we may use your PHI to evaluate the quality of medical services provided to you; develop clinical guidelines; contact you with information about treatment alternatives or communications in connection with your case management or care coordination; to review the qualifications and training of health care professionals; for medical review, legal services, and auditing functions; and for general administrative activities such as customer service and data analysis.
	Appointment reminders: Unless you request that we contact you by other means, the Rule permits us to send appointment reminders and other similar materials to your address.