Notice of Privacy Practices
Describes the use of PHI for carrying out treatment, payment, or health care operations. A written acknowledgement is recommended rather than verbal.
Consent for Use or Disclosure for TPO
Patient consent to the use of and disclosure of health information for treatment, payment, or health care operations (TPO) (optional).
Authorization to use or disclose PHI must be obtained when a consent form does not apply or another exception otherwise permitting use or disclosure of PHI does not apply. See Authorization to Release Health Care Information.
Business Associate Contract (BAC)
Describes protection of privacy of a patient’s PHI when using outside entities that provide services for your organization where access to PHI is necessary.
Data Use Agreement
An agreement with a recipient of the PHI data that limits his or her use of PHI.
Privacy Officer Job Description
A written description of the Privacy Officer’s roles and responsibilities.
Termination Procedure
A written policy of termination of employees who fail to comply with internal privacy policies and procedures.
What to Include
| A complete Notice of Privacy form will include: | Notice of Privacy Practices |
|---|---|
| What will information be used for? | We use health information about you for treatment, to obtain payment, for administrative purposes, and to evaluate the quality of care that you receive. |
| Can information be used for anything else? | We may use or disclose identifiable health information about you without your authorization for public health purposes, for auditing, and for research studies (subject to certain requirements). |
| Limitations of disclosure? | In any other situation, we will ask for your written authorization before using or disclosing any identifiable health information about you. |
| Patient’s rights | In most cases, you have the right to look at or get a copy of health information about you that we use to make decisions about you. Copies can be provided for $0.05 per page. You also have a right to receive a list of instances in which we have disclosed health information about you for reasons other than treatment, payment, or related administrative purposes. If you believe that the information in your record is incorrect or if important information is missing, you have the right to request that we correct the existing information or add missing information. |
| Complaints | If you are concerned that we have violated your privacy rights, you may contact the person below. (HIPAA compliance officer or office manager should be referenced.) |
| Legal duty of office | We are required by law to protect the privacy of your information, provide this notice about our information practices, and follow the information practices that are described in this notice. |
| For questions or complaints, please contact: Name, address, phone |
Adapted from http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html NPP information.