HIPAA Privacy Notice
POLICY
It is the Company’s policy to provide patients with the Notice of Privacy when they first receive services or equipment through Stepping Stones Early Intervention Inc.
PURPOSE
The purpose of this policy is to explain:
The patient’s right to a notice.
The relevant procedures the Company must follow when providing its notice to patients.
Requirements for documentation of and revisions to the Company’s notice.
Right to a Notice of Privacy Practices
A. Patient’s Right to Notice
Patients have a right to adequate notice of:
The uses and disclosures of PHI that the Company may make.
The patient’s rights with respect to PHI.
The Company’s legal obligations regarding PHI.
B. Basic Notice Requirements
The notice must be written in plain language and contain specific elements.
2. Provision of the Notice to Patients
A. General Rules
The Company must follow these rules for providing a paper copy of the notice to patients and the public in general:
The Company must make the notice available upon request to any person, even if they are not current patients.
The Company must provide the notice to the patient no later than the date of the first service to the patient.
3. Document Collection, Retention Requirements, Disclosure, and Disposal of Medical Information
The Company must retain a copy of each notice for its issues and other medical documentation for a period of six (6) years in a locked cabinet or locked office that is accessible only to Stepping Stones Early Intervention Inc. After that period, the records will be shredded.
This information may be shared with the child’s physician, service coordinators, and team members listed on the IFSP.
This information may be received via mail and facsimile transmission with the use of a confidentiality statement, and these records will also be accessible only to SSEI Inc.
General Use and Disclosure
Policy
SSEI Inc. will use and disclose PHI only as specifically permitted or required by the Privacy Rules in accordance with the Company’s policies and procedures. The purpose is to explain the basic standards that must be met when using and disclosing PHI.
Permitted Uses and Disclosures
To the patient.
To carry out treatment, payment, or healthcare operations.
In compliance with a valid authorization.
Pursuant to a verbal agreement from a patient that permits disclosure to a caregiver.
Treatment
Treatment includes activities provided by a healthcare provider, office staff, and other professionals coordinating and managing care with third parties, including consultations with and between healthcare providers.
Healthcare Operations
Healthcare operations include the necessary business and administrative functions of the office.
Payment
Payment includes activities involved in determining eligibility for services, health plan coverage, billing, receiving payments for health benefits, utilization management activities, review of healthcare services, justification of charges, pre-certification, and pre-authorization.
Minimum Necessary Information
The Minimum Necessary Standard
When using or disclosing PHI, and when requesting PHI from another entity, SSEI Inc. will make reasonable efforts to use, disclose, or request only the minimum amount of PHI reasonably necessary to accomplish the intended purpose.
The Company has procedures that limit access to identified personnel and only the PHI required for their job responsibilities. These procedures are based on reasonable determinations regarding who requires PHI and the nature of the information needed.
Disclosures to Relatives and Friends
The Company may disclose PHI to a person involved in the current healthcare of the patient or with payment for the person's healthcare.
Oral Communications
Applicability of Privacy Standards
The Privacy Rules apply to PHI in all forms—electronic, written, oral, or any other format.
Employees may communicate PHI over the telephone with the patient, physician, team members involved in the patient's healthcare, or a family member.
Personal Representatives
The Company must treat a person as the personal representative of a patient if that person is authorized under applicable state law to act on behalf of the patient in making healthcare decisions.
Tracking Disclosed Information
All disclosures made will be recorded through communication or conference notes in the patient’s file.
Other Use and Authorization of PHI
The Company will obtain a signed authorization from a patient before disclosing PHI for purposes not otherwise permitted by a verbal agreement or Privacy Rules that allow disclosure without the patient’s permission.
Authorization is required for non-routine purposes beyond treatment, payment, and healthcare operations, such as certain marketing activities or research purposes.
Disclosures for Which Authorization Is Not Required
Treatment, payment, and healthcare operations. Consent contained in the IFSP document may be used for these purposes for patients receiving Early Intervention services.
Involvement in the patient’s care and notification purposes.
When required by law.
Reports involving victims of abuse, neglect, or domestic violence.
Health oversight activities.
Judicial and administrative proceedings.
Workers’ compensation.
Disclosure to the patient.
Disclosure to the DHS for enforcement of the Privacy Rules.
Face-to-face marketing communications or promotional products of nominal value.
Incidental Disclosures
Incidental disclosures may occur as a by-product of a use or disclosure otherwise permitted under the Privacy Rules, provided the Company has applied reasonable safeguards and implemented the Minimum Necessary Standard where applicable.
Right to Access Records and Disclosure Accounting
The Company will process requests to access, inspect, and obtain copies of PHI, including assessments, progress notes, discharge summaries, and information needed to make decisions about claims and case management records, when requested by the patient or their authorized representative.
Requests for access to PHI must be made in writing.
The Company must provide access for six (6) years from the time the PHI was first in effect.
A patient also has the right to request a list of disclosures of their health information made for purposes other than payment, healthcare operations, and permitted activities within the previous six years, but not before April 14, 2003, when submitted in writing.
Right to Amendment of Protected Health Information
A patient has the right to request that SSEI Inc. amend PHI about them for as long as the Company maintains those records.
The Company must document the titles of persons or offices responsible for receiving and processing amendment requests.
SSEI Inc. will maintain documentation of amendments for six (6) years from the date of creation.
Patient Complaints
It is the Company’s policy to promptly receive, respond to, and resolve all patient complaints regarding the improper use or disclosure of PHI by the Company or its business associates.
Subject of Complaints
An individual may submit a formal complaint regarding the Company’s information practices, including:
Privacy and security of PHI.
Use and disclosure of PHI.
Patient access to and amendment of PHI.
The Company’s marketing practices and the actions of business associates.
Documentation of Complaints
The Company must maintain records of complaints, actions taken (including policy changes), and sanctions against the persons involved.
These records must be maintained for six (6) years from the date they are created.
Concerned parties may submit complaints using the information below.
Privacy Officer
SSEI Inc.
14466 Pinewood Drive
Orland Park, IL 60467
Other Complaints May Be Submitted To
Region V, Office for Civil Rights
U.S. Department of Health and Human Services
233 N. Michigan Ave, Suite 240
Chicago, IL 60601