HIPAA NOTICE OF PRIVACY PRACTICES

Introduction to Privacy Notice:

New York Foundling (NYF) acknowledges that your privacy is extremely important to you and it is our obligation to protect it. We fully comply with the laws and regulations regarding the use and disclosure of Protected Health Information (PHI) we may obtain about you or your child during the provision of services.

All clients and consumers will receive a written copy of NYF privacy practices and this notice will be maintained on our website (www.nyfoundling.org).

NYF’s Duties Under HIPAA:

Protect Confidentiality

• NYF protects all client health information.
• PHI is no longer limited to addiction and HIV/AIDS.
• Protections are enforced through procedures monitored by Program Directors.

Ensure Security

• Client health records are kept locked.
• Client health information is not discussed in public areas.
• Access to health information is limited to authorized persons only.
• Staff are trained in agency procedures and supervised in their implementation.
• Staff is required to keep fax machines in secure locations.

Keep An Accounting

• NYF will track and account for any disclosures made to uncovered entities.
• This tracking and accounting will include disclosures for public policy and audits.
• NYF will keep all requests for access and amendments, as well as any denials, disagreements, and rebuttals in the client record.

Manage Electronic Exchange of Information

• Data and billing systems will have security plans that include limited and authorized access based on the “need to know”.
• Firewalls and worker access codes are used to restrict access to client records.
• All electronic methods of communication (e-mail, voice mail, website) are subject to the same privacy and security rules that govern the verbal and/or paper transmission of information.

Examples of Disclosures for Treatment, Payment, and Health Operations

Treatment, Payment and Health Operations

• Information you provide to NYF will be used for your treatment. NYF will disclose this information to other providers who require it to treat you.
• NYF will also disclose PHI in order for us to receive payment for your care.
• Internally at NYF, certain administrators will have access to it for such purposes as record reviews and supervision.
• Also, emergency medical information may be disclosed to health providers if needed. As mandated reporters, we are required to disclose information to the NYS Central Registry.

Business Associate Agreements

• NYF has what are called “business associate agreements” with others who treat you, and with other entities with which we work and who may not treat you but may see some of your health information. Examples include insurance companies, or for certification and compliance activities.
• The business associate must appropriately safeguard your information, and are provided the “minimum necessary” information to complete their work. After their work is complete the business associate must either destroy or return the PHI to NYF.
• NYF will stop working with associates who do not honor your right to privacy.

Family

• In accordance with policies and procedures governing consents to release information, NYF staff may disclose to a family member, or any other person you identify, health information relevant to that person’s involvement in your care.
• Unless it is an emergency, your consent will be secured prior to these disclosures.

Correctional Institutions

• Should you become an inmate of a correctional institution, we may disclose to the institution or agents there of health information necessary for your health and the health safety of other individuals.
• An inmate does not have the right to the Notice of Privacy Practices.

Law Enforcement

• We may disclose PHI for law enforcement purposes as required by law or in response to a valid subpoena.
• Federal law makes provision for your PHI to be released to an appropriate health oversight agency, public health authority or attorney provided that an employer or business associate believes in good faith that we have engaged in unlawful conduct or have otherwise violated professional or clinical standards and are potentially endangering one or more clients, workers or the public.

Authorizations and Consents

• Any disclosure of PHI for purposes other than treatment, payment and administrative operations will require your authorization.
  
• Consent forms will be in plain language and will be used to inform you that your PHI will only be used and/or disclosed to other covered entities to carry out treatment, and for payment and health care operations.
  
• You can request a restriction on the use of PHI and you can revoke your signed consents and authorizations in writing.

Clients’ and Consumers’ Rights and How to Exercise Them

• You have the right to adequate notice of use and disclosure of your PHI.
  
• You have a right to access your PHI in the form and format you request.
  
• You may be denied access, and if so you have the right to appeal the decision.
  
• You have a right to request an amendment to health information for such things as accuracy and completeness of PHI that is generated by and filed in NYF’s record.
  
• NYF has the right to deny your request for amending your record.
  
• You have a right to request restrictions on disclosing information.
  
• You have a right to request an accounting of disclosures of your PHI.

Who should clients or consumers contact for problem solving?

• If there is a problem, clients and/or consumers should first speak to their social worker.
  
• Clients and/or consumers needing additional assistance can contact the Program Director where they are receiving services.
  
• If a problem cannot be resolved by the Program Director, those receiving services can speak with NYF’s Privacy Officer, Melissa Morgan, at 212-727-6941. You may also email her at MelissaM@nyfoundling.org or send written requests to Melissa Morgan, Privacy Officer, New York Foundling , 590 Avenue of Americas, New York, NY 10011.
  
• If still not satisfied, clients and/or consumers can file a written complaint with: The Office of Civil Rights, Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201. The Office of Civil Rights Privacy Unit’s toll-free number is 866-627-7748.