Phone 315-369-6183
Fax 315-369-6181
THIS NOTICE DESCRIBES HOW MEDICAL
INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN OBTAIN
ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
HASCA is required by law
to maintain the privacy of your Protected Health Information and provide
to you a copy of this detailed Notice of Privacy Practice including our
legal duties and privacy practices relating to your Protected Health
Information; and abide by the terms of this Notice that are currently in
effect. HASCA reserves the right to change the terms of
this Notice, and will notify you or your personal representative by
letter if any material changes are made to this Notice.
HASCA is committed to
maintaining your confidentiality and protecting your health information.
Your Protected Health Information may be used for treatment, payment
arrangements, and for operational purposes, such as improving the
quality of care and services we provide you.
This Notice applies to all information and
records related to your care that our agency personnel and Business
Associates have received or created. It also applies to health
care professionals such as physicians and organizations that provide
care to you from HASCA. It informs you about the possible
uses and disclosures of your Protected Health Information and describes
your rights and our obligations at HASCA regarding your Protected
Health Information.
I.
WITH YOUR CONSENT WE MAY USE AND
DISCLOSE YOUR PROTECTED HEALTH INFORMATION FOR TREATMENT, PAYMENT AND
HEALTH CARE OPERATIONS
Our agency is required by New York State law
to obtain a signed Consent allowing us to use and disclose your
Protected Health Information or Private Information know also as ‘PHI’
to others for purposes of providing your home care services, obtaining
payment for our services, and our health care operations.
Instances in which HASCA may use and disclose your health
information are for;
§
Treatment.
Our staff and affiliated health care professionals may review
and record information in your record about your treatment and care.
We will use and disclose this health information to health care
professions such as your physicians or therapists in order to best treat
and care for you.
§
Payment. HASCA
may use or disclose your Protected Health Information
to others when applicable for purposes of billing for your home care
services. We may also, if necessary, disclose your health
information to other health care providers so that they can receive
payment for your services.
§
Health Care Operations.
HASCA may use and disclose your Protected Health
Information to conduct its general course of business, such as
evaluation of our agency’s services, including the performance of our
staff, education of staff, and quality improvement functions.
II.
WE MAY USE AND DISCLOSE YOUR PROTECTED
HEALTH INFORMATION FOR OTHER SPECIFIED PURPOSES
§
Business Associates.
HASCA may share your Protected Health Information
whenever applicable to our vendors and agents who create, receive,
maintain or transmit PHI for certain functions on behalf of our agency.
These are called our “Business Associates” and include health care
affiliates that create, receive, maintain, or transmit PHI on behalf of
HASCA. To protect and safeguard your health information, we
require our Business Associates to appropriately safeguard your
information.
§
Family and Friends Involved in Your Care.
Unless you object, we may disclose your Protected Health Information
to a family member or close personal friend, including clergy, who is
involved in your care or payment for that care.
§
Personal Representative.
If you have a personal representative, such as a legal guardian, we will
treat that individual as if that person is you with respect to
disclosures of your health information. If you become deceased, we
may disclose your health information to an executor or administrator of
your estate to the extent that individual is acting as your personal
representative or to your next of kin, as permitted under state and
federal law.
§
Disaster Relief.
We may disclose your Protected Health Information to an
organization assisting in a disaster relief effort.
§
Public Health Activities.
We may disclose your Protected Health Information for
public health activities including the reporting of disease, injury,
vital events, and the conduct of public health surveillance,
investigation and/or intervention. We may also disclose your
information to notify a person who may have been exposed to a
communicable disease or may otherwise be at risk of contracting or
spreading a disease or condition if a law permits us to do so.
§
Health Oversight Activities.
We may disclose your Protected Health Information to health oversight
agencies authorized by law to conduct audits, investigations,
inspections and licensure actions or other legal proceedings.
§
Reporting Victims of Abuse, Neglect or
Domestic Violence. If we have reason to
believe that you have been a victim of abuse, neglect or domestic
violence, we may use and disclose your Protected Health Information to
notify a governmental authority if required or authorized by law, or if
you agree to the report.
§
Law Enforcement.
We may disclose your Protected Health Information for certain law
enforcement purposes or other specialized governmental functions;
§
Judicial and Administrative Proceedings.
We may disclose your Protected Health Information in the course of
certain judicial or administrative proceedings.
§
Research.
HASCA will request that you sign a written authorization
before using your Protected Health Information or disclosing it to
others for research purposes.
§
Coroners, Medical Examiners, Funeral
Directors, Organ Procurement Organizations.
We may release your health information to a coroner,
medical examiners, and funeral director or, if you are an organ donor,
to an organization involved in the donation of organs and tissue.
§
To Avert a Serious Threat to Health or
Safety. We may use and disclose
your Protected Health Information when necessary to prevent a serious
threat to your health or safety or the health or safety of the public or
another person. However, any disclosure would be made only to
someone able to help prevent the threat.
§
Military and Veterans.
If you are, or were, a member of the armed forces, we
may use and disclose your Protected Health Information as required by
military command authorities. We may also use and disclose
Protected Health Information about foreign military personnel as
required by the appropriate foreign military authority.
§
Workers’ Compensation.
We may use or disclose you Protected Health Information
to comply with laws relating to workers’ compensation or similar
programs.
§
National Security and Intelligence
Activities; Protective Services.
We may disclose Protected Health Information to authorized federal
officials who are conducting national security and intelligence
activities or as needed to provide protection to the President of the
§
As Required By Law.
We will disclose your Protected Health Information when
required by law to do so.
III.
YOUR AUTHORIZATION IS REQUIRED FOR
OTHER USES OF YOUR PROTECTED HEALTH INFORMATION
HASCA will use and
disclose your Protected Health Information other than as described in
this Notice or required by law only with your written Authorization.
You may revoke your Authorization to use or disclose Protected Health
Information in writing, at any time. To revoke your Authorization,
contact our Director or other Administrative staff. If you revoke
your Authorization, we will no longer use or disclose your Protected
Health Information for the purposes covered by the Authorization, except
where we have already relied on the Authorization.
§
Marketing/Fundraising.
HASCA is required by law to receive your written
authorization before using any of your Protected Health Information or
photo for purposes of marketing or fundraising. Under no
circumstances will we sell our client list or your Protected Health
Information to a third party without your prior written authorization.
We may contact you for purposes of fundraising however you have the
right to opt out of receiving such communication.
§
Psychotherapy Notes.
In most circumstances, HASCA is required by law to obtain your
written authorization before we can use or disclose any psychotherapy
notes.
IV.
YOUR RIGHTS REGARDING YOUR HEALTH
INFORMATION
You have the following rights with respect to
your health information. If you wish to exercise any of
these rights, you should make a request to the HASCA Director
(Privacy Officer).
§
Right of Access to Protected Health
Information. You have the right to request,
either orally or in writing, to inspect and obtain a copy of your
Protected Health Information, subject to some limited exceptions.
If available, you have the right to access your information in
electronic format. We must allow you to inspect your records within 10
days of your request. If you request copies of the records, we
must provide you with copies within a reasonable time but not more than
30 days if the records are maintained onsite, or 60 days for if reason
records are maintained at any location other than the agency office.
We may charge a reasonable fee for our costs of copying and mailing your
requested information.
In certain limited circumstances, we may deny
your request to inspect or receive copies. If we deny access to
your Protected Health Information, we will provide you with a summary of
the information, and you have the right to request review of our denial
and how to file a complaint with HASCA or the Secretary of the
Department of Health and Human Services.
§
Right to Request Restrictions.
You have the right to request restrictions on the way we use and
disclose your Protected Health Information for treatment and services,
collection of payment for treatment and services, or for purposes of
agency operations. You have the right to restrict your Protected
Health Information that we disclose to a family member, friend or other
person who is involved in your care or the payment of your care.
HASCA may not be required
to agree to your requested restrictions, and in some cases, the law may
not permit us to accept your restrictions. However, if we do agree
to accept your restriction, we will comply with your restriction
EXCEPT IF: you are being transferred to another health care
institution, the release of records is required by law, or the release
of information is needed to provide you emergency treatment. If
your restriction applies to the disclosure of information to a health
plan for payment or health care operations purposes and is not otherwise
required by law, and where you paid out of pocket in full for services
rendered, we are required to honor that request.
§
Right to Receive Notice of a Breach.
We will notify you by first class mail or by e-mail (if you have
indicated a preference), of any breaches of Unsecured Protected Health
Information as soon as possible, but in any event, no later than 60 days
following the discovery of a breach. A “Breach” is defined as the
unauthorized access, acquisition, use, or disclosure of Protected Health
Information which compromises the security or privacy of Protected
Health Information, except: (1) an unauthorized person to whom
such information is disclosed would not reasonably have been able to
retain such information; (2) any unintentional acquisition, access, or
use of PHI by an employee or individual acting under the authority of a
covered entity or business associate (a) was made in good faith and
within the course and scope of the employment or other professional
relationship of such employee, or individual, respectively, with the
covered entity or business associate; and (b) such information is not
further acquired, accessed, or used or disclosed by any person; or (3)
any inadvertent disclosure from an individual who is otherwise
authorized to access your PHI at HASCA or by a covered entity or
business associate to another similarly situated individual, provided
that any such information received as a result of disclosure in not
further acquired, accessed, used, or disclosed without authorization.
HASCA must notify you of any breach unless our agency can
demonstrate, based on a risk assessment, that there is a low probability
that the PHI has been compromised.
“Unsecured Protected Health Information” is
information that is not secured through the use of technology or
methodology identified by the U.S. Department of Health and Human
Services to the render the Protected Health Information unusable,
unreadable and undecipherable to unauthorized users. The notice is
required to include the following information:
Ø
A brief description of the breach, including the date of
the breach and the date of its discovery, if known;
Ø
A description of the type of Unsecured Protected Health
Information involved in the breach;
Ø
Steps you should take to protect yourself from potential
harm resulting from the breach;
Ø
A brief description of actions HASCA is taking to
investigate the breach, mitigate losses, and protect against further
breaches; and
Ø
Contact information, including a toll-free number,
e-mail address, website, or postal address which permits you to ask
questions or obtain additional information.
In the event the breach involves more than 10
clients whose contact information is out of date, we will post a notice
of the breach in a major print or broadcast media. The agency does
not own domain to a website at this time. If the breach involves
more than 500 clients in the state or jurisdiction, we will send notices
to prominent media outlets. If the breach involves more than 500
clients, the agency is required to immediately notify the Secretary of
Health and Human Services. We are also required to submit an
annual report to the Secretary of a breach that involved less than 500
clients during the year and will maintain a written log of breaches
involving less than 500 clients. Notification to the Secretary
will occur within 60 days of the end of the calendar year in which the
breach was discovered.
§
Right to an Accounting of Disclosures.
You have the right to request an “accounting” of our disclosures of your
Protected Health Information. This is a listing of certain
disclosures of your Protected Health Information made by the agency or
by others on our behalf, but does not include disclosures made for
treatment, payment and health care operations or certain other purposes
unless the records are maintained in an Electronic Health Record.
Records maintained in an Electronic Health Record will include
disclosures made for home care services, payment, health care operations
and other purposes.
You must submit a request in writing, stating
a time period that is within six years from the date of your request. If
an Electronic Health Record applies, we will provide you with an
accounting of disclosures for a three year period. You are entitled to
one free accounting within one 12-month period. For additional
requests, we may charge you our costs.
We will make every effort to respond to your
request within 60 days. Occasionally, we may need additional time
to prepare the accounting. If so, we will notify you of our delay,
the reason for such delay and the date accounting statement can be
expected.
§
Right to Request Amendment.
If you think that your Protected Health Information is not accurate or
complete, you have the right to request that HASCA amend such
information for as long as the information is kept in our records.
Your request must be in writing and state the reason for the requested
amendment. We will make every attempt to respond within 60 days,
but will notify you within 60 days if we need additional time to
respond, the reason for the delay and when you can expect our response.
We may deny your request for amendment, if we do so, we will provide you
a written denial including the reasons for denial and an explanation of
your right to submit a written statement disagreeing with the denial.
§
Right to a Paper Copy of This Notice.
It is the policy of HASCA to provide you with a paper copy of the
notice.
§
Right to an Electronic Copy of This Notice.
You have a right to an electronic copy of the notice if
you request. We will forward this notice to you by email in Word
document format.
§
Right to Request Confidential
Communications. You have the right to request
that we communicate with you concerning personal health matters in a
certain manner or at a certain location. For example, you can
request that we speak to you only at a private location in your home.
We will accommodate all reasonable requests.
V.
COMPLAINTS
If you believe that your privacy rights have
been violated, or you feel you have been discriminated against, you may
file a complaint in writing with us or with the Office of Civil Rights
in the U.S. Department of Health and Human Services at
1-800-368-1019. To file a
complaint with the agency, contact HASCA Privacy Officer Roberta
Konecny at 315-369-6183. No one will retaliate or take action
against you for filing a complaint.
VI.
CHANGES TO THIS NOTICE
We will promptly revise and distribute this
Notice whenever there is a material change to the uses or disclosures,
your individual rights, our legal duties, or other privacy practices
stated in this Notice. We reserve the right to change this Notice
and to make the revised or new Notice provisions effective for all
Protected Health Information already received and maintained by the
agency as well as for all Protected Health Information we receive in the
future. We will post a copy of the current Notice in our office.
In addition, we will provide a copy of the revised Notice to all
clients/consumers.
VII.
FOR FURTHER INFORMATION
If you have any questions about the contents
of this Notice or would like further information concerning your privacy
rights, please contact HASCA Privacy Officer, Roberta Konecny at
315- 369-6183.
Effective date of this Notice:
September 23, 2013