Agency Guidelines for HIPAA, HITECH, FERPA, Privacy & Security
(March 5, 2014)

The Agency (MCFI, NHS, MCFI Home Care, iLIFE and SEDA)will maintain the confidentiality and privacy of client information in all settings. The Agency is a covered entity under HIPAA and HITECH. We require all staff, volunteers and interns to abide by the Privacy Rule and the Security Rule.

FERPA (The Family Educational Rights and Privacy Act) of 1974 is a Federal law that protects the privacy of students’ education and record and established rights for students relative to disclosure of education records.

Protecting Client Privacy

1)Staff will not discuss confidential client information, including Protected Health Information (PHI), among themselves in public areas.

2)Conversations with the client/family regarding confidential client information and PHI will not be held in public areas.

3)Overhead and intercom announcements will not include confidential client information or PHI.

4)Phone conversations and dictation will take place in areas where confidential client information and PHI cannot be overheard.

5)With the exception of the client’s first name, confidential client information will not be called out in a program area or other open space.

6)Staff, interns and volunteers are authorized to access only the minimum necessary information to perform their job duties.

Electronic Security

1)When possible, computer monitors are positioned away from public areas to avoid observation by visitors.

2)Please log off or lock your workstation when the computer is unattended. The IT Department requires that you set a password on your screen saver so that unused computers are automatically locked when the screensaver turns on.

3)The volume on audio equipment (e.g. speaker phones, tape recorders, etc.) is turned down so information being played cannot be overheard by other staff or visitors. Voice mail passwords are not the default setting or the last four digits of your phone number.

4)Confidential client information, including PHI, may not be downloaded to non-encrypted portable devices.

Document Security

1)On desks in public areas, documents with confidential client information (including PHI) will be placed face down or concealed.

2)Paper documentation and client files are stored in such a way as to avoid observation by clients, visitors, or casual access by unauthorized staff.

3)Release of confidential client information (including PHI) will only be done by staff specifically authorized to do so following applicable federal and state laws and agency policy.

4)Confidential client information (including PHI) will not be left unattended at a printer, photocopier or fax machine.

5)Confidential client information (including PHI) must be discarded in the appropriate secure container or immediately shredded.

6)Client listings are not readily visible by clients or visitors.

7)All employees are required to wear an ID badge when in the building. Those people not recognized in restricted areas should be asked for identification.

8)All client files are filed in locked storage cabinets or rooms that are locked.

9)Only authorized staff has access to confidential client information (including PHI) and use only the minimum amount necessary to accomplish their duties.

Reporting Concerns and Sanctions

1)Individuals should feel comfortable and obligated to report all suspected security and privacy breaches to their supervisor, any Clinical Information staff, IT staff, to the Privacy Officer-Alex Chou,the Security Officer-David Jones, the Director of Compliance-Julie Van Alstine or via the anonymous hotline.

2)All supervisors regularly review procedures and work instructions that are applicable for their area work assignments with their staff to ensure that current practices and procedures protect client privacy and security.

3)Violations of HIPAA, HITECH and FERPAstatutes may result in disciplinary action for employees, fines and/or criminal prosecution to the agency or individual.

Employee Name: ______

Employee Signature: ______

Date Reviewed: ______

Form No.: 04/2014 40-59-01

Updated 03/05/2014 Kimberley Noon, Compliance Officer