PRC Privacy Protection of Health Information
Effective December 1, 2006
Legal References: 122C-52 through 122C-56, 10NCAC 18D, GS 130A-143, Health Insurance Portability Accountability Act (HIPAA) 42 CFR, Part 2; HIPAA 45 CFR, parts 164.502-164.528
PRC, including all consultants and contracted agencies, shall hold confidential all Protected Health Information (PHI) that is created or received in oral, written or other forms relating to individuals seeking or receiving services. This shall also include any PHI acquired on individuals served but not admitted into programming. PRC will secure a general written authorization for health information disclosures made to carry out treatment, payment, and all related services needed for consumer to complete services. Use/disclosure of confidential consumer information shall not be permitted except as authorized under NC GS 122C-52 through 122C-56 and NCGS 130A-143 and in accordance with NC MH/DD/SA Confidentiality Rules (10NCAC, 18D.01117 thorough .0325) and HIPAA; or in the event of confidential information relating to consumers for substance abuse services, in accordance with Federal Rules 42 CFR, part 2, unless the state statutes and rules are more restrictive. PRC shall permit the consumer to request amendment of their PHI as specified under HIPPA and the PRC Handbook.
The CEO Clinical Services shall serve as the privacy officer for implementation of all compliance issues for the privacy protection. All confidentiality policies are listed as such below and can be found in the PRC Handbook.
Confidentiality
As a mental health and substance abuse provider, PRC is under federal HIPAA, Substance Abuse, and state MH/DD/SA policies relating to confidentiality. As such, PRC will enforce all matters of confidentiality to the highest standards, which are the federal Substance Abuse policies. There is no secondary redisclosure with written consent of the consumer or legally responsible person for the consumer. Confidentiality covers all written, electronic, and verbal information.
Consumer and general business confidentiality is a must and is required of all staff and other affiliates, such as vendors. ALL information about employees, staff, consumers, consumer family members is considered CONFIDENTIAL. This means that staff is prohibited from disclosing any confidential information about the consumer, family or other staff members to someone not in the treatment team for PRC. For the purpose of treatment services the consumer will give be required to give written consent for exchange of information to PRC for all members of the treatment team. The only exception for this disclosure is in the event that the consumer is a threat to self or others or there is a suspicion the consumer is experiencing neglect and/or abuse. In this event, the staff must immediately file an incident report and disclose information to the QP, who will then disclose information to the appropriate authorities.
Confidential information may also be provided to the Department of Corrections in order to provide MH/DD/SA services for any inmate. Non-identifying information may be disclosed to the State for informational purposes and/or used for research by state or private agencies.
Measures to insure privacy and security will be taken for all written, oral or electronic information. Electronic information will be secured under separate drives or password protected databases. All electronic correspondences regarding consumer information will contain a confidentiality statement. Every effort will be made to protect confidential information and provide security and safety for the consumer.
Except as required or permitted by law, disclosure of confidential information to someone not authorized to receive the information is a Class 3 misdemeanor and is punishable only by a fine, not to exceed five hundred dollars ($500.00).
Upon the request of a consumer, who is an adult and who has not been adjudicated incompetent under Chapter 35, or former Chapters 33 or 35 of the GS, or the legally responsible person for any other consumer, PRC shall disclose to an attorney, confidential information relating to that client. PRC shall disclose confidential information if a court of competent jurisdiction issues an order compelling disclosure.
PRC may disclose confidential information if the consumer or legally responsible person consents in writing to the release of the information to a specified person or entity. This release is valid for a specified length of time and subject to revocation by the consenting individual. PRC may disclose the fact of admission or discharge of a consumer to the consumer’s next of kin whenever the appropriate county CEO determines that the disclosure is in the best interest of the consumer. Upon request, a consumer shall have access to confidential information in the consumer record except information that would be injurious to the consumer’s physical or mental well-being as determined by the appropriate CEO of clinical services. If the designee has refused to provide confidential information to a consumer, the consumer may request that the information be sent to a physician or psychologist of the consumer’s choice and in this event, the information shall be so provided.Except as provided by GS 90-21.4(b), upon request the legally responsible person of a consumer shall have access to confidential information in the consumer's record; except information that would be injurious to the consumer's physical or mental well-being as determined by the appropriate CEO of clinical services. If the CEO has refused to provide confidential information to the legally responsible person, the legally responsible person may request that the information be sent to a physician or psychologist of the legally responsible person's choice and in this eventthe information shall be so provided.
An internal consumer advocate shall be granted, without the consent of the consumer or legally responsible person, access to routine reports and other confidential information necessary to fulfill the monitoring and advocacy functions. In this role, the internal consumer advocate may disclose confidential information received to the consumer involved, to the legally responsible person, to the appropriate CEO of clinical services, and to other individuals within PRC who are involved in the treatment or habilitation of the consumer. Any further disclosure shall require the written consent of the consumer and the legally responsible person. An external consumer advocate shall have access to confidential information only upon the written consent of the consumer and the legally responsible person. The external consumer advocate may use the information only as authorized by the consumer and legally responsible person.
Upon a determination by the CEO clinical services that disclosure is in the best interests of the consumer, PRC may disclose confidential information for purposes of filing a petition for involuntary commitment of a consumer pursuant to Article 5 NCGC 122C or for purposes of filing a petition for the adjudication of incompetence of the consumer and the appointment of a guardian or an interim guardian under Chapter 35A of the NCGS.
If an individual is a defendant in a criminal case and a mental examination of the defendant has been ordered by the court as provided in GS 15A-1002, PRC shall send the results or the report of the mental examination to the clerk of court, to the district attorney or prosecuting officer, and to the attorney of record for the defendant as provide in GS 15A-1002(d).
Certified copies of written results of examinations by physicians and records in the cases of consumers voluntarily admitted or involuntarily committed and facing district court hearings and rehearing pursuant to Article 5 NCGE 122C shall be furnished by PRC to the consumer’s counsel, the attorney representing the State's interest, and the court. The confidentiality of consumer information shall be preserved in all matters except those pertaining to the necessity for admission or continued stay in the facility or commitment under review. The relevance of confidential information for which disclosure is sought in a particular case shall be determined by the court with jurisdiction over the matter. PRC may disclose confidential information to an attorney who represents either PRC or an employee of PRC, if such information is relevant to litigation, to the operations of PRC, or to the provision of services by PRC. An employee may discuss confidential information with his/her attorney or with an attorney representing PRC. PRC shall disclose confidential information for purposes of complying with Article 3 of Chapter 7B of the GS and Article 6 of Chapter 108A of the GS, or as required by other State or federal law.
An area authority or county program may share confidential information regarding any consumer with any area facility, and any areafacility may share confidential information regarding any consumer of that facility with the area authority or county program, when the area authority or county program determines the disclosure is necessary to develop, manage, monitor, or evaluate the area authority's or county program's network of qualified providers as provided in GS 122C-115.2(b)(1), G.S. 122C-141(a), the State Plan, and rules of the Secretary. The purposes or activities for which confidential information may be disclosed include, but are not limited to, quality assessment and improvement activities, provider accreditation and staff credentialing, developing contacts and negotiating rates, investigating and responding to client grievances and complaints, evaluating practitioner and provider performance, auditing functions, on-site mentoring, conducting consumer satisfaction studies, and collecting and analyzing performance data.Any area facility may share confidential information with any other area facility regarding an applicant when necessary to determine whether the applicant meets eligibility for area facility services.
A facility, physician, or other individual responsible for evaluation, management, supervision, or treatment of respondents examined or committed for outpatient treatment under the provisions of Article 5 NCGS 122C may request, receive, and disclose confidential information to the extent necessary to enable them to fulfill their responsibilities.
The CEO clinical services may disclose an advance instruction for mental health treatment or confidential information from an advance instruction to a physician, psychologist, or other qualified professional when the responsible professional determines that disclosure is necessary to give effect to or provide treatment in accordance with the advance instruction. PRC may disclose confidential information to a provider of support services whenever the other provider has entered into a written agreement with a person to provide support services and the agreement includes a provision in which the provider of support services acknowledges that in receiving, storing, processing, or otherwise dealing with any confidential information, it will safeguard and not further disclose the information.
Whenever there is a reason to believe that a consumer is eligible for benefits through a governmental agency, PRC may disclose confidential information to state, local, or federal government agencies. Except as provided in GS 122C (5)(a3), disclosure is limited to that confidential information necessary to establish financial benefits for a consumer. After establishment of these benefits, the consent of the consumer or legally responsible person is required for further release of confidential information.Within PRC employees, students, consultants or volunteers involved in the care, treatment, or habilitation of a consumer may exchange confidential information as needed for the purpose of carrying out their responsibility in serving the consumer.
Upon request of the next of kin or other family member who has a legitimate role in the therapeutic services offered, or other person designated by the consumer or legally responsible person, the responsible professional shall provide the next of kin or other family member or the designee with notification of the consumer’s diagnosis, the prognosis, the medications prescribed, the dosage of the medications prescribed, the side effects of the medications prescribed, if any, and the progress of the consumer, provided that the consumer or legally responsible person has consented in writing, prior to the release of this information.
Both the consumer’s and the legally responsible person’s consent and the release of this information shall be documented in the consumer’s medical record. This consent shall be valid for a specified length of time only and is subject to revocation by the consenting individual.Notwithstanding the provision of GS 122C53(b) or GS 122C-206, upon request of the next of kin or other family member who has a legitimate role in the therapeutic services offered, or other person designated by the consumer or legally responsible person, the responsible professional shall provide the next of kin, or family member, or the designee, notification of the consumer’s admission to PRC, transfer to another provider, discharge from PRC, and referrals and appointment information for treatment after discharge, after notification to the consumer that this information as been requested.
In response to a written request of the next of kin or other family member who has a legitimate role in the therapeutic services offered, or other person designated by the consumer, for additional information not aforementioned, and when such written request identifies the intended use for this information, the CEO clinical services shall, in a timely manner: (1) Provide the information requested based upon the CEO clinical services determination that providing this information will be to the consumer's therapeutic benefit, and provided that the consumer or legally responsible person has consented in writing to the release of the information requested; or refuse to provide the information requested based upon the determination that providing this information will be detrimental to the therapeutic relationship between consumer and treatment team; or refuse to provide the information requested based upon the determination that the next of kin or family member or designee does not have a legitimate need for the information requested.
The Secretary of State may require information that does not identify consumers from state and area facilities for purposes of preparing statistical reports of activities and services and for planning and study.The Secretary of State may also receive confidential information from State and area facilities when specifically required by other State or federal law.The Secretary may have access to confidential information from private or public agencies or agents for purposes of research and evaluation in the areas of MH/DD/SA. No confidential information shall be further disclosed. PRC may disclose confidential information to persons responsible for conducting general research or clinical, financial, or administrative audits if there is a justifiable documented need for this information. A person receiving the information may not directly or indirectly identify any consumer in any report of the research or audit or otherwise disclose consumer identifying information in any way.
Confidential information regarding persons being treated for substance abuse shall be released or disclosed in accordance with the federal regulations 42 C.F.R. Part 2, Confidentiality of Alcohol and Drug Abuse Patient Records, which are adopted by reference pursuant to G.S. 150B-14(c), unless the NCGS rules are more restrictive in which case the NCGS rules shall be followed.
Persons in violation of any of the policies and procedures for confidentiality are subject to suspension, dismissal, or disciplinary action. Any persons who fail to comply with confidentiality policies shall be denied subsequent access to confidential information by PRC.
When PRC receives confidential information from another facility, agency or individual, then such information shall be treated as any other confidential information generated. Release or disclosure of such information shall be governed by these same rules of confidentiality.
Questions regarding interpretation of and NCGS or NCAR shall be directed to the Client Records Consultant in the Institution Management Support Section of the Division of Mental Health, Developmental Disabilities and Substance Abuse.
The CEO clinical services shall be responsible for the release of confidential information but may delegate the authority for release to other persons under her supervision. The delegation shall be in writing. PRC shall inform the recipient of any information that secondary redisclosure of such information is prohibited without consumer consent.
PRC Privacy Protection of Health Information
Effective December 1, 2006
I, ______, understand that PRC must comply with all local, state and federal privacy policies relating to my protected health information. I affirm that I have received a paper copy of PRC’s policies and have been given an opportunity to have them explained in language I understand. I affirm I accept the conditions of the PRC privacy policy.
______
Consumer/Consultant/Legal RepresentativeDate
PRC Privacy Policy
July, 2007