HIPAA NOTICE OF PRIVACY PRACTICES
(Note to therapists: Section I below must appear in your
Notice of Privacy Practices exactly as it appears
hereunder.)
I. THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION
ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO
THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
II. IT IS MY LEGAL DUTY TO SAFEGUARD YOUR
PROTECTED HEALTH INFORMATION (PHI).
By law I am required to insure that your PHI is kept
private. The PHI constitutes information created or
noted by me that can be used to identify you. It
contains data about your past, present, or future health or
condition, the provision of health care services to you, or the
payment for such health care. I am required to provide
you with this Notice about my privacy procedures. This Notice
must explain when, why, and how I would use and/or disclose your
PHI. Use of PHI means when I share, apply,
utilize, examine, or analyze information within my practice; PHI
is disclosed when I release, transfer, give, or
otherwise reveal it to a third party outside my practice. With
some exceptions, I may not use or disclose more of your PHI than
is necessary to accomplish the purpose for which the use or
disclosure is made; however, I am always legally required to
follow the privacy practices described in this Notice.
Please note that I reserve the right to change the terms of this
Notice and my privacy policies at any time as permitted by
law. Any changes will apply to PHI already on file
with me. Before I make any important changes to my
policies, I will immediately change this Notice and post a new
copy of it in my office and on my website (if
applicable). You may also request a copy of this
Notice from me, or you can view a copy of it in my office or on
my website, which is located at victoriamunoz.com.
III. HOW I WILL USE AND DISCLOSE YOUR PHI.
I will use and disclose your PHI for many different
reasons. Some of the uses or disclosures will require
your prior written authorization; others, however, will not.
Below you will find the different categories of my uses and
disclosures, with some examples.
A. Uses and Disclosures Related to Treatment, Payment, or
Health Care Operations Do Not Require Your Prior Written
Consent. I may use and disclose your PHI without your
consent for the following reasons:
1. For treatment. I can use your PHI within my
practice to provide you with mental health treatment, including
discussing or sharing your PHI with my trainees and
interns. I may disclose your PHI to physicians,
psychiatrists, psychologists, and other licensed health care
providers who provide you with health care services or are
otherwise involved in your care. Example: If a psychiatrist is
treating you, I may disclose your PHI to her/him in order to
coordinate your care.
2. For health care operations. I may disclose your
PHI to facilitate the efficient and correct operation of my
practice. Examples: Quality control - I might use your
PHI in the evaluation of the quality of health care services that
you have received or to evaluate the performance of the health
care professionals who provided you with these
services. I may also provide your PHI to my attorneys,
accountants, consultants, and others to make sure that I am in
compliance with applicable laws.
3. To obtain payment for treatment. I may use and
disclose your PHI to bill and collect payment for the treatment
and services I provided you. Example: I might send your PHI to
your insurance company or health plan in order to get payment for
the health care services that I have provided to you. I could
also provide your PHI to business associates, such as billing
companies, claims processing companies, and others that process
health care claims for my office.
4. Other disclosures. Examples:Your
consent isn't required if you need emergency treatment provided
that I attempt to get your consent after treatment is rendered.
In the event that I try to get your consent but you are unable to
communicate with me (for example, if you are unconscious or in
severe pain) but I think that you would consent to such treatment
if you could, I may disclose your PHI.
B. Certain Other Uses and Disclosures Do Not Require Your
Consent. I may use and/or disclose your PHI without your
consent or authorization for the following reasons:
(The following list is a compilation of federal and California
laws)
1. When disclosure is
required by federal, state, or local law; judicial, board, or
administrative proceedings; or, law
enforcement. Example: I may make a disclosure to the
appropriate officials when a law requires me to report
information to government agencies, law enforcement personnel
and/or in an administrative proceeding.
2. If disclosure is
compelled by a party to a proceeding before a court of an
administrative agency pursuant to its lawful authority.
3. If disclosure is
required by a search warrant lawfully issued to a governmental
law enforcement agency.
4. If disclosure is
compelled by the patient or the patient's representative pursuant
to California Health and Safety Codes or to corresponding federal
statutes of regulations, such as the Privacy Rule that
requires this Notice.
5. To avoid
harm. I may provide PHI to law enforcement personnel or
persons able to prevent or mitigate a serious threat to the
health or safety of a person or the public (i.e., adverse
reaction to meds).
6. If disclosure is
compelled or permitted by the fact that you are in such mental or
emotional condition as to be dangerous to yourself or the person
or property of others, and if I determine that disclosure is
necessary to prevent the threatened danger.
7. If disclosure is
mandated by the California Child Abuse and Neglect Reporting
law. For example, if I have a reasonable suspicion
of child abuse or neglect.
8. If disclosure is
mandated by the California Elder/Dependent Adult Abuse Reporting
law. For example, if I have a reasonable suspicion
of elder abuse or dependent adult abuse.
9. If disclosure is
compelled or permitted by the fact that you tell me of a
serious/imminent threat of physical violence by you against a
reasonably identifiable victim or victims.
10. For public health
activities. Example: In the event of your death,
if a disclosure is permitted or compelled, I may need to give the
county coroner information about you.
11. For health oversight
activities. Example: I may be required to provide
information to assist the government in the course of an
investigation or inspection of a health care organization or
provider.
12. For specific government
functions. Examples: I may disclose PHI of
military personnel and veterans under certain circumstances.
Also, I may disclose PHI in the interests of national security,
such as protecting the President of the United States or
assisting with intelligenceoperations.
13. For research purposes. In
certain circumstances, I may provide PHI in order to conduct
medical research.
14. For Workers' Compensation
purposes. I may provide PHI in order to comply with
Workers' Compensation laws.
15. Appointment reminders and health related
benefits or services. Examples: I may use PHI to provide
appointment reminders. I may use PHI to give you information
about alternative treatment options, or other health care
services or benefits I offer.
16. If an arbitrator or arbitration panel
compels disclosure, when arbitration is lawfully
requested by either party, pursuant to subpoena duces
tectum (e.g., a subpoena for mental health records) or
any other provision authorizing disclosure in a proceeding before
an arbitrator or arbitration panel.
17. If disclosure is required or permitted
to a health oversight agency for oversight activities authorized
by law. Example: When compelled by U.S. Secretary
of Health and Human Services to investigate or assess my
compliance with HIPAA regulations.
18. If disclosure is otherwise specifically
required by law.
C. Certain Uses and Disclosures Require You to
Have the Opportunity to Object.
1. Disclosures to family, friends, or others. I may
provide your PHI to a family member, friend, or other individual
who you indicate is involved in your care or responsible for the
payment for your health care, unless you object in whole or in
part. Retroactive consent may be obtained in emergency
situations.
D. Other Uses and Disclosures Require Your Prior Written
Authorization. In any other situation not described in
Sections IIIA, IIIB, and IIIC above, I will request your written
authorization before using or disclosing any of your PHI. Even if
you have signed an authorization to disclose your PHI, you may
later revoke that authorization, in writing, to stop any future
uses and disclosures (assuming that I haven't taken any action
subsequent to the original authorization) of your PHI by me.
IV. WHAT RIGHTS YOU HAVE REGARDING YOUR PHI
These are your rights with respect to your PHI:
A. The Right to See and Get Copies of Your
PHI. In general, you have the right to see your
PHI that is in my possession, or to get copies of it; however,
you must request it in writing. If I do not have your PHI, but I
know who does, I will advise you how you can get it. You will
receive a response from me within 30 days of my receiving your
written request. Under certain circumstances, I may feel I must
deny your request, but if I do, I will give you, in writing, the
reasons for the denial. I will also explain your right
to have my denial reviewed.
If you ask for copies of your PHI, I will charge you not more
than $.25 per page. I may see fit to provide you with a summary
or explanation of the PHI, but only if you agree to it, as well
as to the cost, in advance.
B. The Right to Request Limits on Uses and Disclosures of Your
PHI. You have the right to ask that I limit how I use
and disclose your PHI. While I will consider your request, I am
not legally bound to agree. If I do agree to your request, I will
put those limits in writing and abide by them except in emergency
situations. You do not have the right to limit the uses and
disclosures that I am legally required or permitted to make.
C. The Right to Choose How I Send Your PHI to You. It
is your right to ask that your PHI be sent to you at an alternate
address (for example, sending information to your work address
rather than your home address) or by an alternate method (for
example, via e-mail instead of by regular mail). I am obliged to
agree to your request providing that I can give you the PHI, in
the format you requested, without undue
inconvenience. I may not require an explanation from
you as to the basis of your request as a condition of providing
communications on a confidential basis.
D. The Right to Get a List of the Disclosures I Have
Made. You are entitled to a list of disclosures of your
PHI that I have made. The list will not include uses or
disclosures to which you have already consented, i.e., those for
treatment, payment, or health care operations, sent directly to
you, or to your family; neither will the list include disclosures
made for national security purposes, to corrections or law
enforcement personnel, or disclosures made before April 15,
2003. After April 15, 2003, disclosure records will be
held for six years.
I will respond to your request for an accounting of disclosures
within 60 days of receiving your request. The list I give you
will include disclosures made in the previous six years unless
you indicate a shorter period. The list will include the date of
the disclosure, to whom PHI was disclosed (including their
address, if known), a description of the information disclosed,
and the reason for the disclosure. I will provide the list to you
at no cost, unless you make more than one request in the same
year, in which case I will charge you a reasonable sum based on a
set fee for each additional request.
E. The Right to Amend Your PHI. If you believe that
there is some error in your PHI or that important information has
been omitted, it is your right to request that I correct the
existing information or add the missing information. Your request
and the reason for the request must be made in writing. You will
receive a response within 60 days of my receipt of your request.
I may deny your request, in writing, if I find that: the PHI is
(a) correct and complete, (b) forbidden to be disclosed, (c) not
part of my records, or (d) written by someone other than me. My
denial must be in writing and must state the reasons for the
denial. It must also explainyour right to file a written
statement objecting to the denial. If you do not file a written
objection, you still have the right to ask that your request and
my denial be attached to any future disclosures of your PHI. If I
approve your request, I will make the change(s) to your PHI.
Additionally, I will tell you that the changes have been made,
and I will advise all others who need to know about the change(s)
to your PHI.
F. The Right to Get This Notice by E-mail. You have
the right to get this notice by e-mail. You have the right to
request apaper copy of it, as well.
V. HOW TO COMPLAIN ABOUT MY PRIVACY PRACTICES
If, in your opinion, I may have violated your privacy rights, or
if you object to a decision I made about access to your PHI, you
are entitled to file a complaint with the person listed in
Section VI below. You may also send a written complaint to the
Secretary of the Department of Health and Human Services at 200
Independence Avenue S.W. Washington, D.C. 20201. If you file a
complaint about my privacy practices, I will take no retaliatory
action against you.
VI. PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO
COMPLAIN ABOUT MY PRIVACY PRACTICES
If you have any questions about this notice or any complaints
about my privacy practices, or would like to know how to file a
complaint with the Secretary of the Department of Health and
Human Services, please contact me at: [insert therapist's
name, address phone number, and e-mail].
VII. NOTIFICATIONS OF BREACHES
In the case of a breach, Maria Victoria Munoz, MC,
LPC requires to notify each affected individual whose
unsecured PHI has been compromised. Even if such a breach was
caused by a business associate, Maria Victoria Munoz, MC,
LPC is ultimately responsible for providing the
notification directly or via the business
associate. If the breach involves more than 500
persons, OCR must be notified in accordance with instructions
posted on its website. Maria Victoria Munoz, MC,
LPC bears the ultimate burden of proof to demonstrate
that all notifications were given or that the impermissible use
or disclosure of PHI did not constitute a breach and must
maintain supporting documentation, including documentation
pertaining to the risk assessment.
VIII. PHI AFTER DEATH
Generally, PHI excludes any health information of a person who
has been deceased for more than 50 years after the date of death.
Maria Victoria Munoz, MC, LPC may disclose deceased
individuals' PHI to non-family members, as well as family
members, who were involved in the care or payment for healthcare
of the decedent prior to death; however, the disclosure must be
limited to PHI relevant to such care or payment and cannot be
inconsistent with any prior expressed preference of the deceased
individual.
IX. INDIVIDUALS' RIGHT TO RESTRICT DISCLOSURES; RIGHT OF
ACCESS
To implement the 2013 HITECH Act, the Privacy Rule is amended.
Maria Victoria Munoz, MC, LPC is required to restrict
the disclosure of PHI about you, the patient, to a health plan,
upon request, if the disclosure is for the purpose of carrying
out payment or healthcare operations and is not otherwise
required by law. The PHI must pertain solely to a healthcare item
or service for which you have paid the covered entity in
full. (OCR clarifies that the adopted provisions do not require
that covered healthcare providers create separate medical records
or otherwise segregate PHI subject to a restrict healthcare item
or service; rather, providers need to employ a method to flag or
note restrictions of PHI to ensure that such PHI is not
inadvertently sent or made accessible to a health plan.)
The 2013 Amendments also adopt the proposal in the interim rule
requiring Maria Victoria Munoz, MC, LPC, to
provide you, the patient, a copy of PHI if you, the patient,
requests it in electronic form. The electronic format must be
provided to you if it is readily producible. OCR clarifies
that Maria Victoria Munoz, MC, LPC must provide
you only with an electronic copy of their PHI, not direct access
to their electronic health record systems. The 2013 Amendments
also give you the right to direct Maria Victoria Munoz,
MC, LPC to transmit an electronic copy of PHI to an
entity or person designated by you. Furthermore, the amendments
restrict the fees that Maria Victoria Munoz, MC,
LPC may charge you for handling and reproduction of PHI,
which must be reasonable, cost-based and identify separately the
labor for copying PHI (if any). Finally, the 2013 Amendments
modify the timeliness requirement for right of access, from up to
90 days currently permitted to 30 days, with a one-time extension
of 30 additional days.
X. NPP
Maria Victoria Munoz, MC, LPC NPP must contain a
statement indicating that most uses and disclosures of
psychotherapy notes, marketing disclosures and sale of PHI do
require prior authorization by you, and you have the right to be
notified in case of a breach of unsecured PHI.
XI. EFFECTIVE DATE OF THIS NOTICE
This notice went into effect on Jan. 30, 2013
I acknowledge the terms of this notice and the privacy practices of
this office.