top of page
hipaa.jpg

HIPAA Compliance and What is it?

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The HIPAA Security Rule protects a subset of information covered by the Privacy Rule.

hippa-compliant.png

HIPAA Privacy Rule 

The Privacy Rule standards address the use and disclosure of individuals’ health information (known as protected health information or PHI) by entities subject to the Privacy Rule. These individuals and organizations are called “covered entities.”

The Privacy Rule also contains standards for individuals’ rights to understand and control how their health information is used. A major goal of the Privacy Rule is to make sure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high-quality healthcare, and to protect the public’s health and well-being. The Privacy Rule permits important uses of information while protecting the privacy of people who seek care and healing.

Unless you give us permission for the following below, we will not disclose your information: 
 
Fundraising
Research

 

Other Uses and Disclosures:  We are permitted and/or required by law to make certain other uses and disclosures of your protected health information without your consent or authorization for the following: 
 
• Any purpose required by law; 
 
• Public health activities such as required reporting of immunizations, disease, injury, birth and death, or in connection with public health investigations; 
 
• If we suspect child abuse or neglect; if we believe you to be a victim of abuse, neglect or domestic violence; 
 
• To the Food and Drug Administration to report adverse events, product defects, or to participate in product recalls; 
 
• To your employer when we have provided health care to you at the request of your employer; 
 
• To a government oversight agency conducting audits, investigations, civil or criminal proceedings; 
 
• Court or administrative ordered subpoena or discovery request; 
 
• To law enforcement officials as required by law if we believe you have been the victim of abuse, neglect or domestic violence.  We will only make this disclosure if you agree or when required or authorized by law; 
 
• To coroners and/or funeral directors consistent with law; 
 
• If necessary to arrange an organ or tissue donation from you or a transplant for you; 
 
• If you are a member of the military, we may also release your protected health information for national security or intelligence activities; and 
 
• To workers' compensation agencies for workers' compensation benefit determination. 

 

DISCLOSURES REQUIRING AUTHORIZATION: 

Psychotherapy Notes:  We must obtain your specific written authorization prior to disclosing any psychotherapy notes unless otherwise permitted by law.  However, there are certain purposes for which we may disclose psychotherapy notes, without obtaining your written authorization, including the following: (1) to carry out certain treatment, payment or healthcare operations (e.g., use for the purposes of your treatment, for our own training, and to defend ourselves in a legal action or other proceeding brought by you), (2) to the A Secretary of the Department of Health and Human Services to determine our compliance with the law, (3) as required by law, (4) for health oversight activities authorized by law, (5) to medical examiners or coroners as permitted by state law, or (6) for the purposes of preventing or lessening a serious or imminent threat to the health or safety of a person or the public. 
 
Genetic Information:  We must obtain your specific written authorization prior to using or disclosing your genetic information for treatment, payment or health care operations purposes.  We may use or disclose your genetic information, or the genetic information of your child, without your written authorization only where it would be permitted by law. 
 
Marketing:  We must obtain your authorization for any use or disclosure of your protected health information for marketing, except if the communication is in the form of (1) a face-to-face communication with you, or (2) a promotional gift of nominal value. 
 
Sale of Protected Information: We must obtain your authorization prior to receiving direct or indirect remuneration in exchange for your health information; however, such authorization is not required where the purpose of the exchange is for:   
 
• Public health activities; 
 
• Research purposes, provided that we receive only a reasonable, cost-based fee to cover the cost to prepare and transmit the information for research purposes; 
 
• Treatment and payment purposes; 
 
• Health care operations involving the sale, transfer, merger or consolidation of all or part of our business and for related due diligence; 
 
• Payment we provide to a business associate for activities involving the exchange of protected health information that the business associate undertakes on our behalf (or the subcontractor undertakes on behalf of a business associate) and the only remuneration provided is for the performance of such activities; 


• Providing you with a copy of your health information or an accounting of disclosures; 
 
• Disclosures required by law; 
 
• Disclosures of your health information for any other purpose permitted by and in accordance with the Privacy Rule of HIPAA, as long as the only remuneration we receive is a reasonable, cost-based fee to cover the cost to prepare and transmit your health information for such purpose or is a fee otherwise expressly permitted by other law; or 
 
• Any other exceptions allowed by the Department of Health and Human Services. 

​

RIGHTS THAT YOU HAVE REGARDING YOUR PROTECTED HEALTH INFORMATION:  
 
Access to Your Protected Health Information: You have the right to copy and/or inspect much of the protected health information that we retain on your behalf.  For protected health information that we maintain in any electronic designated record set, you may request a copy of such health information in a reasonable electronic format, if readily producible.  Requests for access must be made in writing and signed by you or your legal representative.  You may obtain a "Patient Access to Health Information Form" from the front office person. You will be charged a reasonable copying fee and actual postage and supply costs for your protected health information.  If you request additional copies you will be charged a fee for copying and postage. 
 
Amendments to Your Protected Health Information: You have the right to request in writing that protected health information that we maintain about you be amended or corrected. We are not obligated to make requested amendments, but we will give each request careful consideration.  All amendment requests, must be in writing, signed by you or legal representative, and must state the reasons for the amendment/correction request.  If an amendment or correction request is made, we may notify others who work with us if we believe that such notification is necessary.  You may obtain an "Amendment Request Form" from the front office person or individual responsible for medical records. 
 
Accounting for Disclosures of Your Protected Health Information: You have the right to receive an accounting of certain disclosures made by us of your protected health information after April 14, 2003.  Requests must be made in writing and signed by you or your legal representative. "Accounting Request Forms" are available from the front office person or individual responsible for medical records.  The first accounting in any 12-month period is free; you will be charged a fee for each subsequent accounting you request within the same 12-month period.  You will be notified of the fee at the time of your request. 
 
Restrictions on Use and Disclosure of Your Protected Health Information: You have the right to request restrictions on uses and disclosures of your protected health information for treatment, payment, or health care operations.  We are not required to agree to most restriction requests, but will attempt to accommodate reasonable requests when appropriate.  You do, however, have the right to restrict disclosure of your protected health information to a health plan if the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law, and the protected health information pertains solely to a health care item or service for which you, or someone other than the health plan on your behalf, has paid STAR BRIGHT HOME HEALTHin full.  If we agree to any discretionary restrictions, we reserve the right to remove such restrictions as we appropriate.  We will notify you if we remove a restriction imposed in accordance with this paragraph.  You also have the right to withdraw, in writing or orally, any restriction by communicating your desire to do so to the individual responsible for medical records. 
 
Right to Notice of Breach: We take very seriously the confidentiality of our patients’ information, and we are required by law to protect the privacy and security of your protected health information through appropriate safeguards.  We will notify you in the event a breach occurs involving or potentially involving your unsecured health information and inform you of what steps you may need to take to protect yourself. 
 
Paper Copy of this Notice: You have a right, even if you have agreed to receive notices electronically, to obtain a paper copy of this Notice. To do so, please submit a request to the Privacy Officer at the address

below.

 

Complaints:  If you believe your privacy rights have been violated, you can file a complaint in writing with the Privacy Officer.  You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services at the below address.  There will be no retaliation for filing a complaint. 
 

U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Bldg.
Washington, D.C. 20201

​

To report a HIPAA complaint against a health care facility or credentialed professional regulated by DSHS, go to http://www.dshs.texas.gov/hipaa/privacycomplaints.shtm or call 1-800-942-5540.
 
For Further Information:  If you have questions, need further assistance regarding or would like to submit a request pursuant to this Notice, you may contact the Star Bright Home Health Privacy Officer by phone at (000) 000-0000 or at the following address:

​

 
This Notice of Privacy Practices is also available on our Star Bright Home Health web page at www.starbrighthomehealth.com 

bottom of page