HIPAA

Notice of Privacy Practices

As required by the Privacy Regulations created as a result of the Health Insurance Portability and Accountability Act of 1996 (HIPAA)

THIS NOTICE DESCRIBES HOW MEDICAL/HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION.

The effective date of this privacy notice is August 1, 2015
Updated August 28, 2022

At the practice of Washington Aesthetics & MedSpa,  we respect the privacy and confidentiality of your health information.  This Notice of Privacy Practices (“Notice”) describes how we may use and disclose your medical/health information and how you can obtain access to this information.  This Notice applies to uses and disclosures we may make of all your health information whether created or received by us.

This notice applies to the Hospital(s), including its employees and volunteers, its affiliates, members of its Medical Staff and other health care practitioners practicing at the Hospital(s) or practice.  These entities are an Organized Health Care Arrangement for purposes of information sharing only.  These entities are independent of one another and nothing in this Notice should be construed to create or imply any agency, partnership, or joint venture between the entities.

We are required by law to:

1. Maintain the privacy of your health information and to provide you with notice of our legal duties and privacy practices.
2. Comply with the terms of our Notice currently in effect.

We reserve the right to change our practices and to make the new provisions effective for all health information we maintain, including both health information we already have and health information we create or receive in the future.  Should we make material changes, we will make the revised Notice available at the locations patients are registered and will be provided to all patients at their next encounter after the revision with the Hospital(s) or practice.

DISCLOSURER OF YOUR HEALTH INFORMATION FOR TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS

We may use and disclose your health information for purposes of treatment, payment, and health care operations as described below.

1. For Treatment.  We may use and disclose your health information to provide you with treatment and services and to coordinate your continuing care.  Your health information may be used by doctors and nurses, as well as by lab technicians, dieticians, physical therapists, or other personnel involved in your care, both within the Hospital(s) or practice, and with other health care providers involved in your care. For example, a pharmacist will need certain information to fill a prescription ordered by your doctor.  We may also disclose your health information to persons or facilities that will be involved in your care after you leave the Hospital(s) or practice.
2. For Payment.  We may use and disclose your health information so that we can bill and receive payment for the treatment and services you receive.  For billing and payment purposes, we may disclose your health information to an insurance or when applying for credit. Example care credit.
3. For Health Care Operations.  We may use and disclose your health information as necessary for our internal operations, such as for general administration activities and to monitor the quality of care you receive from us.  For example, we may use your health information to evaluate and improve the quality of care you received, for education and training purposes, and for planning for services.  Health information may be used to evaluate our employees and to review the qualifications and practices of doctors and other practitioners at the Hospital(s) or practice.

OTHER USES AND DISCLOSURES 

The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (“HHS”) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). 1 The Privacy Rule standards address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals’ privacy rights to understand and control how their health information is used. Within HHS, the Office for Civil Rights (“OCR”) has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties. A major goal of the Privacy Rule is to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well being.
The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing. Given that the health care marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed.

This is a summary of key elements of the Privacy Rule and not a complete or comprehensive guide to compliance. Entities regulated by the Rule are obligated to comply with all of its applicable requirements and should not rely on this summary as a source of legal information or advice. To make it easier for entities to review the complete requirements of the Rule, provisions of the Rule referenced in this summary are cited in notes at the end of this document. To view the entire Rule, and for other additional helpful information about how it applies, see the OCR website: https://www.hhs.gov/ocr/hipaa.

In the event of a conflict between this summary and the Rule, the Rule governs.
Links to the OCR Guidance Document are provided throughout this paper. Provisions of the Rule referenced in this summary are cited in endnotes at the end of this document. To review the entire Rule itself, and for other additional helpful information about how it applies, see the OCR website: https://www.hhs.gov/ocr/hipaa.

Statutory & Regulatory Background

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, was enacted on August 21, 1996. Sections 261 through 264 of HIPAA require the Secretary of HHS to publicize standards for the electronic exchange, privacy and security of health information. Collectively these are known as the Administrative Simplification provisions. HIPAA required the Secretary to issue privacy regulations governing individually identifiable health information, if Congress did not enact privacy legislation within OCR Privacy Rule Summary 2 Last Revised 05/03 three years of the passage of HIPAA. Because Congress did not enact privacy legislation, HHS developed a proposed rule and released it for public comment on November 3, 1999. The Department received over 52,000 public comments. The final regulation, the Privacy Rule, was published December 28, 2000.2 In March 2002, the Department proposed and released for public comment modifications to the Privacy Rule. The Department received over 11,000 comments. The final modifications were published in final form on August 14, 2002.3 A text combining the final regulation and the modifications can be found at 45 CFR Part 160 and Part 164, Subparts A and E on the OCR website:

https://www.hhs.gov/ocr/hipaa.

Who is Covered by the Privacy Rule

The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA (the “covered entities”). For help in determining whether you are covered, use the decision tool at:

https://www.cms.hhs.gov/hipaa/hipaa2/support/tools/decisionsupport/default.asp.

Health Plans. Individual and group plans that provide or pay the cost of medical care are covered entities.4 Health plans include health, dental, vision, and prescription drug insurers, health maintenance organizations (“HMOs”), Medicare, Medicaid, Medicare+Choice and Medicare supplement insurers, and long-term care insurers (excluding nursing home fixed-indemnity policies). Health plans also include employer-sponsored group health plans, government and church-sponsored health plans, and multi-employer health plans. There are exceptions—a group health plan with less than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity. Two types of government funded programs are not health plans: (1) those whose principal purpose is not providing or paying the cost of health care, such as the food stamps program; and (2) those programs whose principal activity is directly providing health care, such as a community health center,5 or the making of grants to fund the direct provision of health care. Certain types of insurance entities are also not health plans, including entities providing only workers’ compensation, automobile insurance, and property and casualty insurance.

Health Care Providers. Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include claims, benefit eligibility inquiries, referral authorization requests, or other transactions for which HHS has established standards under the HIPAA Transactions Rule.6 Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction. The Privacy Rule covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Health care providers include all “providers of services” (e.g., institutional providers such as hospitals) and “providers of medical or health services” (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for health care.

What Information is Protected Protected Health Information. The Privacy Rule protects all “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information “protected health information (PHI).”12 OCR Privacy Rule Summary 4 Last Revised 05/03 “Individually identifiable health information” is information, including demographic data, that relates to:

• the individual’s past, present or future physical or mental health or condition,
• the provision of health care to the individual, or
• the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual.13 Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number).

The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g.

De-Identified Health Information. There are no restrictions on the use or disclosure of de-identified health information.14 De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: 1) a formal determination by a qualified statistician; or 2) the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.15

Basic Principle. A major purpose of the Privacy Rule is to define and limit the circumstances in which an individual’s protected heath information may be used or disclosed by covered entities. A covered entity may not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing.16

Required Disclosures. A covered entity must disclose protected health information in only two situations: (a) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their protected health information; and (b) to HHS when it is undertaking a compliance investigation or review or enforcement action.17 See OCR “Government Access” Guidance.

Permitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and OCR Privacy Rule Summary 5 Last Revised 05/03

(6) Limited Data Set for the purposes of research, public health or health care operations.18 Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.

(1) To the Individual. A covered entity may disclose protected health information to the individual who is the subject of the information.

(2) Treatment, Payment, Health Care Operations. A covered entity may use and disclose protected health information for its own treatment, payment, and health care operations activities.19 A covered entity also may disclose protected health information for the treatment activities of any health care provider, the payment activities of another covered entity and of any health care provider, or the health care operations of another covered entity involving either quality or competency assurance activities or fraud and abuse detection and compliance activities, if both covered entities have or had a relationship with the individual and the protected health information pertains to the relationship. See OCR “Treatment, Payment, Health Care Operations” Guidance.

Treatment is the provision, coordination, or management of health care and related services for an individual by one or more health care providers, including consultation between providers regarding a patient and referral of a patient by one provider to another.20

Payment encompasses activities of a health plan to obtain premiums, determine or fulfill responsibilities for coverage and provision of benefits, and furnish or obtain reimbursement for health care delivered to an individual21 and activities of a health care provider to obtain payment or be reimbursed for the provision of health care to an individual.

Health care operations are any of the following activities: (a) quality assessment and improvement activities, including case management and care coordination; (b) competency assurance activities, including provider or health plan performance evaluation, credentialing, and accreditation; (c) conducting or arranging for medical reviews, audits, or legal services, including fraud and abuse detection and compliance programs; (d) specified insurance functions, such as underwriting, risk rating, and reinsuring risk; (e) business planning, development, management, and administration; and (f) business management and general administrative activities of the entity, including but not limited to: de-identifying protected health information, creating a limited data set, and certain fundraising for the benefit of the covered entity.22 Most uses and disclosures of psychotherapy notes for treatment, payment, and health care operations purposes require an authorization as described below.23 Obtaining “consent” (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities.24 The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent.

FACILITY DIRECTORIES. IT IS A COMMON PRACTICE IN MANY HEALTH CARE FACILITIES, SUCH AS HOSPITALS, TO MAINTAIN A DIRECTORY OF PATIENT CONTACT INFORMATION. A COVERED HEALTH CARE PROVIDER MAY RELY ON AN INDIVIDUAL’S INFORMAL PERMISSION TO LIST IN ITS FACILITY DIRECTORY THE INDIVIDUAL’S NAME, GENERAL CONDITION, RELIGIOUS AFFILIATION, AND LOCATION IN THE PROVIDER’S FACILITY.25 THE PROVIDER MAY THEN DISCLOSE THE INDIVIDUAL’S CONDITION AND LOCATION IN THE FACILITY TO ANYONE ASKING FOR THE INDIVIDUAL BY NAME, AND ALSO MAY DISCLOSE RELIGIOUS AFFILIATION TO CLERGY. MEMBERS OF THE CLERGY ARE NOT REQUIRED TO ASK FOR THE INDIVIDUAL BY NAME WHEN INQUIRING ABOUT PATIENT RELIGIOUS AFFILIATION.