Notice of Privacy Practices
Policy Number OLHS.CP.014
Date of Issue June 2019
This policy provides guidelines for Ochsner LSU Health Shreveport (OLHS)’s Notice of Privacy Practice (NPP) as described within the Health Insurance Portability and Accountability Act (HIPAA).
This policy applies to all those engaged to perform work at Ochsner LSU Health Shreveport (OLHS) including, but not limited to, employees, part-time and temporary workers, physicians, residents, fellows, medical students, advanced practice providers, volunteers, community and OLHS-appointed physicians & residents, students, contracted staff, business associates and third-party personnel (contactors and sub-contractors) engaged to perform work for OLHS (Workforce members).
A. Business Associate– Organizations or individuals who perform some function or service for OLHS that requires them to have access to our patients’ protected health information. Common examples of Business Associates include, but are not limited to, accounting, consulting, bill collection, attorneys representing OLHS, peer review, language translation/interpretation, accreditation, quality assurance, utilization review, and claims processing.
IV. Policy Statements
A. OLHS will provide patients with a NPP regarding the use or disclosure of protected health information (PHI) at the first service delivery date which includes services delivered by phone, through a screening, electronically, or at any time upon request. Further, OLHS maintains an up to date copy of its NPP in a readily accessible location on its website.
B. OLHS’s NPP will be written in plain language and will include all the elements as required by HIPAA and more fully described within this policy.
C. The NPP will be promptly revised and distributed whenever there is a material change to OLHS use or disclosure policy, the individual’s rights, OLHS legal duties, or other privacy practices stated in the NPP.
1. OLHS will make the revised NPP available upon request on or after the effective date of the revision.
2. OLHS will also post the revised NPP in clear and prominent locations.
V. Procedures/Standards and Roles & Responsibilities
A. As outlined under HIPAA, any OLHS NPP must contain the following elements:
1. A header that reads as follows: “This Notice Describes How Medical Information About You May Be Used And Disclosed And How You Can Get Access To This Information. Please Review It Carefully.”
2. A description and at least one example of the types of uses and disclosures OLHS is permitted by HIPAA to make for treatment, payment, and health care operations.
a. The description and example of disclosures made for treatment purposes should include examples of OLHS participation in any organized health care arrangement (OHCA) or any health data exchange.
3. A description of each of the purposes for which OLHS is permitted or required by regulation to use or disclose PHI without the individual’s written authorization.
4. A description of the types of uses and disclosures with regards to psychotherapy notes, marketing, and sale of PHI that require an authorization.
5. A statement that other uses and disclosure will be made only with the individual’s written authorization and that the individual may revoke such authorization in writing at any time.
6. A statement that OLHS intends to engage in the following activities:
a. Appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to the individual.
i. If OLHS is receiving financial remuneration in exchange for the marketing of the treatment alternatives or health-related services, the notice must state that the individual has the right to opt out.
b. Fundraising– notice must state that the individual has the right to opt out of receiving fundraising communications.
7. A statement regarding the individual’s rights with respect to PHI and a brief description of how those rights may be exercised. These rights include:
a. Right to request a restriction on certain uses and disclosures of PHI.
i. The NPP should include a statement that OLHS is not required to agree to a requested restriction.
ii. The NPP should explain that OLHS cannot refuse a request for a restriction to a health plan if the patient has paid for the service out-of-pocket in full.
b. Right to receive confidential communications of PHI.
c. Right to inspect and copy PHI.
d. Right to request amendment of PHI.
e. Right to receive an accounting of certain disclosures of PHI.
f. Right to obtain a paper copy of the NPP from OLHS upon request.
8. Statements regarding OLHS duties to:
a. Maintain the privacy of PHI as required by law and to provide notice of these duties to individuals.
b. Abide by the terms of the NPP currently in effect.
c. Change the terms of our NPP and make the new notice provisions effective for all PHI OLHS maintains.
i. The statement must also describe how individuals may obtain a revised notice.
9. A statement regarding how an individual may file a complaint with OLHS or the United States Secretary of Health and Human Services.
10. The contact information for OLHS.
11. The effective date of the NPP.
B. OLHS Workforce members must provide patients, with whom OLHS has a direct treatment relationship, the NPP as follows:
1. No later than the first service delivery date
2. On request by the patient
C. OLHS Workforce members must make a good faith effort to obtain a signed NPP Acknowledgment from the individual.
1. If the individual will not accept the NPP when offered, the Workforce member should document the reason for refusal in the patient’s medical record.
D. When providing the NPP to an individual by electronic means, OLHS Workforce members will ensure the individual agrees to receive the NPP electronically and such agreements have not been withdrawn.
E. OLHS will provide the NPP at community health screenings and similar public service programs when an individually identifiable record is created and maintained by a Workforce member.
F. OLHS will make the NPP available to patients at the service delivery site.
G. OLHS will post the NPP in a clear and prominent location where it is reasonable to expect individuals seeking service to read it.
H. OLHS will prominently post and make available the NPP on any OLHS website that provides information about services or benefits.
I. OLHS will scan the NPP written acknowledgment into the patient’s medical record.
VI. Enforcement and Exceptions
Failure to comply with this policy may result in progressive discipline up to and including termination of employment for employees or termination of contract or service for third party personnel, students or volunteers.
VII. Internal References
Ochsner LSU Health Shreveport’s Notice of Privacy Practices
VIII. External References
45 C.F.R. 164.520
Adopted from OHS.CP.031 Notice of Privacy Practices
IX. Policy History
UH COMP 214 Use and Disclosures Consistent with Notice
UH COMP 217 Disclosures by Whistleblowers and Workforce Member Crime Victims
UH COMP 236 Right to Notice of Privacy Practices
This section intentionally left blank.
Eugenia Stark Thomas, Compliance Officer
Nicole C. Owens, Compliance Officer
OLHS Policy Committee, 5/30/2019