Harris County - Office of Human Resources & Risk Management

Notice of Privacy Practices (HIPAA)

NOTICE OF PRIVACY RIGHTS – HEALTH CARE RECORDS

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU

MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

This statement gives you advice required by law. This Notice is effective as of April 14, 2003 and applies to health information the Harris County Health-Benefits Plan (the "Plan") receives about you. You may receive similar notices about your medical information and how other plans or insurers handle it.

The Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA") mandated the issuance of regulations to protect the privacy of individually identifiable health information which were issued at 45 CFR Parts 160 through 164 (the "Privacy Regulations"). This statement is not a consent or an authorization form. We will not use this form to release or use your health-care information in any manner that is not permitted by the Privacy Regulations.

This Notice is for participants and beneficiaries in the Plan. As a participant or beneficiary of the Plan, you are entitled to receive this Notice of the Plan's privacy procedures with respect to your health information that the Plan creates or receives (your "Protected Health Information" or "PHI"). This Notice is intended to inform you about how we will use or disclose your PHI, your privacy rights with respect to PHI, our duties with respect to your PHI, your right to file a complaint with us or with the Secretary of the United States Health and Human Services (“HHS”), and our office to contact for further information about our privacy practices. We may make the following uses and disclosures of your PHI:

We may use or disclose your PHI to obtain payment, including disclosures for coordination of benefits paid with other plans and medical payment coverages, disclosures for subrogation in order for us to pursue recovery of benefits paid from parties who caused or contributed to your injury or illness, disclosures to determine if your claims for benefits are covered under our Plan, are medically necessary, experimental or investigational, and disclosures to obtain reimbursement under insurance, reinsurance, stop-loss or excessive-loss policies providing reimbursement for the benefits paid under our Plan on your behalf.
We may also disclose your PHI to other health plans maintained by Harris County, which sponsors our Plan, for any of the purposes described above, if our Plan is part of an organized health-care arrangement with the other plan.
We may use or disclose your PHI for purposes of treating you. For example, if your doctor requests information on what other drugs you are currently receiving, we will provide that information.
We may use your PHI as part of the Plan's health-care operations. Health-care operations include quality assurance, underwriting and premium rating to obtain renewal coverage, and other activities related to creating, renewing, or replacing the contract of health insurance or health benefits or securing or placing a contract for reinsurance of risk, including stop-loss insurance, reviewing the competence and qualification of health-care providers, conducting cost-management and quality-improvement activities, and customer service and resolution of internal grievances.
The Plan may also be required to disclose or use your PHI for certain other purposes. These purposes include uses or disclosures that are required by law. For example, if the Plan receives a court order requiring disclosure of your information, we must provide it to the court. Also, we must provide your PHI if you have certain types of wounds that require reporting, or if we are required to disclose your PHI to comply with a court order, a warrant, a subpoena, a summons, or a grand jury subpoena.
The Plan may disclose your PHI as authorized by you or your representative and to the extent necessary to comply with laws relating to workers' compensation and similar programs providing benefits for work-related injuries or illnesses if either (1) the health-care provider provides health care to you at the request of your employer to determine if you have a work-related illness or injury, or to provide medical surveillance of the workplace and the health-care provider is employed by the employer; or (2) if your employer is a health-care provider and the health-care provider is a member of the employer's work force; or (3) you authorize the disclosure in writing. If you authorize the disclosure, we will give you a copy of any authorization you sign.
We will make any other use or disclosure of your PHI only with your written authorization. You may revoke that authorization in writing. However, your revocation cannot be effective to the extent that we have already taken any action relying on your authorization for disclosure. You may not revoke your authorization if your authorization is a condition for obtaining insurance coverage and any law provides the insurer with the right to contest a claim under the policy or the policy itself.
Your PHI may be used so that the Plan, or one of its contracted service providers, may contact you to provide appointment reminders, information on treatment alternatives, or other health-related benefits and services that may be of interest to you, such as case management, disease management, wellness programs, or employee assistance programs. We may provide PHI to Harris County provided Harris County has certified it will not use your PHI for any other employee benefit plans or employment related activities.
We may disclose your PHI to refer you to case management or to a pharmacy benefit manager.
We may disclose your PHI to vendors who work with us regarding other types of products that are available for marketing purposes. This type of disclosure may only be made with your authorization.
We may also disclose your PHI for underwriting, premium rating, and other activities with respect to creating, renewing, and replacing the Harris County health-insurance contract or health-benefit coverage, including creating, renewing, and replacing stop-loss or excess-loss insurance coverage.

Rights You May Exercise –You Have the Right to Request:

restrictions on certain uses and disclosures of your PHI in writing. However, we are not required to agree to any restriction you may request.
access to your PHI and to inspect and copy your PHI under the policies and procedures we have established.
amendment to your PHI under the policies and procedures we have established.
accounting of any disclosures we make of your PHI, other than those for payment, treatment, and health-care operations.
obtain a paper copy of this Notice of Privacy Practices.
to receive confidential communications of your PHI. If you clearly state that disclosure of all or part of your PHI could endanger you, we may provide your PHI to you at a location you specify or by the means you request.
to inspect a copy of your PHI, other than psychotherapy notes and any information compiled in reasonable anticipation of or for use in civil, criminal, or administrative actions or proceedings. You also have the right to request to inspect a copy of your PHI that is maintained by a covered entity that is a clinical laboratory. Psychotherapy notes are separately filed notes about your conversations with your mental-health professional during a counseling session. Psychotherapy notes do not include summary information about your mental health treatment.

Other Uses or Disclosures of Protected Health Information

Uses and disclosures that require that you be given an opportunity to agree or disagree before the use or release:

Disclosure of your PHI to family members, other relatives and your close personal friends is allowed if:

the information is directly relevant to the family or friend's involvement with your care or payment for that care; and
you have either agreed to the disclosure or have been given an opportunity to object but have not objected.

Uses and disclosures for which authorization or opportunity to object is not required:

Use and disclosure of your PHI is allowed without your authorization or any opportunity to agree or object under the following circumstances:

When required by law.
When permitted for purposes of public-health activities, including when necessary to report product defects, to permit product recalls, and to conduct post-marketing surveillance. PHI may also be used or disclosed if you have been exposed to a communicable disease or are at risk of spreading a disease or condition, if authorized or required by law.
When authorized or required by law to report information about abuse, neglect, or domestic violence to public authorities if there exists a reasonable belief that you may be a victim of abuse, neglect, or domestic violence. In such case, we may inform you that such a disclosure has been or will be made unless that notice would cause a risk of serious harm. Disclosure may generally be made to the minor's parents or other representatives, although there may be circumstances under federal or state law when the parents or other representatives may not be given access to a minor's PHI.
The Plan may disclose your PHI to a public health oversight agency for oversight activities authorized or required by law. This includes uses or disclosures in civil, administrative or criminal investigations; inspections; licensure or disciplinary actions (for example, to investigate complaints against providers); and other activities necessary for appropriate oversight of government benefit programs (for example, to investigate Medicare or Medicaid fraud).
The Plan may disclose your PHI when required for judicial or administrative proceedings. For example, your PHI may be disclosed in response to a subpoena or discovery request provided certain conditions are met. One of those conditions is that satisfactory assurances must be given to the Plan that the requesting party has made a good faith attempt to provide written notice to you so that you could object, but that you either raised no objection or the court or tribunal resolved your objections in favor of disclosure.
When required for law enforcement purposes (for example, to report certain types of wounds), the Plan may disclose PHI.
For law enforcement purposes, including for the purpose of identifying or locating a suspect, fugitive, material witness or missing person, the Plan may disclose PHI. The Plan may disclose information about an individual who is or is suspected to be a victim of a crime, but only if the individual agrees to the disclosure, or the Plan is unable to obtain the individual's agreement because of emergency circumstances. Furthermore, the law enforcement official must represent that your PHI is not intended to be used against you, the immediate law enforcement activity would be materially and adversely affected by waiting to obtain your agreement, and disclosure is in your best interest as determined by the exercise of the Plan's best judgment.
When required to be given to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death or other duties as authorized or required by law, the Plan will disclose PHI. Also, disclosure is permitted to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent.
The Plan may use or disclose PHI for research, subject to certain conditions.
When consistent with applicable law and standards of ethical conduct, if the Plan, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the disclosure is to a person reasonably able to prevent or lessen the threat, including the target of the threat.
When authorized by and to the extent necessary to comply with workers' compensation or other similar programs established by law.

Except as otherwise indicated in this Notice, we will use and disclose our PHI only with your written authorization subject to your right to revoke such authorization.

Rights of Individuals

Right to Request Restrictions on PHI Uses and Disclosures

You may request that we restrict uses and disclosures of your PHI to carry out treatment, payment, or health care operations, or to restrict uses and disclosures to family members, relatives, friends, or other persons identified by you who are involved in your care or payment for your care. However, we are not required to agree to your request.

We will accommodate reasonable requests to receive communications of PHI by alternative means or at alternative locations.

We require that you or your personal representative complete a form to request restrictions on uses and disclosures of your PHI. Such requests should be made to the following officer: Ms. Krista Britt, Harris County Privacy Officer, Human Resources and Risk Management, 1310 Prairie, 4^th Floor, Houston, Texas 77002, 713/755-5349.

Right to Inspect and Copy PHI

You have a right to inspect and obtain a copy of your PHI contained in a "designated record set," for as long as we have it.

"Designated Record Set" includes your medical records and billing records that are maintained by or for a covered health-care provider; or for enrollment, payment, billing, claims adjudication; and case or medical-management record systems maintained by or for us. It also includes other information we use, in whole or in part, to make decisions about you. Information used for quality control or peer review analyses and not used to make decisions about individuals is not in the designated record set.

The requested information will be provided within 30 days if the information is maintained on site or within 60 days if the information is maintained offsite. A single 30-day extension is allowed if the Plan is unable to comply with the deadline.

You or your personal representative will be required to complete a form to request access to the Protected Health Information in your designated record set. Requests for access to your PHI should be made to Krista Britt at the address given above.

If we deny you access to your PHI, we will give you or your personal representative a letter telling you why. We will also tell you how to request a review and how to complain to the Secretary of the U.S. Department of Health and Human Services.

Right to Amend

You have the right to ask us to amend your PHI or a record about you in a designated record set for as long as your PHI is maintained in the designated record set.

We ordinarily have 60 days to act on your request. However, we get a single 30-day extension if we are unable to comply with the 60-day deadline. If we deny your request to amend your PHI, in whole or part, we must provide you with a written denial letter explaining why. You or your personal representative may then submit a written statement to us disagreeing with the denial. We will include your statement with any future disclosures of your PHI.

Requests to PHI in a designated record set should be made to Krista Britt at the address given above.

You or your personal representative must complete an amendment-request form and give us a reason why we should amend your PHI.

The Right to Receive an Accounting of Protected Health Information Disclosures

At your request, we will also provide you with an accounting of our disclosures of your PHI during the six years before the date of your request. However, this accounting need not include PHI disclosures made: (1) to carry out treatment, payment, or health-care operations; (2) to you about your own PHI; (3) validly authorized; (4) incident to a use or disclosure permitted or required under the Privacy Regulations; (5) as part of a limited-data set; or (6) before April 14, 2003.

If we cannot give you an accounting within 60 days, we tell you why and give you a date, within an additional 30 days by which we will give you the accounting. If you request more than one accounting within a 12-month period, we will charge a reasonable, cost-based fee for each subsequent accounting.

The Right to Receive a Paper Copy of This Notice Upon Request

To obtain a paper copy of this Notice, contact your payroll coordinator or human resources representative.

A Note About Personal Representatives

You may exercise your rights through a personal representative. Your personal representative must give us evidence of his/her authority to act on your behalf before we will give him/her access to your PHI or allow her/her to take any action for you. Proof of such authority may take several forms authorized by Texas law including:

a power of attorney for health-care purposes;
a court order of appointment as a conservator or guardian; or
an individual who is the parent of a minor child.

We retain discretion to deny a personal representative access to your PHI in order to protect you from abuse or neglect. Our discretion also applies to personal representatives of minors.

You have a right to request an amendment to your PHI. However, we may deny your request. You may appeal our denial.

You have the right to receive an accounting of any disclosures we made of your PHI excluding disclosures or uses for payment, treatment, or health care operations.

You have a right to receive a paper copy of this Notice. We are required by law to maintain the privacy of your PHI and to notify you of our legal duties and privacy practices with respect to your PHI.

We are required to abide by the terms of this Notice or any subsequent Notice that replaces it. We reserve the right to make changes to any of our privacy policies and practices described in this Notice and to apply such changes to all PHI we maintain. Any PHI that we previously received or created will be subject to the revised policies and practices. We may make changes applicable to all PHI we receive or maintain.

We will post or distribute any revised version of this Notice within 60 days of the effective date of any material change that effects uses or disclosures of PHI, your rights, our duties, or privacy practices stated in this Notice.

Minimum Necessary Standard

When using or disclosing PHI or when requesting PHI from another covered entity, we will make reasonable efforts not to use, disclose, or request more than the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request, taking into consideration practical and technological limitations.

However, the minimum necessary standard will not apply in the following situations:

disclosures to or requests by a health-care provider for treatment;
uses or disclosures of your PHI made to you;
disclosures made to the Secretary of the U.S. Department of Health and Human Services;
uses or disclosures required by law;
uses or disclosures required for our compliance with regulations; and
uses and disclosures validly authorized.

This Notice does not apply to information that has been de-identified. De-identified information does not identify anyone individually and there is no reasonable basis to believe that the information can be used to identify an individual.

In addition, we may use or disclose "summary health information" to Harris County for obtaining premium bids, or for modifying, amending, or terminating the Harris County group health plan. “Summary health information” summarizes claims history, claims expenses, or type of claims experienced by individuals for whom Harris County has provided health benefits under a group health plan; and from which identifying information has been deleted.

In addition, we may use or disclose a "Limited Data Set" when we have a Limited Data Set agreement with the recipient of information. We do not need to include our disclosures of a Limited Data Set in any accounting of disclosures of your PHI.

You have the right to file a complaint with us or with the Secretary of the United States Health and Human Services if you believe that your privacy rights have been violated. You may file a complaint with your department privacy official or with Ms. Krista Britt, Harris County Health Plan Privacy Officer, Human Resources and Risk Management, 1310 Prairie, 4^th Floor, Houston, Texas 77002, 713/755-5349. Your written complaint should describe the violation and when it occurred. We will not retaliate against you for filing a complaint. Each department’s privacy official maintains copies of all Privacy Policies for your review. You may access the list of department privacy officials on the County’s website, Human Resources and Risk Management page.

You may also file a complaint with the Office of Civil Rights of the Department of Health and Human Services at 200 Independence Avenue S.W., Room 515F, HHH Building, Washington, DC 20201, or at the appropriate regional office of the Office of Civil Rights of the U.S. Department of Health and Human Services, within 180 days of any alleged violation. If you would like to receive further information, you should contact Ms. Krista Britt, Harris County Health Plan Privacy Officer, Human Resources and Risk Management, 1310 Prairie, 4^th Floor, Houston, Texas 77002, 713/755-5349. This Notice will first be in effect on April 14, 2003 and shall remain in effect until you are notified of any changes, modifications or amendments.