Purpose:
The Cancer Education and Research
Foundation of Texas is committed to compliance with all federal
and state laws that pertain to any aspect of the clinical
practices or business procedures of this office. In particular,
privacy and security rules relating to the Health Insurance
Portability and Accountability Act (HIPAA), along with related
state laws, are integral to matters of privacy, medical records,
the confidentiality of communications, and other topics
addressed throughout this manual.
Policy:
The HIPAA Privacy Rule applies to all
protected health information (PHI) in this office, including
information stored and transmitted electronically, paper
records, and oral communications. PHI includes any information
as it relates to the past, present, or
future physical or mental health condition of any of our
patients; any treatment they have received; and health care
payment information.
·
In keeping with HIPAA
compliance, this office has appointed a privacy officer to
continually evaluate our privacy practices, train our staff
about privacy issues, supervise the sharing of information with
third parties, and address any complaints from patients, their
friends, and loved ones; staff; other providers; and members of
the community. See Privacy Officer policy and procedure.
·
All staff members will
be trained on this policy and procedure manual, which will help
ensure that the procedures in effect in our office are in
keeping with state and federal law. The privacy officer is
responsible for training of staff, as well as continual review
and amendment of this manual as necessary.
·
A Notice of Privacy
Practices is reviewed by all patients to increase
understanding of how their PHI is stored, used, and shared
beyond this practice, and to notify them of their new rights
created under HIPAA. See Patient Notice of Privacy Practices
policy and procedure.
·
Under all
circumstances, when PHI must be communicated either within this
office or to a third party, only the amount of information that
is minimally necessary to accomplish the appropriate purpose
will be divulged. The privacy officer is responsible for
establishing criteria on what information is minimally necessary
for recurring situations. Unusual or unique needs to share
information will be conveyed to the privacy officer for
approval. See Privacy Officer policy and procedure.
·
PHI that is shared as
part of delivering quality patient care will not be scrutinized
under the minimally necessary guidelines, and any information
necessary for quality care will be shared appropriately.
Only those medical records and files that are immediately
necessary for patient care are to be kept at workstations. |
