Anne Miniter McKay NCC, LPC
487 B Carlisle Drive, Herndon, VA 20170
Notice of privacy practices with links to relevant to your protected health information (PHI):
(1) Virginia laws related to privacy practices and (2) HIPPA rights and responsibilities
(1) Virginia laws related to privacy practices
I. Confidentiality: Uses and Disclosures of Information Requiring Your Authorization or Consent. As a rule, I will disclose no information about you, or the fact that you are my patient, without your written consent. My formal Mental Health Record describes the services provided to you and contains the dates of our sessions, your diagnosis, functional status, symptoms, prognosis and progress, and any psychological testing reports. Health care providers are legally allowed to use or disclose records or information for treatment, payment, and health care operations purposes. However, I do not routinely disclose information in such circumstances, so I will require your permission in advance, either through your consent at the onset of our relationship (by signing an associated general consent form), or through your written authorization at the time the need for disclosure arises. You may revoke your permission, in writing, at any time, by contacting me.
II. “Limits of Confidentiality:”
Possible Uses and Disclosures of Mental Health Records without Consent or Authorization. There are some important exceptions to this rule of confidentiality – some exceptions created voluntarily by my own choice, [some because of policies in this office/agency], and some required by law. If you wish to receive mental health services from me, you must sign the attached form indicating that you understand and consent to accept my policies about confidentiality and its limits. We will discuss these issues now, but you may reopen the conversation at any time during our work together. I may use or disclose records or other information about you without your consent or authorization in the following circumstances, either by policy, or because legally required:
· Emergency If you are involved in in a life-threatening emergency and I cannot ask your permission, I will share information if I believe you would have wanted me to do so, or if I believe it will be helpful to you.
· Child Abuse Reporting: If I have reason to suspect that a child is abused or neglected, I am required by Virginia law to report the matter immediately to the Virginia Department of Social Services ( § 63.2-1509 ).
· Adult Abuse Reporting: If I have reason to suspect that an elderly or incapacitated adult is abused, neglected or exploited, I am required by Virginia law to immediately make a report and provide relevant information to the Virginia Department of Welfare or Social Services ( § 63.2-1606 ).
· Health Oversight: [For licensed psychologists and social workers:] Virginia law requires that I report misconduct by a mental health care provider of my own profession. By policy, I also reserve the right to report misconduct by health care providers of other professions. By law, if you describe unprofessional conduct by another mental health provider of any profession, I am required to explain to you how to make a report to the licensing board ( § 54.1-2400.4 ). If you are yourself a health care provider, I am required by law to report to your licensing board if I believe your condition places the public at risk ( § 54.1-2400.7 ). Virginia Licensing Boards have the power, when necessary, to subpoena relevant records for investigating a complaint of provider incompetence or misconduct.
· Court Proceedings: If you are involved in a court preceding and a request is made for information about your diagnosis and treatment and the records thereof, such information is privileged under state law, and I will not release information unless you provide written authorization or a judge issues a court order (§ 8.01-399; § 8.01-400.2 ). If I receive a subpoena for records or testimony, I will notify you so that you (or your attorney, or I ) can file a motion to quash (block) the subpoena and can give reasons why I think your records should be protected from disclosure. However, while awaiting the judge’s decision, I am required to place said records in a sealed envelope and provide them to the Clerk of Court. NOTE: In Virginia civil court cases, therapy information or records are not protected by patient-therapist privilege in child abuse cases, in cases in which your mental health is an issue (e.g., if you sue someone for mental/emotional damages), or in any case in which the judge deems the information to be “necessary for the proper administration of justice.” In criminal cases, Virginia has no statute granting therapist-patient privilege, although records can sometimes be protected on another basis. Protections of privilege may not apply if I do an evaluation for a third party or where the evaluation is court- ordered. You will be informed in advance if this is the case.
· Serious Threat to Health or Safety: Under Virginia law, if I am engaged in my professional duties and you communicate to me a specific and immediate threat to cause serious bodily injury or death, to an identified or to an identifiable person, and I believe you have the intent and ability to carry out that threat immediately or imminently, I am legally required to take steps to protect third parties ( § 54.1-2400.1 ). These precautions may include 1) warning the potential victim(s), or the parent or guardian of the potential victim(s), if under 18, 2) notifying a law enforcement officer, or 3) seeking your hospitalization. By my own policy, I may also use and disclose medical information about you when necessary to prevent an immediate, serious threat to your own health and safety. If you become a party in a civil commitment hearing, I can be required to provide your records to the magistrate, your attorney or guardian ad litem, a CSB evaluator, or law enforcement officer, whether you are a minor ( § 16.1-337 ) or an adult (§ 37.2-804.2 ).
· Workers Compensation: If you file a worker’s compensation claim, I am required by law, upon request, to submit your relevant mental health information to you, your employer, the insurer, or a certified rehabilitation provider.
· Records of Minors: Virginia has a number of laws that limit the confidentiality of the records of minors. For example, parents, regardless of custody, may not be denied access to their child’s records ( § 20-124.6 ); and CSB evaluators in civil commitment cases have legal access to therapy records without notification or consent of parents or child ( § 16.1-342 ). Other circumstances may also apply, and we will discuss these in detail if I provide services to minors.
Other uses and disclosures of information not covered by this notice or by the laws that apply to me will be made only with your written permission.
III. Patient’s Rights and Provider’s Duties:
· Right to Request Restrictions-You have the right to request restrictions on certain uses and disclosures of protected health information about you. You also have the right to request a limit on the medical information I disclose about you to someone who is involved in your care or the payment for your care. If you ask me to disclose information to another party, you may request that I limit the information I disclose. However, I am not required to agree to a restriction you request. To request restrictions, you must make your request in writing, and tell me: 1) what information you want to limit; 2) whether you want to limit my use, disclosure or both; and 3) to whom you want the limits to apply.
· Right to Receive Confidential Communications by Alternative Means and at Alternative Locations — You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations. (For example, you may not want a family member to know that you are seeing me. Upon your request, I will send your bills to another address. You may also request that I contact you only at work, or that I do not leave voice mail messages.) To request alternative communication, you must make your request in writing, specifying how or where you wish to be contacted.
· Right to an Accounting of Disclosures – You generally have the right to receive an accounting of disclosures of PHI for which you have neither provided consent nor authorization (as described in section III of this Notice). On your written request, I will discuss with you the details of the accounting process
. Right to Inspect and Copy – In most cases, you have the right to inspect and copy your medical and billing records. To do this, you must submit your request in writing. If you request a copy of the information, I may charge a fee for costs of copying and mailing. I may deny your request to inspect and copy in some circumstances. I may refuse to provide you access to certain psychotherapy notes or to information compiled in reasonable anticipation of, or use in, a civil criminal, or administrative proceeding.
· Right to Amend – If you feel that protected health information I have about you is incorrect or incomplete, you may ask me to amend the information. To request an amendment, your request must be made in writing, and submitted dot me. In addition, you must provide a reason that supports s your request. I may deny your request if you ask me to amend information that: 1) was not created by me; I will add your request to the information record; 2) is not part of the medical information kept by me; 3) is not part of the information which you would be permitted to inspect and copy; 4) is accurate and complete.
· Right to a copy of this notice – You have the right to a paper copy of this notice. You may ask me to give you a copy of this notice at any time. Changes to this notice: I reserve the right to change my policies and/or to change this notice, and to make the changed notice effective for medical information I already have about you as well as any information I receive in the future. The notice will contain the effective date . A new copy will be given to you or posted in the waiting room. I will have copies of the current notice available on request.
Complaints: If you believe your privacy rights have been violated, you may file a complaint. To do this, you must submit your request in writing to my office. You may also send a written complaint to the U.S. Department of Health and Human Services.
(2) HIPPA rights and responsibilities
HIPAA NOTICE OF PRIVACY PRACTICES
I. THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
II. IT IS MY LEGAL DUTY TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (PHI).
By law I am required to insure that your PHI is kept private. The PHI constitutes information created or noted by me that can be used to identify you. It contains data about your past, present, or future health or condition, the provision of health care services to you, or the payment for such health care. I am required to provide you with this Notice about my privacy procedures. This Notice must explain when, why, and how I would use and/or disclose your PHI. Use of PHI means when I share, apply, utilize, examine, or analyze information within my practice; PHI is disclosed when I release, transfer, give, or otherwise reveal it to a third party outside my practice. With some exceptions, I may not use or disclose more of your PHI than is necessary to accomplish the purpose for which the use or disclosure is made; however, I am always legally required to follow the privacy practices described in this Notice.
Please note that I reserve the right to change the terms of this Notice and my privacy policies at any time as permitted by law. Any changes will apply to PHI already on file with me. Before I make any important changes to my policies, I will immediately change this Notice and post a new copy of it in my office and on my website (if applicable). You may also request a copy of this Notice from me, or you can view a copy of it in my office or on my website, which is located at (insert website address, if applicable).
III. HOW I WILL USE AND DISCLOSE YOUR PHI.
I will use and disclose your PHI for many different reasons. Some of the uses or disclosures will require your prior written authorization; others, however, will not. Below you will find the different categories of my uses and disclosures, with some examples. A. Uses and Disclosures Related to Treatment, Payment, or Health Care Operations Do Not Require Your Prior Written Consent. I may use and disclose your PHI without your consent for the following reasons:
1. For treatment. I can use your PHI within my practice to provide you with mental health treatment, including discussing or sharing your PHI with my trainees and interns. I may disclose your PHI to physicians, psychiatrists, psychologists, and other licensed health care providers who provide you with health care services or are otherwise involved in your care. Example: If a psychiatrist is treating you, I may disclose your PHI to her/him in order to coordinate your care.
2. For health care operations. I may disclose your PHI to facilitate the efficient and correct operation of my practice. Examples: Quality control – I might use your PHI in the evaluation of the quality of health care services that you have received or to evaluate the performance of the health care professionals who provided you with these services. I may also provide your PHI to my attorneys, accountants, consultants, and others to make sure that I am in compliance with applicable laws.
3. To obtain payment for treatment. I may use and disclose your PHI to bill and collect payment for the treatment and services I provided you. Example: I might send your PHI to your insurance company or health plan in order to get payment for the health care services that I have provided to you. I could also provide your PHI to business associates, such as billing companies, claims processing companies, and others that process health care claims for my office.
4. Other disclosures. Examples: Your consent isn’t required if you need emergency treatment provided that I attempt to get your consent after treatment is rendered. In the event that I try to get your consent but you are unable to communicate with me (for example, if you are unconscious or in severe pain) but I think that you would consent to such treatment if you could, I may disclose your PHI.
B. Certain Other Uses and Disclosures Do Not Require Your Consent. I may use and/or disclose your PHI without your consent or authorization for the following reasons: (Note to therapists: The following list is a compilation of federal laws)
1. When disclosure is required by federal, state, or local law; judicial, board, or administrative proceedings; or, law enforcement. Example: I may make a disclosure to the appropriate officials when a law requires me to report information to government agencies, law enforcement personnel and/or in an administrative proceeding.
2. If disclosure is compelled by a party to a proceeding before a court of an administrative agency pursuant to its lawful authority.
3. If disclosure is required by a search warrant lawfully issued to a governmental law enforcement agency.
4. If disclosure is compelled by the patient or the patient’s representative pursuant to Virginia Codes or to corresponding federal statutes of regulations, such as the Privacy Rule that requires this Notice.
5. To avoid harm. I may provide PHI to law enforcement personnel or persons able to prevent or mitigate a serious threat to the health or safety of a person or the public (i.e., adverse reaction to meds).
6. If disclosure is compelled or permitted by the fact that you are in such mental or emotional condition as to be dangerous to yourself or the person or property of others, and if I determine that disclosure is necessary to prevent the threatened danger.
7. If disclosure is mandated by the Virginia Child Abuse and Neglect Reporting law. For example, if I have a reasonable suspicion of child abuse or neglect.
8. If disclosure is mandated by the Virginia Elder/Dependent Adult Abuse Reporting law. For example, if I have a reasonable suspicion of elder abuse or dependent adult abuse.
9. If disclosure is compelled or permitted by the fact that you tell me of a serious/imminent threat of physical violence by you against a reasonably identifiable victim or victims.
10. For public health activities. Example: In the event of your death, if a disclosure is permitted or compelled, I may need to give the county coroner information about you.
11. For health oversight activities. Example: I may be required to provide information to assist the government in the course of an investigation or inspection of a health care organization or provider.
12. For specific government functions. Examples: I may disclose PHI of military personnel and veterans under certain circumstances. Also, I may disclose PHI in the interests of national security, such as protecting the President of the United States or assisting with intelligence operations.
13. For research purposes. In certain circumstances, I may provide PHI in order to conduct medical research.
14. For Workers’ Compensation purposes. I may provide PHI in order to comply with Workers’ Compensation laws.
15. Appointment reminders and health related benefits or services. Examples: I may use PHI to provide appointment reminders. I may use PHI to give you information about alternative treatment options, or other health care services or benefits I offer.
16. If an arbitrator or arbitration panel compels disclosure, when arbitration is lawfully requested by either party, pursuant to subpoena duces tectum (e.g., a subpoena for mental health records) or any other provision authorizing disclosure in a proceeding before an arbitrator or arbitration panel.
17. If disclosure is required or permitted to a health oversight agency for oversight activities authorized by law. Example: When compelled by U.S. Secretary of Health and Human Services to investigate or assess my compliance with HIPAA regulations.
18. If disclosure is otherwise specifically required by law.
C. Certain Uses and Disclosures Require You to Have the Opportunity to Object. 147
1. Disclosures to family, friends, or others. I may provide your PHI to a family member, friend, or other individual who you indicate is involved in your care or responsible for the payment for your health care, unless you object in whole or in part. Retroactive consent may be obtained in emergency situations.
D. Other Uses and Disclosures Require Your Prior Written Authorization. In any other situation not described in Sections IIIA, IIIB, and IIIC above, I will request your written authorization before using or disclosing any of your PHI. Even if you have signed an authorization to disclose your PHI, you may later revoke that authorization, in writing, to stop any future uses and disclosures (assuming that I haven’t taken any action subsequent to the original authorization) of your PHI by me.
IV. WHAT RIGHTS YOU HAVE REGARDING YOUR PHI
These are your rights with respect to your PHI:
A. The Right to See and Get Copies of Your PHI. In general, you have the right to see your PHI that is in my possession, or to get copies of it; however, you must request it in writing. If I do not have your PHI, but I know who does, I will advise you how you can get it. You will receive a response from me within 30 days of my receiving your written request. Under certain circumstances, I may feel I must deny your request, but if I do, I will give you, in writing, the reasons for the denial. I will also explain your right to have my denial reviewed. If you ask for copies of your PHI, I will charge you not more than $.25 per page. I may see fit to provide you with a summary or explanation of the PHI, but only if you agree to it, as well as to the cost, in advance.
B. The Right to Request Limits on Uses and Disclosures of Your PHI. You have the right to ask that I limit how I use and disclose your PHI. While I will consider your request, I am not legally bound to agree. If I do agree to your request, I will put those limits in writing and abide by them except in emergency situations. You do not have the right to limit the uses and disclosures that I am legally required or permitted to make. C. The Right to Choose How I Send Your PHI to You. It is your right to ask that your PHI be sent to you at an alternate address (for example, sending information to your work address rather than your home address) or by an alternate method (for example, via e-mail instead of by regular mail). I am obliged to agree to your request providing that I can give you the PHI, in the format you requested, without undue inconvenience. I may not require an explanation from you as to the basis of your request as a condition of providing communications on a confidential basis.
D. The Right to Get a List of the Disclosures I Have Made.
You are entitled to a list of disclosures of your PHI that I have made. The list will not include uses or disclosures to which you have already consented, i.e., those for treatment, payment, or health care operations, sent directly to you, or to your family; neither will the list include disclosures made for national security purposes, to corrections or law enforcement personnel, or disclosures made before April 15, 2003. After April 15, 2003, disclosure records will be held for six years.
I will respond to your request for an accounting of disclosures within 60 days of receiving your request. The list I give you will include disclosures made in the previous six years unless you indicate a shorter period. The list will include the date of the disclosure, to whom PHI was disclosed (including their address, if known), a description of the information disclosed, and the reason for the disclosure. I will provide the list to you at no cost, unless you make more than one request in the same year, in which case I will charge you a reasonable sum based on a set fee for each additional request.
E. The Right to Amend Your PHI.
If you believe that there is some error in your PHI or that important information has been omitted, it is your right to request that I correct the existing information or add the missing information. Your request and the reason for the request must be made in writing. You will receive a response within 60 days of my receipt of your request. I may deny your request, in writing, if I find that: the PHI is (a) correct and complete, (b) forbidden to be disclosed, (c) not part of my records, or (d) written by someone other than me. My denial must be in writing and must state the reasons for the denial. It must also explain your right to file a written statement objecting to the denial. If you do not file a written objection, you still have the right to ask that your request and my denial be attached to any future disclosures of your PHI. If I approve your request, I will make the change(s) to your PHI. Additionally, I will tell you that the changes have been made, and I will advise all others who need to know about the change(s) to your PHI. F. The Right to Get This Notice by E-mail. You have the right to get this notice by email. You have the right to request a paper copy of it, as well. V.
HOW TO COMPLAIN ABOUT MY PRIVACY PRACTICES If, in your opinion, I may have violated your privacy rights, or if you object to a decision I made about access to your PHI, you are entitled to file a complaint with the person listed in Section VI below. You may also send a written complaint to the Secretary of the Department of Health and Human Services at 200 Independence Avenue S.W. Washington, D.C. 20201. If you file a complaint about my privacy practices, I will take no retaliatory action against you.
VI. PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR
TO COMPLAIN ABOUT MY PRIVACY PRACTICES
If you have any questions about this notice or any complaints about my privacy practices, or would like to know how to file a complaint with the Secretary of the Department of Health and Human Services, please contact me at: [insert therapist’s name, address phone number, and e-mail].
VII. NOTIFICATIONS OF BREACHES
In the case of a breach, [Insert therapist’s name] requires to notify each affected individual whose unsecured PHI has been compromised. Even if such a breach was caused by a business associate, [Insert therapist’s name] is ultimately responsible for providing the notification directly or via the business associate. If the breach involves more than 500 persons, OCR must be notified in accordance with instructions posted on its website. [Insert therapist’s name] bears the ultimate burden of proof to demonstrate that all notifications were given or that the impermissible use or disclosure of PHI did not constitute a breach and must maintain supporting documentation, including documentation pertaining to the risk assessment.
VIII. PHI AFTER DEATH
Generally, PHI excludes any health information of a person who has been deceased for more than 50 years after the date of death. [Insert therapist’s name] may disclose deceased individuals’ PHI to non-family members, as well as family members, who were involved in the care or payment for healthcare of the decedent prior to death; however, the disclosure must be limited to PHI relevant to such care or payment and cannot be inconsistent with any prior expressed preference of the deceased individual.
IX. INDIVIDUALS’ RIGHT TO RESTRICT DISCLOSURES; RIGHT OF ACCESS
To implement the 2013 HITECH Act, the Privacy Rule is amended. [Insert therapist’s name] is required to restrict the disclosure of PHI about you, the patient, to a health plan, upon request, if the disclosure is for the purpose of carrying out payment or healthcare operations and is not otherwise required by law. The PHI must pertain solely to a healthcare item or service for which you have paid the covered entity in full. (OCR clarifies that the adopted provisions do not require that covered healthcare providers create separate medical records or otherwise segregate PHI subject to a restrict healthcare item or service; rather, providers need to employ a method to flag or note restrictions of PHI to ensure that such PHI is not inadvertently sent or made accessible to a health plan.)
The 2013 Amendments also adopt the proposal in the interim rule requiring your professional counselor, to provide you, the patient, a copy of PHI if you, the patient, requests it in electronic form. The electronic format must be provided to you if it is readily producible. OCR clarifies that Anne Miniter McKay LPC must provide you only with an electronic copy of their PHI, not direct access to their electronic health record systems.
The 2013 Amendments also give you the right to direct [Insert therapist’s name] to transmit an electronic copy of PHI to an entity or person designated by you. Furthermore, the amendments restrict the fees that [Insert therapist’s name] may charge you for handling and reproduction of PHI, which must be reasonable, cost-based and identify separately the labor for copying PHI (if any). Finally, the 2013 Amendments modify the timeliness requirement for right of access, from up to 90 days currently permitted to 30 days, with a one-time extension of 30 additional days.
X. CONSENT TO RELEASE RECORDS
Most uses and disclosures of psychotherapy notes, marketing disclosures and sale of PHI do require prior authorization by you, and you have the right to be notified in case of a breach of unsecured