NOTICE OF HIPAA PRIVACY PRACTICES

I.               Definitions

This section defines terms relating to the psychotherapy relationship covered by HIPAA. Explanations are provided for what is meant by client file, privileged communication, protected health information, treatment, payment, healthcare operations, progress notes, psychotherapy notes, use, disclosure and business associates.

·       Client File. Each client has a client file that contains records of psychotherapy meetings and other information related to treatment. Information included in the client file is determined by state law, professional standards, and other review procedures. Under HIPAA, the client file is referred to as the “designated medical record.” HIPAA very clearly defines what information is to be included in this file. In Tennessee, information contained within the client file is a combination of Tennessee law and HIPAA. Your client file consists of all initial, identifying paperwork; all billing information; a summary of the first appointment; a mental status examination; an individualized, comprehensive treatment plan; progress notes; managed care/insurance company treatment authorizations and review information; psychological assessments, including raw data (if applicable) and results of the assessment; any medical records from other providers disclosed on behalf of the client; authorization letters or summaries of care released on your behalf; and a discharge summary (or note) completed at the end of treatment. 

·       Privileged Communication. Privileged communication refers to conversations between therapists and their clients. The licensing law for the state of Tennessee provides very strong confidentiality protections for these conversations. It is at the same level as that between lawyer and client. However, there is a difference between privileged conversations and documentation in your client file. Documentation in your client file is considered “protected health information” or PHI.

·       PHI. PHI refers to protected health information, information in your client file that could identify you. PHI includes an individual’s past, present, or future physical or mental health condition, the provision of health care to an individual or individuals, or the past, present, or future payment for the provision of health care to an individual or individuals. HIPAA provides privacy protections for the documentation of this information in your client file as well as the communication of this information to others whether verbally or in writing.

·       Treatment. Treatment refers to efforts by the psychotherapist to help clients resolve mental health, behavioral, or emotional problems; to manage the client’s mental health care; or to coordinate other services related to the client’s mental health care. Examples include contents of psychotherapy sessions, psychological testing/assessments, or consultations with other people who may be important in the client’s treatment.

·       Payment. Payment refers to reimbursement for mental health care and related services. The clearest examples of this aspect of treatment is collecting out-of-pocket fees from you and filing insurance claims on your behalf to pay for treatment costs.

·       Health Care Operations. Health care operations are activities related to the psychotherapist’s professional responsibilities. In mental health care, the best example of healthcare operations is when an insurance company reviews a psychotherapist’s work to determine “medical necessity” for the treatment. It may also include performance evaluations, accreditation, certification, licensing or credentialing activities.

HIPAA distinguishes between two types of documents containing information related to individual psychotherapy sessions. This information is contained within progress notes and psychotherapy notes.

·       Progress Notes. Progress notes document the information and activities in a psychotherapy session related to treatment goals. Progress notes may contain information on medication prescriptions, time spent in the session, treatment modality (e.g., individual, family, group), treatment frequency, test results, diagnostic summaries, level of functioning, treatment plans, symptoms, progress to date, and prognosis. The content of progress notes vary and usually consist of a combination of factual information (such as client quotes and direct observations by the therapist) as well as process information (such as clinician insights on client growth and progress towards identified goals).

·       Psychotherapy Notes. Psychotherapy notes represent information “recorded in any medium by a mental health provider documenting and analyzing the contents of a conversation during a private, group, or joint family counseling sessions.” Psychotherapy notes have been accorded a special status by HIPAA. Psychotherapy notes belong to the psychotherapist. Psychotherapy notes are not a part of the client file and therefore the information contained within these notes is not available to clients or to other individuals or agencies except under special authorization (see Uses and Disclosures of Protected Health Information Requiring Authorization section below).

Three additional terms used in reference to client privacy and security are use of protected health care information, disclosure of this information, and definition of business associates.

·       Use. Us of protected health information applies only to activities within our office such as sharing, employing, applying, utilizing, examining, and analyzing information that identifies you. This includes activities conducted in the practice of psychotherapy related to filing claims for payment, scheduling appointments, keeping records, and other activities related to the mental health care of clients.

·       Disclosure. Disclosure applies to activities outside of our office, such as releasing, transferring, or providing access to information about you to other parties. It refers to activities that result in protected health care information being revealed to people or agencies other than to the client or legal guardian. Examples of disclosures would be contact with the client’s physician, school personnel, or reporting concerns about abuse or neglect.

·       Business Associate. Business Associates are any individuals performing ancillary administrative services for the Trauma & Therapy Center of TN. who may have access to client files and/or other protected information. Business Associates include administrative assistants, phone/email/internet/alarm service providers, billing service personnel, collection agency personnel, clinical consultants, legal counsel, and janitorial service personnel. There are varied levels of disclosure depending on the type of associate. All disclosed information is on a  “need to know only” basis, which in consistent with the requirements of HIPAA. This means that the minimal amount of information is shared in order to complete the service. For some ancillary services, no PHI will be disclosed; however, PHI is disclosed electronically via email or phone or WIFI. For all Business Associates, a BAA, also known as “Business Associate Agreement (see Business Associates Disclosure for more information).

II.             Uses and Disclosures of Protected Health Information Requiring Authorization

 Psychotherapy clients or their legal guardians must provide consent for the psychologist or their representative to provide information from the client file to any other person or agency. This includes consent for treatment, payment, health care operations, and release of information to a third party. Special instances of confidentiality are also described relating to psychotherapy notes, psychological test information, and revoking authorization to release confidential information.

·       Consent to Treatment, Payment and Health Care Operations. Tennessee law and HIPAA require psychotherapists to obtain informed consent for treatment from clients. This includes consent for the use of psychotherapy techniques, collection of payment due for services provided by the psychotherapist, and conducting necessary healthcare operations. Clients or the client’s legal guardian must sign a consent form authorizing these activities. You provide informed consent to participate in psychotherapy with the psychotherapists of this practice when you initial  and sign the relevant sections of the “Informed Consent and Practice Policies” included in your initial paperwork.

·       Release of Information. Releasing information from a client’s file to a third party requires a specific authorization. An example of this type of disclosure would be speaking to a child’s teacher at the request of the child’s parent or guardian. A signed release of information form is required before information like this may be shared with others.

·       Psychotherapy Notes. As mentioned above (see Definitions section, Progress Notes and Psychotherapy Notes), psychotherapy notes are accorded a special, protected status by HIPAA. They are not part of the client file and, therefore, are not available to clients or third parties. This means that insurance companies do not have access to information contained in psychotherapy notes for any reason.

 Despite this special protection for psychotherapy notes, HIPAA has allowed selected payors (such as Medicare and Workers Compensation) to have access to psychotherapy notes. If psychotherapy notes are required by these payors, clients or their legal guardians will be asked to sign an additional authorization to release this information.

·       Revoking Authorizations. Clients or their legal representatives have the right at any time to revoke all preexisting authorizations to disclose information from the client file. Clients or their legal representatives may revoke authorizations to submit claims for reimbursement by their insurance carrier. Requests revoking existing authorizations must be made in writing.

Clients may not revoke authorizations for a disclosure that has already occurred or for claims presented to an insurance carrier under a preexisting authorization. Tennessee law provides the insurer the right to contest any claim under policy and, thereby, have access to relevant information from the client file for the purpose of resolving the disputed claim.

III.            Business Associates Disclosures

 HIPAA requires that health care providers train and monitor the conduct of Business Associates. A formal Business Associates contract must be signed that clarifies the Business Associate’s responsibility to maintain the confidentiality of client information. The contract must clearly state that maintaining confidentiality of client information is a condition of employment or a condition of the service agreement. Business Associates are to be instructed in privacy practices, their compliance is to be monitored, and any errors that occur are to be corrected.

All client information in our office building is stored after hours in a  locked closet and/or in locked file cabinets. Janitorial staff do not have access to records as they remain locked after business hours. This practice employs an administrative assistant who is trained in HIPAA regulations. Her name is Katie Jordan. She has access to your PHI via an online note service (SimplePractice.com), which is also HIPAA compliant.

IV.            Limitations to Confidentiality and Privacy

 I may use or disclose protected health information without the client’s consent or authorization in the following circumstances:

·       Child Abuse: If I have knowledge of any child who is suffering from or has sustained any wound, injury, or disability, or physical or mental condition of such a nature as to reasonably indicate that it has been caused by brutality, abuse, or neglect, I am required by law to report such harm immediately to Tennessee Department of Children’s Services or to the judge having juvenile jurisdiction, or to the office of the sheriff or the chief law enforcement official of the municipality where the child resides. Also, if I have reasonable cause to suspect that a child has been sexually abused, I must report such information, regardless of whether the child has sustained any injury.

·       Adult and Domestic Abuse: If I have reasonable cause to suspect that an adult has suffered abuse, neglect, or exploitation, I am required by law to report such information to the Tennessee Department of Human Services.

·       Health Oversight: If a complaint is filed against me with the Tennessee Board of Professional Counselors, the Board has the authority to subpoena confidential mental health information from me relevant to that complaint.

·       Judicial or administrative proceedings: If you are involved in a court proceeding and a request is made for information about the professional services that I have provided you and/or the records thereof, such information is privileged under state law, and I must not release this information without your written authorization or a valid court order. This privilege does not apply when you are being evaluated for a third party or where the evaluation is court ordered. I will inform you in advance if this is the case.

·       Serious Threat to Health or Safety: If you communicate to me an actual threat of bodily harm against a clearly identified victim, and I have determined or reasonably should have determined that you have the apparent ability to commit such an act and are likely to carry out the threat unless prevented from doing so, I am required to take reasonable care to predict, warn of, or take precautions to protect the identified victim from your violent behavior. 

·       Threats to National Security: Health care providers are required by law to disclose a client’s health information to authorized federal officials conducting national security and intelligence activities or providing protective services to the President or other important officials. It is unlawful for me to reveal that this information has been provided.

·       Workers' Compensation: If you file a worker's compensation claim, and I am seeing you for treatment relevant to that claim, I must, upon request, furnish to your employer or insurer, and to you, a complete report as to the claimed injury, the effect upon you, the prescribed treatment, an estimate of duration of hospitalization, if any, and a statement of charges.

There may be additional disclosures of PHI that I am required or permitted by law to make without your consent or authorization, however the disclosures listed above are the most common.

V.             Client’s Rights and Psychotherapist’s Duties

Clients have a right to the following:

·       Right to Request Restrictions. You have the right to request restrictions on certain uses and disclosures of protected health information. These requests must be provided in writing. However, I am not required to agree to a restriction you request.

·       Right to Receive Confidential Communications by Alternative Means and at Alternative Locations. You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations. (For example, you may not want a family member to know that you are seeing me.) Upon your request, I will send your bills to another address. These requests must be made in writing.

·       Right to Inspect and Copy. You have the right to inspect or obtain a copy (or both) of PHI in my mental health and billing records used to make decisions about you for as long as the PHI is maintained in the record. Clients will be charged a predetermined rate for per page copy costs and for time spent producing these copies.

·       Right to Amend. You have the right to request an amendment of PHI for as long as the PHI is maintained in the record. Should a client choose to request an amendment, he or she will be informed of the formal process for amending material in the client file. Improper requests may be denied by the psychotherapist. The psychotherapist may also respond to any amendment(s) and enter the response(s) into the client file.

·       Right to an Accounting. You generally have the right to an accounting of nonauthorized disclosures of your protected health information (e.g., documentation of suspected child abuse/neglect reports, etc.). Clients will be charged a predetermined rate for per page copy costs and for time spent producing these copies.

·       Right to a Paper Copy. You have the right to obtain a paper copy of the notice from me upon request, even if you have agreed to receive the notice electronically.

·       Right to File Concerns or Complaints. You may exercise your rights as a client under the privacy rule, file a complaint, be involved in a compliance review, or oppose a practice believed to be unlawful without concern for retaliation.

·       Right to revoke authorization. You have the right to revoke authorization for release of protected mental health information except to the extent that action has already been taken (see Revoking Authorizations in Section II above).

Psychotherapist’s Duties:

·       I am required by law to maintain the privacy of PHI, provide you with a notice of your rights, and to provide you with a notice of my legal duties and privacy practices with respect to PHI.

·       I reserve the right to change the privacy policies and practices described in this notice. Unless I notify you of such changes, however, I am required to abide by the terms currently in effect.

·       If I revise my policies and procedures, I will provide you with a notice at your preferred mailing address if you have provided consent to do so.

VI.            Questions and Complaints

·       I will be happy to address any questions you may have about this notice, disagreements with a decision I make about access to your records, or other concerns about your privacy rights. Any questions or complaints should be put in writing for purposes of documentation.

·       You may also send a written complaint to the Secretary of the U.S. Department of Health and Human Services by calling 1-800-368-1019 or by going online to http://www.hhs.gov/ocr/hippahowtofile.pdf.

·       You may also contact the Tennessee Board of Professional Counselors and Marriage and Family Therapist by calling (615) 741-5735.

·       You can also call the Complaint Divisions of the Department of Health at 1-800-852-2187 to request a complaint form. 

·       You can also write to them at:  Office of Investigations, 665 Mainstream Drive, 2nd Floor, Suite 201
Nashville, TN 37243

VII.          Effective Date, Restrictions and Changes to Privacy Policy

 This notice will go into effect on January 1, 2021. I reserve the right to change the terms of this notice and to make the new notice provisions effective for all PHI that I maintain. I will provide you with a revised notice by mail if you have consented for this.