dhss-logo

Home and Community Based Services Manual

9.00 Confidentiality Requirements

Home and Community Based Services Manual


9.00 Confidentiality Requirements

During the normal course of business, the Department of Health and Senior Services (DHSS), Division of Senior and Disability Services (DSDS) gathers extensive personal and confidential information regarding individuals that have a need for Home and Community Based Services (HCBS). All such information shall be held in confidence and shall only be disclosed when there is a need to know (e.g. arranging for service delivery) and/or an appropriate authorization by the participant is in place.

DSDS is also required to comply with the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH) (PL-111-5) (collectively, and hereinafter, HIPAA) and maintain the confidentiality of all HCBS participants. All DSDS employees shall ensure they are familiar with DHSS Administrative Policies related to HIPAA and general confidentiality issues, including the following:

During all phases of the HCBS assessment process, DSDS shall hold all protected health information (PHI) as confidential and shall only use PHI to perform functions, activities, or services related to the provision of HCBS. DSDS shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PHI that is created, received, maintained, or transmitted on behalf of the HCBS participant.

All HCBS participants, during the face-to-face visit for initial assessment, shall be given a copy of the DHSS Notice of Privacy Practices(Notice). DSDS shall explain this Notice to the participant and have the participant sign the Privacy Policies Acknowledgement (PPA) form stating the Notice was received. If the participant has a guardian, the guardian must sign the PPA form.

PHI will be made available only to the guardian, when applicable, and to any person the participant designates as an ‘authorized representative.’ In order to designate an authorized representative, permission must be given by the participant. This permission may be given verbally in the presence of the person to be designated, or in writing by completing and signing the Authorization for Disclosure of Consumer Medical/Health Information (Authorization) form.

  • Any time hard copies are released to someone other than the participant or the guardian, a fullycompleted Authorization must be in place prior to the release of information.

Once an authorized representative has been designated, DSDS will be able to release pertinent information in the participant’s person centered care plan (PCCP) until the Authorization expires or is rescinded.

Note: If a participant’s case is closed and later reopened for HCBS, the participant must be provided with a current copy of the Notice and sign a new PPA form.

Table of Contents

On this page

    9.00 Appendix 5 Acknowledgement Instructions

    Home and Community Based Services Manual


    9.00 Confidentiality Requirements

    The Privacy Policies Acknowledgement (PPA) form documents a Home and Community Based Services (HCBS) participant’s receipt of the Department of Health and Senior Services’ (DHSS) Notice of Privacy Practices. This acknowledgment is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH) (PL-111-5) (collectively, and hereinafter, HIPAA). The Notice explains how DHSS may use and/or disclose the participant’s medical information. It shall be given to all participants at the initial face-to-face assessment.

    Instructions

    The following shall be entered:

    • Participant’s first name, middle initial, and last name
    • Participant's birth month, day, and year
    • Social Security Number only if the individual does not have an assigned Departmental Client Number (DCN)
    • Participant’s DCN

    The person receiving the Notice shall print their first name, middle initial and last name.

    • This will be the participant, their legal guardian, or any individual named in a Durable Power of Attorney for Health Care (DPOA-HC) that has been invoked.

    Obtain the signature of the person whose name is printed on the form and who is receiving it, and include the date.

    • Participants who cannot sign may mark with an “X.”
    • If the person who signs the PPA form is the guardian or DPOA-HC, a copy of the document granting legal authority to act on behalf of the participant must be uploaded into the participant’s electronic case record.
    • The only time a parent may sign is if the participant is a minor child.

    Check the appropriate box to describe the relationship between the participant and the person who signed the PPA form.

    • If the participant refuses to sign the form, DSDS staff shall check the box “client refused to sign form.”

    The following shall be completed by DSDS staff:

    • Name and address of the bureau or program that provided the Notice to the participant.
    • If DSDS is present when the PPA form is completed, they shall sign and print their name and enter the date

    Distribution

    The original form shall be uploaded into the participant’s electronic case record. Upon request, a copy shall be given to the participant.

    Note: If a participant’s case is closed and later reopened for services, the participant must be provided with a current copy of the Notice and sign a new PPA form.

    On this page

      Table of Contents

      9.00 Appendix 6, Authorization For Disclosure Of Consumer Medical/Health Information Instructions

      Home and Community Based Services Manual


      9.00 Confidentiality Requirements

      Overview

      The Authorization for Disclosure of Consumer Medical/Health Information (Authorization) is a statewide form implemented by multiple state agencies, including the Department of Health and Senior Services (DHSS), in response to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH) (PL-111-5) (collectively, and hereinafter, HIPAA). This form serves as written documentation to obtain and/or release protected health information (PHI) as required by HIPAA. PHI is defined as any individually identifiable health information which would include:

      • Participant case record information
      • Demographic information (name, address, date of birth, etc.)
      • Physical and mental health information contained in the case

      This form provides maximum protection for the participant’s privacy and serves as a legal means of documenting the participant’s permission for information sharing. Use of this form also documents what information is released and the purpose of the disclosure. This form shall be completed any time PHI will be released in hard copy form to a person or entity other than the participant, guardian, or other legal representative. It may also be used to document permission to share information verbally, when necessary as outlined in the Confidentiality Requirements policy.

      The authorization becomes effective on the date of signature and expires one year from that date unless it is revoked by the participant prior to that time.

       

      Instructions

      This form shall be typed or clearly written in ink prior to being signed by the participant.

      • No blank or partially completed forms are to be signed by the participant.
      • DSDS staff completing the form shall review all the information contained in the document with the participant

      Enter the information on the form as outlined below:

      • Enter the name of the person authorizing the release of the participant's medical/health information
        • This may be the participant, a legal guardian, or an individual named as a durable power of attorney for health care (DPOA-HC) that has been invoked.
          • If the authorizing individual is not the participant, a copy of the document granting legal authority to act on behalf of the participant must be attached.
          • If the person is deceased, the document granting legal authority would be papers appointing a personal representative.
        • Check the appropriate field to indicate the entity providing medical/health information about the participant
          • When using the ‘Other’ field, enter the name of the specific entity.
        • Enter the participant’s full legal name, Departmental Client Number (DCN), and date of birth
        • Enter the Social Security Number only if the participant does not have an assigned DCN

       

      Purpose of Disclosure

      The following shall be completed:

      • List the specific dates of services included in the requested records
        • The phrase “any and all” is not specific and shall not be used.
      • Check the appropriate box to indicate the entity that will receive the information
        • When using the ‘Other’ box, enter the name of the specific entity and complete the address information.
      • Check all applicable purposes for the disclosure.
        • If the boxes provided are not applicable, mark “other” and write in the purpose.
      • Check all applicable information to be disclosed
        • When the requested information is not listed, mark other and provide a description of the specific information.

       

      Review of Information with Participant

      The information obtained shall be reviewed with the participant.

      • Obtain the participant’s signature (when there is no legal guardian or DPOA-HC) and enter the date signed
      • Obtain the witness's signature and enter the date signed
      • Obtain the signature of legal guardian, DPOA-HC, or other legal representative, when applicable
        • This signature should match the name of the person authorizing the disclosure.

       

      Authorization to Disclose Substance Abuse Treatment

      When the form is completed to request disclosure of substance abuse treatment information, the participant must also review, sign and date this section.

       

      Revocation

      This section shall be completed if the participant or the individual with legal authority to act as a representative for the participant wishes to revoke the authorization. The participant or representative must send the form to the department, facility, agency, or entity indicated at the beginning of the form.

      • Enter the date of revocation
      • Enter the participant’s name
      • Obtain signature of the participant or their legal representative, as appropriate

       

      Distribution

      • One copy shall be provided to the participant/representative
      • A copy shall be sent to the agency disclosing/releasing the information
      • A copy shall be uploaded into the participant’s electronic case record

      On this page

        Table of Contents

        Additional documents

        Cover letter
        Authorization form