Home and Community Based Services Manual


9.00 Confidentiality Requirements

During the normal course of business, the Department of Health and Senior Services (DHSS), Division of Senior and Disability Services (DSDS) gathers extensive personal and confidential information regarding individuals that have a need for Home and Community Based Services (HCBS). All such information shall be held in confidence and shall only be disclosed when there is a need to know (e.g. arranging for service delivery) and/or an appropriate authorization by the participant is in place.

DSDS is also required to comply with the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH) (PL-111-5) (collectively, and hereinafter, HIPAA) and maintain the confidentiality of all HCBS participants. All DSDS employees shall ensure they are familiar with DHSS Administrative Policies related to HIPAA and general confidentiality issues, including the following:

During all phases of the HCBS assessment process, DSDS shall hold all protected health information (PHI) as confidential and shall only use PHI to perform functions, activities, or services related to the provision of HCBS. DSDS shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PHI that is created, received, maintained, or transmitted on behalf of the HCBS participant.

All HCBS participants, during the face-to-face visit for initial assessment, shall be given a copy of the DHSS Notice of Privacy Practices(Notice). DSDS shall explain this Notice to the participant and have the participant sign the Privacy Policies Acknowledgement (PPA) form stating the Notice was received. If the participant has a guardian, the guardian must sign the PPA form.

PHI will be made available only to the guardian, when applicable, and to any person the participant designates as an ‘authorized representative.’ In order to designate an authorized representative, permission must be given by the participant. This permission may be given verbally in the presence of the person to be designated, or in writing by completing and signing the Authorization for Disclosure of Consumer Medical/Health Information (Authorization) form.

  • Any time hard copies are released to someone other than the participant or the guardian, a fullycompleted Authorization must be in place prior to the release of information.

Once an authorized representative has been designated, DSDS will be able to release pertinent information in the participant’s person centered care plan (PCCP) until the Authorization expires or is rescinded.

Note: If a participant’s case is closed and later reopened for HCBS, the participant must be provided with a current copy of the Notice and sign a new PPA form.

Table of Contents