LANDY HEADACHE & ESTHETICS, LLC

Privacy Policy

TABLE OF CONTENTS

LANDY HEADACHE & ESTHETICS, LLC Privacy Policy 1

TABLE OF CONTENTS 1

Landy Headache & Esthetics Privacy Policy 1

  1. Introduction 1
  2. Definitions 1
  3. Permitted and Required Uses and Disclosures of Protected Information 4
    1. Permitted Uses and Disclosures 4
  1. Minimum Necessary Standard 6

All other positions have restricted access to only the portions of the records that are necessary to perform their job functions. 7

  1. Uses and Disclosures of Protected Health Information Subject to an Agreed Upon Restriction 9
  2. Confidential Communications 11
  3. Personal Representatives 13
  4. Use and Disclosure of Psychotherapy Notes 15
  5. Sale of Protected Health Information 17
  6. Marketing 19
  1. Disclosure of Information Related to Alcohol or Substance Abuse Treatment 21
  2. Business Associates 23
    1. Incidental Access by Persons Other than Workforce or Business Associates. 23
  3. Notice of Privacy Practices 25
  4. Valid Authorizations 27
  1. Uses and Disclosures Requiring an Opportunity for the Individual to Agree or Object 30
  1. Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object is Not Required 32
  1. Access of Individual to Protected Health Information 38
  1. Amendment of Protected Health Information 43
  1. Request for Accounting of Disclosure(s) 45
  1. Notification of Breach of Unsecured Protected Health Information 48
  1. Administrative Requirements 53

Inappropriate use or disclosure of protected health information by a member of Landy Headache & Esthetics will result in immediate termination of the employee’s access to the electronic health record and may also result in immediate termination of employment. 54

Landy Headache & Esthetics

Privacy Policy

  1. Introduction

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health Act (the HITECH Act) and other federal and state laws/regulations mandate the protection of protected health information.  In order to achieve this, Landy Headache & Esthetics has adopted this policy concerning the manner in which its employees, agents, volunteers, and business associates use and disclose protected health information.

Notwithstanding other Landy Headache & Esthetics policies and procedures, all Landy Headache & Esthetics employees, administrators, and business associates shall comply with this Privacy Policy.  Where any conflict exists, the policy and/or procedure that is most protective of patients’ health information and health information rights shall be implemented.  Staff with questions regarding applicability of these policies and procedures should contact the Privacy Officer.

  1. Definitions

HIPAA Privacy Rule:  HIPAA Privacy Rule shall mean the privacy portions of the administrative simplification section of the Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191, codified at 42 U.S.C. § 1320d), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (Title XIII of Division A and Title IV of Division B of Pub. L. No. 111-5), and implementing regulations promulgated by the Department of Health and Human Services at 45 C.F.R. Parts 160 and 164.

Protected health information:  Protected health information is defined as individually identifiable health information relating to the past, present, or future mental or physical health condition of an individual, provision of health care to an individual, or the past, present, or future payment for health care provided to an individual that is:  transmitted by electronic media; maintained in any electronic medium (including the internet, extranet, leased lines, dial-up lines, private networks, and those transmissions that are physically moved from one location to another using magnetic tape, disk, or compact disk media) or transmitted or maintained in any other form or medium.  All individually identifiable information related to individuals receiving services from Landy Headache & Esthetics is considered protected health information, and is subject to the restrictions outlined in this document.

De-identified Information:  De-identified information is information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual.  Prior to determining whether health information is de-identified, employees should consult the Privacy Officer.

Designated Record Set:  Landy Headache & Esthetics’ designated record sets include Landy Headache & Esthetics’ medical and billing records or other records used, in whole or in part, by or for Landy Headache & Esthetics to make decisions about individuals.  Landy Headache & Esthetics’ clinical record is maintained in Remedly, an electronic health record.

Disclosure:  Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.

Use:  Use means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

Personal Representative:  An individual’s Personal Representative is that person authorized by state or federal law to make health care decisions on behalf of an individual who because of mental illness or mental retardation, is unable to make an informed decision to give or withhold consent to action.

Business Associates:  A Business Associate is defined as an entity that performs or assists in the performance of a function or activity involving the use or disclosure of individually identifiable health information.  This includes, but is not limited to, legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services.

Psychotherapy Notes:  For purposes of this policy, “psychotherapy notes” shall be defined as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint or family counseling session and that are separated from the rest of the individual’s medical record.  “Psychotherapy notes” shall not include medication prescription and monitoring, counseling session start and stop times, modalities and frequencies of treatment furnished, results of clinical tests or any summary of the following items:  diagnosis, functional status, treatment plan, symptoms or progress to date.

III.

Permitted and Required

Uses and Disclosures

of

Protected Health Information

  1. Permitted and Required Uses and Disclosures of Protected Information
    1. Permitted Uses and Disclosures

Landy Headache & Esthetics employees, agents, volunteers and business associates are permitted to use or disclose protected health information as follows:

  • To the individual;
  • For the treatment, payment or health care operations of Landy Headache & Esthetics;
  • For treatment, payment, and limited health care operations purposes of another covered entity;
  • Incident to a permitted use or disclosure;
  • For notification purposes in accordance with Section XIII of this Privacy Policy;
  • For public policy purposes as described in Section XV of this Privacy Policy;
  • As required by state and federal law; and
  • As otherwise permitted by a valid authorization signed by the patient or his or her personal representative.
    1. Required Disclosures

Landy Headache & Esthetics is required to disclose protected health information under the following circumstances:

  • To an individual who requests access to his or her protected health information, in accordance with Section XVII of this Privacy Policy;
  • To an individual who requests an accounting of the disclosures of his or her protected health information, in accordance with Section XIX of this Privacy Policy; and
  • As required by the Department of Health and Human Services to investigate or determine Landy Headache & Esthetics’ compliance with the HIPAA Privacy Rule.

IV.

Minimum

Necessary

Standard

  1. Minimum Necessary Standard

Landy Headache & Esthetics’ employees, agents, and business associates must limit the uses and disclosures of protected health information to the minimum necessary to accomplish the intended purpose of that use or disclosure.  Reasonable efforts will be made to limit each user of protected information to only that information that is needed in the execution of his or her duties.  If practicable, Landy Headache & Esthetics will de-identify information or limit disclosures to a limited data set.  If this is not practicable, disclosures will be subject to a minimum necessary determination.  Disclosure of the entire health record should not be made unless the use or disclosure of the entire record is permitted by law or otherwise specifically authorized or reasonably necessary to accomplish the purpose of the disclosure.

Minimum Necessary Does Not Apply.  The minimum necessary standard does not apply to:

  • Disclosures or requests made by or to a health care provider for treatment;
  • Permitted uses or disclosures made to the individual;
  • Uses or disclosures made pursuant to a valid authorization;
  • Disclosures made to the Department of Health and Human Services and/or the Office for Civil Rights in accordance with the HIPAA Privacy Rule; or
  • Uses or disclosures required by law, including but not limited to uses and disclosures required by the HIPAA Privacy Rule.

Personnel Access to Protected Health Information.  Protected health information shall be maintained in the clinic in either hard copy form or electronically.  Access to protected health information shall be restricted to individuals according to their need for the information.  Additional information concerning Access Controls is included in Section V of the Security Policy.

Access to Hardcopy Information.  All protected health information in hardcopy form shall be stored in a secure place and manner to ensure confidentiality of the record and to safeguard information against loss, defacement, and tampering.  At no time will individuals without proper access be allowed to view protected information.

Unrestricted Access to Entire Record.  The following positions have complete access to the records of those individuals they serve for the purpose of patient care:

    • Healthcare Providers

Restricted/Supervised Access to Protected Information.

All other positions have restricted access to only the portions of the records that are necessary to perform their job functions.

Disclosures of Protected Health Information.  Routine requests for disclosure of protected health information will be handled in accordance with this policy.  The Privacy Officer will review non-routine requests for protected health information and will determine the minimum amount of information necessary to respond to such requests.  The Privacy Officer’s determination will take into consideration the following criteria:

  • Avoiding disruption in patient care;
  • Protecting the patient’s privacy;
  • Minimizing patient costs.

Minimum Necessary Requests for Protected Health Information.  Employees, agents, and business associates shall limit any request for protected health information to that which is reasonably necessary to accomplish the purpose for which the request is made when requesting such information from other covered entities.

V.

USES AND DISCLOSURES

OF

PROTECTED HEALTH INFORMATION

SUBJECT TO AN

AGREED UPON RESTRICTION

  1. Uses and Disclosures of Protected Health Information Subject to an Agreed Upon Restriction

Landy Headache & Esthetics shall afford all individuals receiving services the opportunity to request that their protected health information be restricted.  Landy Headache & Esthetics is not required to agree to a request for restriction, unless the restriction involves disclosure of protected health information to a health plan concerning treatment that has been paid for, in full, out of pocket.  However, upon agreeing to a requested restriction, Landy Headache & Esthetics may not use or disclose the information covered by the restriction except to provide emergency treatment.  If Landy Headache & Esthetics agrees to a restriction, documentation shall be maintained by the Privacy Officer indicating the nature of the agreed upon restriction.

An agreed upon restriction may be terminated if the individual so agrees, and this is documented in writing, or Landy Headache & Esthetics so informs the individual of such termination.  The termination applies only to protected health information created, or received, after such notice of termination.

If a patient requests that protected health information not be disclosed to his or her health plan concerning treatment for which the patient has paid, in full, out of pocket, Landy Headache & Esthetics must honor that request unless disclosure of the protected health information is required by law, such as a response to a Medicare or Medicaid audit request.  The request will be communicated to the Privacy Officer, who will oversee the flagging of the patient’s record to ensure that the restricted protected health information is not subsequently inadvertently disclosed.

VI.

CONFIDENTIAL

COMMUNICATIONS

VI. Confidential Communications

Landy Headache & Esthetics shall permit individuals to request to receive communications of protected health information by alternative means or at alternative locations, and shall accommodate all reasonable requests.  Requests of this nature may be made either orally or in writing.  If the patient’s request cannot reasonably be accommodated, Landy Headache & Esthetics will work with the patient to find an alternative that is satisfactory to the patient.

VII.

Personal Representatives

VII. Personal Representatives

As a general rule, Landy Headache & Esthetics will communicate directly with each patient concerning his or her protected health information.  However, under certain circumstances, another individual may act as Personal Representative on behalf of a patient.  This most often occurs with respect to decedents, unemancipated minors, and adults who are not competent to make health care decisions for themselves.  If a person is treated as a Personal Representative, that person stands in the shoes of the patient, and is entitled to authorize uses and disclosures of the patient’s protected health information, request access or amendment to the patient’s protected health information, and otherwise exercise the individual’s rights with regard to his or her protected health information.

Landy Headache & Esthetics may elect not to treat a person as a patient’s Personal Representative if Landy Headache & Esthetics decides in its professional judgment, that treating the person as a Personal Representative is not in the patient’s best interest, based upon a reasonable belief that the patient has been or may be subjected to domestic violence, abuse, or neglect by the person or that treating the person as the patient’s Personal Representative could endanger the patient.

Deceased Individuals.  If an executor or administrator has been appointed to act on behalf of a deceased individual or of the individual’s estate, Landy Headache & Esthetics shall treat such person as a Personal Representative with respect to protected health information relevant to such representation.  Prior to receiving information that an executor or administrator has been appointed, Mississippi law allows Landy Headache & Esthetics to disclose protected health information to up to three (3) of the decedent’s heirs upon receipt of an affidavit stating that no executor or administrator has been appointed and that the requestor is an heir of the decedent. 

Unemancipated Minors.  Landy Headache & Esthetics shall treat a person legally authorized to make health care decisions concerning an unemancipated minor as that minor’s Personal Representative except in cases in which the minor is permitted by law to receive health care without the Personal Representative’s consent. 

Adults Who Are Incompetent to Make Health Care Decisions.  If a patient’s attending physician determines, in his or her medical judgment, that the patient is incompetent to make health care decisions, a person who is legally authorized to make health care decisions for the patient shall be treated as the patient’s Personal Representative.  This person may be the patient’s guardian or conservator, or may have been named the patient’s agent in an advanced directive, or may act as surrogate under the Mississippi Uniform Health Care Decisions Act at Miss. Code Ann. §  41-41-201 et seq.

VIII.

USE AND DISCLOSURE
OF
PSYCHOTHERAPY NOTES

VIII. Use and Disclosure of Psychotherapy Notes

Landy Headache & Esthetics does not maintain psychotherapy notes. 

IX.

Sale of

Protected Health Information

IX. Sale of Protected Health Information

Landy Headache & Esthetics does not sell the protected health information of its patients or former patients without an authorization.

For purposes of this policy, “sale of protected health information” includes any disclosure of protected health information in exchange for which Landy Headache & Esthetics directly or indirectly receives payment.  It does not include disclosures for public health purposes, for treatment or payment, for sale of Landy Headache & Esthetics’ business, disclosures required by law, or payment of copying charges to Landy Headache & Esthetics or Landy Headache & Esthetics’ business associates.  Landy Headache & Esthetics may disclose protected health information for research purposes and receive a reasonable, cost-based fee to prepare and transmit the protected health information.

X.

Marketing

X. Marketing

Landy Headache & Esthetics will not use or disclose protected health information for marketing purposes without an authorization from the patient.  If Landy Headache & Esthetics receives any direct or indirect payment from a third party to make marketing communications to its patients, the authorization must indicate that the patient understands that such payment will be received.

Marketing does not include the following types of communication:

  • To provide refill reminders or otherwise communicate about a drug or biologic currently being prescribed for the patient, if the only payment received is reasonably related to the cost of making the communication; and
  • Treatment communications, including case management or care coordination, or to direct or recommend alternate treatments, therapies, health care providers or settings of care, for which Landy Headache & Esthetics receives no payment for making the communication.

XI.

Disclosure of Information

Related to

Alcohol or Substance Abuse Treatment

XI. Disclosure of Information Related to Alcohol or Substance Abuse Treatment

Landy Headache & Esthetics will not disclose information related to treatment for alcohol or substance abuse without a specific valid authorization for disclosure of such information.  A request for disclosure of information related to alcohol or substance abuse treatment will be reviewed by the Privacy Officer for compliance with federal and state regulations prior to disclosure.  Because Landy Headache & Esthetics participates with other health care providers in a shared electronic health record, other providers accessing the system may access such information in accordance with their own minimum necessary obligations under the HIPAA privacy rule.

XII.

Business Associates

  1. Business Associates

Business Associate Requirements.  Business Associates of Landy Headache & Esthetics are legally and contractually bound to protect protected health information.  All Business Associates will be provided with a copy of this Privacy Policy.

Disclosures to Business Associates.  Protected information may be disclosed to a Business Associate for purposes described in the Business Associate Agreement, and a Business Associate may be allowed to create or receive protected information on behalf of Landy Headache & Esthetics for these purposes, if Landy Headache & Esthetics obtains satisfactory assurance that the Business Associate will appropriately safeguard the information.  Landy Headache & Esthetics will secure a Business Associate Agreement which assures, with the signature(s) of the person or company entering into the agreement with Landy Headache & Esthetics that every attempt will be made to safeguard all protected health information in accordance with the HIPAA Privacy Rule.

    1. Incidental Access by Persons Other than Workforce or Business Associates.

In the event that any person or entity that is not a business associate but performs services for Landy Headache & Esthetics enters or sends personnel to Landy Headache & Esthetics who are permitted to enter areas of Landy Headache & Esthetics’ facility that house protected health information or workstations that access ePHI (as defined in the Security Policy, Landy Headache & Esthetics will request that person or entity sign an agreement to keep confidential any protected health information to which that person or entity is incidentally exposed.

XIII.

Notice of Privacy Practices

XIII. Notice of Privacy Practices

Patients will be given a Notice of Privacy Practices describing the uses and disclosures of protected health information that may be made, and notifying them of their rights and Landy Headache & Esthetics’ legal duties with respect to protected health information.  Landy Headache & Esthetics shall only use/disclose protected health information in accordance with the effective Notice of Privacy Practices

Each individual receiving services from Landy Headache & Esthetics (or his/her Personal Representative) shall receive a copy of the Notice of Privacy Practices on his or her first date of service and shall be asked to sign an acknowledgment of receipt of the Notice of Privacy Practices.  If a patient refuses to sign the Notice of Privacy Practices, Landy Headache & Esthetics will document the refusal in the individual’s record, but may continue to provide treatment to the individual.

XIV.

Valid Authorizations

  1. Valid Authorizations

Required Elements of Valid Authorization.  When an authorization is required, Landy Headache & Esthetics shall use an authorization to release protected health information containing, and will accept other authorizations containing, the required elements of a valid authorization as outlined in HIPAA privacy regulations.  These elements include:

  • A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion;
  • The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure;
  • The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure;
  • A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose;
  • An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement “end of the research study,” “none,” or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository;
  • Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual must also be provided;
  • A statement concerning the individual’s right to revoke the authorization in writing, and either (A) the exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) a reference to Landy Headache & Esthetics’ Notice of Privacy Practices, which describes the patient’s right to revoke;
  • A statement concerning the ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating either: (A) that Landy Headache & Esthetics may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization; or (B) the consequences to the individual of a refusal to sign the authorization when, in accordance with the HIPAA Privacy Rule, Landy Headache & Esthetics may condition treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization;
  • A statement concerning the potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by the HIPAA Privacy Rule.

Copy to the Individual.  If Landy Headache & Esthetics receives an authorization from an individual for a use or disclosure of protected health information, Landy Headache & Esthetics shall provide the individual with a copy of the signed authorization.  When an authorization is received, the employee receiving the authorization will make two copies:  one for the individual receiving services and another to be filed in the health record.

Validity of Authorizations Determination.  Prior to the release of any protected health information pursuant to an authorization, all authorizations shall be reviewed to determine the validity of such authorization.  Upon making a determination as to the validity of such authorization, the personnel responsible for medical records shall oversee the disposition of the requested information or the requested action.  The action taken will be consistent with the request and the minimum necessary standard.

VX.

Uses and Disclosures

Requiring an Opportunity

for the Individual

to Agree or Object

XV. Uses and Disclosures Requiring an Opportunity for the Individual to Agree or Object

In addition to treatment, payment, and health care operations, there are certain routine instances in which Landy Headache & Esthetics may use or disclose limited protected health information without an authorization if the patient has the opportunity to agree or object to the use or disclosure.  The patient’s agreement or objection to any of the following disclosures may be oral or written.  Oral agreements or objections should be documented in the patient’s medical record.

Permitted Uses and Disclosures.  Landy Headache & Esthetics may disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person’s involvement with the individual’s care or payment related to the individual’s health care.  Landy Headache & Esthetics may also use or disclose protected health information to notify, or assist in the notification of, a family member, a Personal Representative of the individual, or another person responsible for the care of the individual of the individual’s location, general condition, or death.

Uses and Disclosures with the Individual Present.  If the individual is present, or available, and has the capacity to make health care decisions, Landy Headache & Esthetics may either use or disclose protected health information if it obtains the individual’s agreement, provides the opportunity to object, or infers, based on professional judgment, that the individual does not object to the use or disclosure.  In such case, a notation will be made in the health record that the individual was present.

Emergency Circumstances.  If the opportunity to object cannot be practicably provided because of the individual’s incapacity or an emergency treatment circumstance, Landy Headache & Esthetics may use or disclose some or all of the protected health information if the disclosure is:

  • Consistent with a prior expressed preference of the individual, if any, that is known to Landy Headache & Esthetics; and/or;
  • In the individual’s best interest as determined by Landy Headache & Esthetics, in the exercise of professional judgment.

XVI.

Uses and Disclosures

For

Which an Authorization

Or

Opportunity to

Agree or Object

Is Not Required

  1. Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object is Not Required

Uses and Disclosures Required by Law.  Landy Headache & Esthetics may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.

Uses and Disclosures for Public Health Activities.  Landy Headache & Esthetics may disclose protected information for the purposes of reporting to a public health authority for specific purposes authorized by state or federal law.

Disclosures about Victims of Abuse, Neglect or Domestic Violence.  Landy Headache & Esthetics may disclose protected health information about an individual whom Landy Headache & Esthetics reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority to the extent that the disclosure is required by law, if the individual agrees to the disclosure; or if the individual is unable to agree because of incapacity.

When making a permitted disclosure related to victims of abuse, neglect or domestic violence, Landy Headache & Esthetics shall promptly inform the individual that such a report has been or will be made, unless, in the exercise of professional judgment, Landy Headache & Esthetics determines that:

  • Informing the individual would place the individual at risk of serious harm; or
  • Informing the individual would require informing a Personal Representative, and informing the Personal Representative would not be in the best interests of the individual because Landy Headache & Esthetics believes the Personal Representative is responsible for the abuse, neglect, or other injury.

Disclosures to Health Oversight Agencies.  Landy Headache & Esthetics may disclose protected health information to a health oversight agency for oversight activities authorized by law which are necessary for appropriate oversight of the health care system, governmental programs, entities subject to governmental regulatory programs; or entities subject to civil rights laws for which health information is necessary for determining compliance.  Examples of health care oversight entities likely to request protected health information include, but are not limited to, the following:

  • Mississippi Division of Medicaid
  • Centers for Medicare and Medicaid Services
  • Mississippi Attorney General’s Office
  • Social Security Administration
  • U.S. Department of Health and Human Services
  • Mississippi State Department of Health
  • Mississippi State Board of Medical Licensure
  • Mississippi Board of Nursing

Disclosures for Judicial and Administrative Proceedings.  Landy Headache & Esthetics may disclose protected health information in the course of any administrative or judicial proceeding:

  • In response to a court order; or
  • Under certain restricted circumstances, in response to a subpoena or similar process.  Responses to subpoenas for protected health information shall be approved by the Privacy Officer.

Disclosures for Law Enforcement Purposes.  Landy Headache & Esthetics may disclose protected health information for law enforcement purposes under certain circumstances, described below.  Law enforcement requests for protected health information shall be directed to the Privacy Officer, who will follow the requirements of the HIPAA Privacy Rule at 45 C.F.R § 164.512.

Landy Headache & Esthetics may disclose protected health information to law enforcement under the following circumstances:

  1. To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena, in accordance with 45 C.F.R. § 164.512(f)(1)(ii)(A)-(B).
  2. To respond to an administrative request, such as an administrative subpoena or investigative demand or other written request from a law enforcement official.
  3. To respond to a request for protected health information for purposes of identifying or locating a suspect, fugitive, material witness or missing person; but Landy Headache & Esthetics will limit disclosures of protected health information to name and address, date and place of birth, social security number, ABO blood type and rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics.  Other information related to the individual’s DNA, dental records, body fluid or tissue typing, samples, or analysis cannot be disclosed under this provision, but may be disclosed in response to a court order, warrant, or written administrative request.

This same limited information may be reported to law enforcement about a suspected perpetrator of a crime when the report is made by the victim who is a member of the covered entity’s workforce, or to identify or apprehend an individual who has admitted participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to a victim, provided that the admission was not made in the course of or based on the individual’s request for therapy, counseling, or treatment related to the propensity to commit this type of violent act.

  1. To respond to a request for protected health information about a victim of a crime, if the victim agrees.  If, because of an emergency or the person’s incapacity, the individual cannot agree, Landy Headache & Esthetics may disclose the protected health information if law enforcement officials represent that the protected health information is not intended to be used against the victim, is needed to determine whether another person broke the law, the investigation would be materially and adversely affected by waiting until the victim could agree, and Landy Headache & Esthetics believes in its professional judgment that doing so is in the best interests of the individual whose information is requested.

In accordance with Mississippi law, Landy Headache & Esthetics will report suspicions of child abuse or neglect to a law enforcement official authorized by law to receive such reports.  The agreement of the child or personal representative is not required.  Similarly, Landy Headache & Esthetics will report suspicions of abuse, neglect, or domestic violence toward vulnerable adults to a law enforcement official authorized by law to receive such reports:

  • if the individual agrees;
  • if the report is required by law; or
  • If the report is expressly authorized by law, and based on the exercise of professional judgment, Landy Headache & Esthetics believes the report is necessary to prevent serious harm to the individual or others, or in certain other emergency situations.
  • Notice to the individual of the report may be required in accordance with 45 C.F.R. § 164.512(c)(2).
  1. To report protected health information to law enforcement when required by law to do so.
  2. To alert law enforcement to the death of the individual, when there is a suspicion that death resulted from criminal conduct.  Additionally, Landy Headache & Esthetics may disclose information about a decedent to medical examiners or coroners to assist them in identifying the decedent, determining the cause of death, or to carry out their other authorized duties.
  3. To report protected health information that Landy Headache & Esthetics in good faith believes to be evidence of a crime that occurred on Landy Headache & Esthetics’ premises.
  4. When responding to an off-site medical emergency, as necessary to alert law enforcement about criminal activity, specifically, the commission and nature of the crime, the location of the crime or any victims, and the identity, description and location of the perpetrator of the crime.
  5. When consistent with applicable law and ethical standards, to a law enforcement official reasonably able to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public, or to identify or apprehend an individual who appears to have escaped from lawful custody.
  6. For certain other specialized governmental law enforcement purposes, such as disclosures to federal officials authorized to conduct intelligence, counter-intelligence, and other national security activities under the National Security Act, to provide protective services to the President and others and conduct related investigations, or to respond to a request for protected health information by a correctional institution or a law enforcement official having lawful custody of an inmate or others if they represent such protected health information is needed to provide health care to the individual; for the health and safety of the individual, other inmates, officers or employees of or others at a correctional institution or responsible for the transporting or transferring inmates; or for the administration and maintenance of the safety, security, and good order of the correctional facility, including law enforcement on the premises of the facility.  Such disclosure will be reviewed in advance by the Privacy Officer.

Uses and Disclosures for Research Purposes.  In accordance with the HIPAA Privacy Rule, written authorization to use or disclose protected health information is required for research purposes with the following exceptions:

  • The use of protected health information is solely to prepare for research and the information does not leave Landy Headache & Esthetics;
  • The protected health information is partially de-identified according to the limited data set rule and the researcher and anyone who will receive the information signs a data use agreement; or
  • A waiver is granted.

Landy Headache & Esthetics may grant a waiver upon determining that use or disclosure of the protected health information involves no more than minimal risk to the privacy of individuals, and the research could not practicably be conducted without the waiver and without access to and use of the protected health information.  Determination of “no more than minimal risk to the privacy of individuals” will be based on the presence of the following criteria:

  • An adequate plan to protect identifiers from improper use and disclosure;
  • An adequate plan to destroy the identifiers at the earliest opportunity, unless there is a health or research justification for retaining the identifiers or retention is otherwise required by law;
  • Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research which the use or disclosure of protected health information is permitted under HIPAA.

Disclosure for Workers’ Compensation or Other Employment Laws Landy Headache & Esthetics may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs, established by law, that provide benefits for work related injuries or illness without regard to fault.

XVII.

Access of Individual

To

Protected Health Information

XVII. Access of Individual to Protected Health Information

Right of Access.  Individuals have a right of access to protected health information that is used, in whole or in part, to make decisions about them, including information used to make health care decisions. 

Duration of the Right of Access.  Individuals may request access to their protected health information for as long as Landy Headache & Esthetics maintains such information.

Exceptions to Right of Access.  Individuals do not have the right of access to the following types of protected information:

  • Psychotherapy notes; and
  • Information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding.  Landy Headache & Esthetics may deny access to any information that relates specifically to legal preparations but may not deny access to the individual’s underlying health information.

Landy Headache & Esthetics is not required to provide and may be legally prohibited from providing access to such information.  Requests for this information and a decision that results in a denial of access are not subject to review. 

Grounds for Denial of Access.  Landy Headache & Esthetics may deny access to an individual’s access to protected health information for one of several reasons:

Un-Reviewable Grounds for Denial of Access.  Landy Headache & Esthetics may deny an individual access to protected health information without providing the individual an opportunity for review, in the following circumstances:

  • The protected health information is excepted from the right of access as described under “Exceptions to the Rights of Access,” above.
  • An individual’s access to protected health information created or obtained by Landy Headache & Esthetics in the course of research that includes treatment may be temporarily suspended for as long as the research is in progress, provided that the individual has agreed to the denial of access when consenting to participate in the research that includes treatment, and the covered health care provider has informed the individual that the right of access will be reinstated upon completion of the research.
  • An individual’s access to protected health information that is contained in the records were obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be likely to reveal the source of the information.

Reviewable Grounds for Denial of Access.  Landy Headache & Esthetics may deny access to protected health information under certain circumstances in which the access may harm the individual or others.  Landy Headache & Esthetics may deny access for these reasons if Landy Headache & Esthetics provides the individual with a right to have the denial reviewed:

  • A licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person;
  • The protected health information makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person; or
  • The request for access is made by the individual’s Personal Representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such Personal Representative is reasonably likely to cause substantial harm to the individual or another person.

Requests for Access and Timely Action.  Landy Headache & Esthetics shall take action on a request for access as soon as possible, but not later than thirty (30) days following the request.  Landy Headache & Esthetics shall permit an individual to request access to inspect or to obtain a copy of the protected health information about the individual that is maintained in a designated record set.  Additionally, Landy Headache & Esthetics shall require individuals to make requests for access in writing.  Landy Headache & Esthetics must act on a request for access within thirty (30) days of receiving the request.

If Landy Headache & Esthetics is unable to act on a request within the applicable deadline, it may extend the deadline by no more than thirty (30) days by providing the individual with a written statement of the reasons for the delay and the date by which Landy Headache & Esthetics will complete its action on the request.  This written statement describing the extension must be provided within the standard deadline.  Landy Headache & Esthetics may only extend the deadline once per request for access.

Provision of Access.  Individuals desiring to access their record will provide a written notice to Landy Headache & Esthetics’ Privacy Officer.  Upon receipt of a written request for access, the Privacy Officer shall determine whether disclosure of the information requested meets the criteria for denial set forth above.  The Privacy Officer may consult with the patient’s physician in making this determination.  The Privacy Officer shall notify the individual of the decision of acceptance or denial of the request in writing and document the decision in the patient’s record.  If denied, the justification for denial shall also be included in the record.

If a request is accepted, in whole or in part, the individual shall be notified of the decision and provided the access requested or allowed.  If the accepted request is to inspect the record, the physician or the physician’s designee shall review the specified section of the record with the individual and make a note in the record.  If the request involves a copy of specified information, whether paper or electronic, the individual shall be informed of any fees associated with the request and, if the individual agrees, copies will be provide to the individual upon receipt of payment. 

Landy Headache & Esthetics will provide the information requested in the form or format requested if it is readily producible in such form or format, including in electronic format for records maintained electronically.  Additionally, if the information is not available in the form or format requested, Landy Headache & Esthetics shall produce a readily readable hard copy of the information or another form or format to which the individual and Landy Headache & Esthetics can agree.  It the individual agrees, including agreeing to any associated fees, Landy Headache & Esthetics may provide access to a summary of information rather than all protected health information in a designated record set.

Landy Headache & Esthetics will provide the access requested in a timely manner and arrange for a mutually convenient time for the individual to inspect the protected health information or obtain a copy.  If the individual requests that Landy Headache & Esthetics mail a copy of the information, Landy Headache & Esthetics will do so, and may charge reasonable fees for copying and mailing. 

If the individual requests a copy of protected health information, the individual shall be informed that a copying fee as set by Landy Headache & Esthetics shall be assessed.  Landy Headache & Esthetics shall not charge any fees for retrieving or handling the information or for processing the request.  The inclusion of a fee for copying is not intended to impede the ability of individuals to copy their records.

Denial of Access.  If access is denied, in whole or in part, Landy Headache & Esthetics must, to the extent possible, give the individual access to any other protected health information requested after excluding the protected information to which Landy Headache & Esthetics has reason to deny access.  Only the information that falls within one or more of the denial criteria will be excluded and the individual shall be permitted to inspect and copy all of the remaining information, to the extent it is possible to do so.

If a request for access is denied, in whole or in part, Landy Headache & Esthetics will provide the individual a written statement in plain language regarding the basis for the denial and how the individual can make a complaint.  If the request for access is denied based upon reviewable grounds for denial, the written denial shall describe the individual’s right to a review of the denial and how the individual may exercise this right. 

If the request is denied because the requested information is not in Landy Headache & Esthetics’ possession, and Landy Headache & Esthetics has knowledge of where the information is maintained, Landy Headache & Esthetics will inform the individual where to direct the request for access.

Review of Denial of Access.  Landy Headache & Esthetics, when denying an individual’s request for access, will inform the individual of how to make a complaint.  In addition, if Landy Headache & Esthetics denies the request on the basis of one of the reviewable grounds for denial, the individual has the right to have the denial reviewed by a licensed health care professional who is designated by Landy Headache & Esthetics to act as a reviewing official and who did not participate in the original decision to deny access.  Landy Headache & Esthetics must provide access in accordance with the reviewing official’s determination.

Reviewing Official.  If the individual requests a review of a denial, Landy Headache & Esthetics shall designate a licensed health care professional to act as the reviewing official.  This reviewing official shall not have been involved in the original decision to deny access.  The request for review, when received by the Privacy Officer, shall be referred to the designated reviewing official within seven (7) calendar days of receipt.  The reviewing official, within fourteen (14) calendar days, shall determine whether or not to deny the access requested.  The Privacy Officer shall provide the individual with written notice of the decision within fourteen (14) calendar days of the completion of the reviewing official’s review.

XVIII.

Amendment

of

Protected Health Information

  1. Amendment of Protected Health Information

Right to Amend.  An individual has the right to request that protected health information in the designated record set be amended for as long as Landy Headache & Esthetics maintains the information.

Request for Amendment.  Any request for amendment must be submitted, in writing, to the Privacy Officer.  The Privacy Officer will notify the individual making the request, in writing, of the decision.

Denial of Request for Amendment.  The request to amend will be denied if the Privacy Officer determines that the record:

  • Was not created by Landy Headache & Esthetics, unless there is a reasonable basis to believe that the originator of the records is no longer available to act on the request.
  • Is not part of the designated record set.
  • Would not be available for inspection; or,
  • Is accurate and complete.

Acceptance of a Request for Amendment.  If the request for amendment is accepted, Landy Headache & Esthetics shall:

  • Make the amendment by identifying the affected records and appending or otherwise providing a link to the location of the amendment.  Under no circumstances should information be deleted in its entirety.
  • Inform the individual that the amendment has been accepted and obtain the individual’s identification of an agreement to have Landy Headache & Esthetics notify relevant persons with a need to know.
  • Make reasonable efforts to inform and timely efforts to provide the amendment to those persons and others, including Business Associates, that Landy Headache & Esthetics knows to have affected protected health information and who may have relied, or be foreseen to rely, on that information to the detriment of the individual.

XIX.

Request

For

Accounting of Disclosure(s)

XIX. Request for Accounting of Disclosure(s)

An individual has a right to receive an accounting of disclosures of his/her protected health information.  All requests for disclosure of protected information shall be submitted in writing to the Privacy Officer.  After determining the validity of the identity of the entity, or individual, requesting the use or disclosure of the protected information, the request shall be reviewed and a determination will be made concerning the approval or denial of such request.  The Privacy Officer may approve the request in whole or in part.

Notification of Approval or Denial of Requests for Accounting of Disclosure(s).  A written notification of either approval or denial shall be issued by the personnel responsible for Medical Records within 14 days of receipt of the request for disclosure.  Copies of the response shall be forwarded to the appropriate hospital personnel.

Maintaining an Accounting Record for Disclosures.  Landy Headache & Esthetics shall maintain an accounting of disclosures of protected health information to other entities as follows:

When a disclosure that requires an accounting is made, the date requested, who requested the accounting, a description of the requested information, staff completing the request, and the date the information was provided will be documented in the medical record on a disclosure log.

Disclosures that do not require accounting are those:

  • To carry out treatment, payment, and health care operations;
  • To individuals of protected health information about them;
  • Incident to a use or disclosure otherwise permitted or required;
  • Pursuant to an authorization;
  • For Landy Headache & Esthetics’ directory or for disaster relief;
  • To persons involved in the individual’s care or other notification purposes;
  • For national security of intelligence purposes;
  • To correctional institutions or law enforcement officials;
  • As part of a limited data set;
  • That occurred prior to the date of compliance (April 14, 2003).

Providing an Accounting Record to an Individual upon Request.  Individuals may request an accounting of disclosures of their protected health information as follows:

  • A written request for the disclosure shall be made by the individual.
  • The accounting shall be provided within sixty (60) days by means of a copy of the disclosure log.  A one-time thirty (30) day extension is available after receipt of such a request by the individual.  One accounting of disclosures will be provided to the individual at no charge per calendar year.  Additional accounting disclosure requests will be subject to a copying charge as set by Landy Headache & Esthetics provided that the individual is informed in advance of the fee and is given an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee.
  • An individual may request an accounting of disclosures for any period of time less than six (6) years prior to the date of the request.
  • A copy of the disclosure along with the date of disclosure, name of receiving individual, and the title and name of the person responsible for processing the accounting disclosure shall be documented and retained in the client’s medical record.
  • The accounting shall include disclosures made by Landy Headache & Esthetics employees, agents, or volunteers, disclosures to Landy Headache & Esthetics’ business associates, and disclosures by Landy Headache & Esthetics’ business associates to other persons or entities.

Suspension of Individual’s Right to Receive Accounting of Disclosures.  Landy Headache & Esthetics shall temporarily suspend an individual’s right to receive an accounting of disclosures to a health oversight agency or law enforcement official if in accordance with applicable law, such agency or official provides Landy Headache & Esthetics with a written statement that such an accounting to the individual would be reasonably likely to impede a law enforcement or health oversight agency’s investigation.  The statement shall also specify the time for which such a suspension is required.  If the statement is made orally, Landy Headache & Esthetics shall document the statement, including the identity of the law enforcement official making the statement.  Landy Headache & Esthetics shall temporarily suspend an individual’s right to receive an accounting of disclosures and shall limit the suspension to no longer than thirty (30) days from the oral statement unless a written statement is received during that time.  A written statement shall be requested by Landy Headache & Esthetics at the time that the oral request is made.

XX.

Notification of Breach

of

Unsecured Protected Health Information

XX. Notification of Breach of Unsecured Protected Health Information

Upon discovery of  a breach of unsecured protected health information, Landy Headache & Esthetics shall notify the patient or the patient’s personal representative of the breach without unreasonable delay and in no case later than sixty (60) days of discovering the breach.  Landy Headache & Esthetics will also comply with the HIPAA Privacy Rule’s requirements for notifying DHHS and the media, if applicable.

A breach is considered discovered as of the first day on which the breach is known by any employee or agent of Landy Headache & Esthetics other than the person responsible for the breach.  Landy Headache & Esthetics’ business associates are required to report any breach to Landy Headache & Esthetics upon discovery.

If a law enforcement official informs Landy Headache & Esthetics that a notification, notice, or posting would impede a criminal investigation or cause damage to national security, such notification, notice or posting shall be delayed in the same manner as provided under § 164.528(a)(2) of title 45, Code of Federal Regulations.

Definition of Breach.  For purposes of this Section XVIII, a “breach” shall mean acquisition, access, use, or disclosure of protected health information in a manner that is not permitted by the HIPAA Privacy Rule which compromises the security or privacy of such information. 

For purposes of breach notification, any acquisition, access, use or disclosure of protected health information that does not comply with the HIPAA Privacy Rule will be presumed to be a “breach” unless the Privacy Officer, in consultation with legal counsel, determines that there is a low probability that the protected health information has been compromised.

The following occurrences are NOT considered “breaches” for purposes of this Section XVIII:

  • Any unintentional acquisition, access, or use of protected health information by a member of Landy Headache & Esthetics’ workforce or an individual acting under the authority of Landy Headache & Esthetics or its business associate if
    • Such acquisition, access, or use was made in good faith and within the course and scope of authority, and
    • Such information is not further used or disclosed in a manner not permitted by the HIPAA Privacy Rule.
  • Any inadvertent disclosure by a person who is authorized to access protected health information at Landy Headache & Esthetics or Landy Headache & Esthetics’ business associate, to another person authorized to access protected health information at Landy Headache & Esthetics, Landy Headache & Esthetics’ business associate. or an organized health care arrangement in which the Landy Headache & Esthetics participates; and any such information received as a result of such disclosure is not further used or disclosed in a manner not permitted by the HIPAA Privacy rule.
  • A disclosure of protected health information where Landy Headache & Esthetics or Landy Headache & Esthetics’ business associate has a good faith belief that the unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Notification to Patients.

1. Upon discovery of a breach, Landy Headache & Esthetics must provide written notice to the patient or:

a. If the patient is deceased, the patient’s next of kin or personal representative.

b. If the patient is incapacitated/incompetent, the patient’s personal representative.

c. If the patient is a minor, the patient’s parent, guardian, or personal representative.

2. Written notification must be provided as soon as possible, but no later than sixty (60) days after discovery of the breach.  The notice must be in plain language at an appropriate reading level with clear syntax and language with no extraneous materials.

3 Written notification must be sent to the last known address of the patient or next of kin, or if specified by the patient, by encrypted electronic mail.

4. In the case where there is insufficient or out-of-date contact information that precludes direct written notification to the patient:

a. For less than ten (10) individuals, a substitute form of notice, such as a telephone call, shall be provided.

b. If there are ten (10) or more individuals for which there is insufficient or out of date contact information and contact information is not obtained, Landy Headache & Esthetics shall:

(1) Post a conspicuous notice for ninety (90) days on the homepage of Landy Headache & Esthetics’ website that includes a toll-free number; or

(2) Provide notice in major print or broadcast media in the Landy Headache & Esthetics service area where a patient can learn whether their unsecured protected health information may be included in the breach.  A toll-free number will be included in the notice.

5. If Landy Headache & Esthetics determines the patient should be notified urgently of a breach because of possible imminent misuse of unsecured protected health information, Landy Headache & Esthetics may, in addition to providing notice as outlined in steps 2-4 above, contact the patient by telephone or other means, as appropriate.

Media Notification.  In the case where a single breach event affects more than five hundred (500) residents of the same state, Landy Headache & Esthetics shall provide notice to prominent media outlets.  Notice to media outlets shall be provided as soon as possible, but no later than sixty (60) days after discovery of the breach, and shall include information listed below under “Content of Notification.”

DHHS Notification.  Landy Headache & Esthetics will maintain a log of any breaches of protected health information that occur during a calendar year.

1. For any breach affecting less than five hundred (500) individuals occurs, Landy Headache & Esthetics will use the electronic form available on the DHHS website, and will submit the form to DHHS no later than sixty (60) days after the end of the calendar year. 

2. Landy Headache & Esthetics will provide notice to DHHS without unreasonable delay and in no case later than sixty (60) days from the breach discovery if a single breach event affecting the protected health information of five hundred (500) or more individuals occurs.  Landy Headache & Esthetics will use the electronic form available on the DHHS website when notifying DHHS of breaches involving five hundred (500) or more individuals.

Content of Notification.  Regardless of the method by which the notice is provided, notice of the breach must include:

1. A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known.

2. A description of the types of unsecured protected health information that were involved in the breach, such as full name, Social Security Number, date of birth, home address, account number, diagnosis code or disability code.  Only the generic type of protected health information should be listed in the notice (i.e., date of birth rather than the patient’s actual birth date).

3. The steps the individual should take to protect themselves from potential harm resulting from the breach.

4. A brief description of what the covered entity is doing to investigate the breach, mitigate harm to the individual, and to protect against any further breaches.

5. Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, website, or postal address.

XXI.

Administrative Requirements

XXI. Administrative Requirements

Privacy Officer.  Landy Headache & Esthetics shall designate a Privacy Officer who is responsible for the development and implementation of this privacy policy and overseeing Landy Headache & Esthetics’ HIPAA Privacy Rule compliance program.  The Privacy Officer is also responsible for receiving complaints in regard to matters covered by Landy Headache & Esthetics’ Notice of Privacy Practices.  All complaints regarding privacy issues will be handled in accordance with established grievance procedures.

Retention of Documentation.  All required documents related to the HIPAA Privacy Rule shall be retained for six (6) years from the date of its creation or the date when it last was in effect, whichever is later.  This includes, but is not limited to, any authorization, request, response, policy and procedure, or any tracking device utilized for monitoring releases or uses of protected information.

Changes to Policies and/or Procedures.  Landy Headache & Esthetics shall change policies and procedures as necessary and appropriate to comply with changes in the law.  When these changes are necessary, and a material change is made to a privacy practice that is stated in the notice, then Landy Headache & Esthetics may make the changes effective for protected health information that it created or received prior to the effective date of the notice revision as there is a statement in the notice in which Landy Headache & Esthetics reserves its right to make such a change in its privacy policy. 

All staff shall receive training concerning any material changes made to the policies and procedures within a reasonable time period.

Training.  Landy Headache & Esthetics shall train all members of its workforce with respect to protected health information.  Such training shall be incorporated in new employee training and periodic retraining.  A copy of this Privacy Policy shall be provided to all members of Landy Headache & Esthetics’ workforce.  A copy shall also be provided to Landy Headache & Esthetics’ business associates, who shall be responsible for providing appropriate training to their employees and agents.

Any material changes in Landy Headache & Esthetics’ privacy practices due to changes in the law will result in additional workforce training regarding the change(s) within a reasonable period of time following the change.

All staff members receiving training will sign an acknowledgement of such training.  This document shall be maintained in each workforce member’s personnel folder.

Complaint Procedure.  Individuals treated by Landy Headache & Esthetics and employees, agents, and business associates of Landy Headache & Esthetics who became aware of or suspicious of a violation of this policy or the HIPAA Privacy Rule may file a complaint with Landy Headache & Esthetics’ Office Manager.  All complaints received and their dispositions, if any, shall be documented.  Landy Headache & Esthetics will make every effort to preserve the anonymity of persons filing complaints.  Retaliation toward a person filing a complaint is strictly prohibited.

Report of Suspicious Activity.  Employees are to report any violation or suspected violation of Landy Headache & Esthetics’ privacy policy to the Office Manager immediately.  The Office Manager will investigate all reports and shall report the results of such investigation to the Medical Director, Stephen Landy, MD for resolution. 

Any employee with knowledge of unauthorized activity is REQUIRED to report such activities.  In neglecting to do so, the employee assumes the same liability as those participating in the unauthorized activity.

Sanctions.

Inappropriate use or disclosure of protected health information by a member of Landy Headache & Esthetics will result in immediate termination of the employee’s access to the electronic health record and may also result in immediate termination of employment.