POLICIES Supersedes Series No:

Transcription

1 Series No CENTRAL INTERMEDIATE UNIT Date Approved: 9/23/2010 Date Revised: Date Amended: POLICIES Supersedes Series No: TITLE: HIPAA Compliance Plan (Partial Hospitalization Program) POLICY: 5505 It is the policy of the Central Intermediate Unit # 10 to retain clients health information and documentation of compliance with the HIPAA Privacy Regulations, pursuant to the following schedule: Client s Medical/Treatment Chart If the client is under the age of 18, the chart shall be retained for at least two years after the client s 18 th birthday Client s Billing File If the client is under the age of 18, the billing file shall be retained for at least two years after the client s ALL Documents Originated by an Agency or Agencies Other Than CIU#10, and Psychotherapy Notes If and Whenever Applicable Crisis Logs, Quality Assurance and Utilization Review Materials, and Incident Reports Each Version of Notice of Privacy Practices date of document Seven years from last date in effect

2 Consents for Use/Disclosure of Health for Treatment, Payment or Health Care Operations Seven years from last date of treatment If revoked, document shall be retained with revocation form for seven years from date of revocation. Authorization Forms Seven years from expiration date Responses to Requests for Release of Client Pursuant to Authorization Form Warrants, Subpoenas, Court Orders and/or Administrative/Governmental Requests Concerning Release of Client Responses to Requests for Release of Client Pursuant to Authorization Form Warrants, Subpoenas, Court Orders and/or Administrative/Governmental Requests Concerning Release of Client Responses to Warrants, Subpoenas, Court Orders and/or response to request for release of information response response to request for release of information response response

3 Administrative/Governmental Requests Concerning Release of Client Requests for Accounting date of accounting Disclosure Sheets If disclosure sheets involve a client under the age of 18, all disclosure sheets shall be retained for at least two years after the client s Requests for Restriction on Uses and/or Disclosures and/or for Confidential Communications Denials of Requests for Restriction on Uses/Disclosures and/or for Confidential Communications Responses to Requests for Restriction on Uses/Disclosures and/or for Confidential Communications, where Request has been Granted Complaint Forms Concerning Privacy Practices date of response to or denial of request forms shall be retained for at date of denial of request If response involves a client under the age of 18, response shall be retained for at least two years after the client s 18 th birthday. date of response to complaint If complaint involves a client under the age of 18, complaint

4 forms shall be retained for at Responses to Complaint Forms Concerning Privacy Practices Requests for Amendment of Health Responses to or Denials of Requests for Amendment of Health Requests for Access to Health by Clients and/or Legal Representative Responses to or Denials of Requests for Access to Health by Clients and/or Legal Representative, with or without Requests for Review of Access Denial Decisions of Reviewing Official on Review of Access Denial Copies of Powers of Attorney, Guardianship Orders, Letters of Administration, Letters Testamentary, Custody Orders, or Other Proof of Status of Legal Representative date of response to complaint If complaint involves a client under the age of 18, response to complaint shall be retained for at least two years after the client s date of response to request date of response to complaint If complaint involves a client under the age of 18, response to request for amendment shall be retained for at least two years after the client s 18th birthday. response to or denial of request, or from date of reviewing official s letter of decision (if review requested) Seven years from the date of response to or denial of request, or from date of reviewing official s letter of decision (if review requested) Seven years from the date of reviewing official s letter of decision As long as the client s medical chart and/or consent for use/disclosure for treatment, payment or healthcare operations, is maintained Policies and Procedures Concerning Seven years from last date

5 Maintaining, Retaining, Safeguarding, Requesting, Using and/or Disclosing Health and Related Documentation All Versions of The Matrix/Table of Workforce Access Determinations Pursuant to Minimum Necessary Standard All Versions of Personnel and Other Designations Made Pursuant to the HIPAA Privacy Regulations Contracts with Business Associates as Defined by HIPAA Privacy Regulations Contracts with Business Associates as defined by HIPAA Privacy Regulations Correspondence to and/or Received from HIPAA Business Associates Concerning Breach, Accounting of Disclosures, Amendment of, Termination of Agreement Due to Breach, Destruction or Return of, or Other HIPAA-related Obligations Certificates of Destruction by Third Party (including HIPAA Business Associates) policy or procedure was in effect Seven years from last date each version of The Table of Workforce Access Determinations, was in effect Seven years from last date each version of personnel or other designation was in effect Seven years from expiration date of contract or from termination of contract, whichever occurs first Seven years from expiration date of contract or from termination of contract, whichever occurs first most recent correspondence Indefinitely Destruction Log Indefinitely Documentation of Completion of Workforce Training Personnel File Documentation of Workforce Privacy Sanctions Applied Seven years from last date of employment completion of workforce sanction It is further the policy of CIU # 10 that whenever destruction of client health information of any sort, or other related documents, is permitted pursuant to this retention schedule, destruction shall be completed pursuant to the following guidelines:

6 1. Documents shall only be destroyed by a process of shredding, leaving no readily readable portion of the document. 2. Immediately upon destruction of any documentation listed in the schedule above, the staff member charged with the duty of destruction shall immediately document in the Destruction Log: (1) the date of destruction; (2) a description of the documents destroyed consistent with the titles in the schedule above, including where appropriate the name of the client(s) to whom individually identifiable health information relates; (3) the manner of destruction; and (4) the signature of the person completing the destruction. Legal Reference: 24 PS-9-964