Section 3 Personnel


Policy 3-26 HEALTH INSURANCE PORTABILITY AND ACCOUNTIBILITY ACT (HIPPA) OF 1996 PRIVACY NOTICE

DATE:        March 14, 2003

DISTRIBUTION:    Departments/Divisions

SUBJECT:    Health Insurance Portability and Accountability Act (HIPPA) of 1996 Privacy Notice

PURPOSE:    To put forth in writing the City Manager’s position on Health Information Privacy.

BACKGROUND:    This policy describes how medical information about employees is used and disclosed to third parties and how an employee can get access to this information.  Any employee having questions about Health Information Privacy should contact the Human Resources (HR) Department.

POLICY/
PROCEDURES:    Protected Health Information shall be maintained by the City of Lawton

City of Lawton policy is to protect the privacy of health information of its employees.  Federal Law requires the city to maintain the privacy of employee health information and to provide employees with a health privacy information notice.  This policy applies to all participants in the City of Lawton Benefit Plan to include all employees and any business associates or agents of the city.  This policy describes how the city may collect, use, and disclose an employee’s health information.  It also describes employee rights concerning health information.

Employees should be familiar with the term “protected health information” or PHI.  PHI is information created or received by the city about the employee, including health and demographic information, which can reasonably be used to identify an individual.  PHI include information that relates to an employee’s past, present, and future physical or mental condition, the provision of health care, and payment for that care.

    A.    Privacy Official.

    The HR Director is the appointed privacy officer for the City of Lawton.  All questions concerning PHI should be directed to the HR Department.

    B.    PHI Use.

    Listed below are some examples of ways the city may use or share PHI without prior employee or benefit participant consent or authorization.  These examples are considered to be related to treatment, payment and health care operations:

    *    Managerial and oversight functions such as auditing and monitoring the     expenditures and claims for the Employee Group Health and Dental plan.

    *    Group Health and Dental Plan third party administrator actions relating to claims activities involving payment and medical management functions.

    *    Organizations that help the city conduct business operations.  The city shall only     share PHI with businesses and business agents that agree to keep PHI     safeguarded.

    C.    Health Oversight Activities:

        There are state and federal laws that may require or allow the city to release PHI. The city may be required to provide information for the following reasons:

    *    Government Authorization or Law.  The City may disclose employee PHI to a government agency authorized to oversee the health care system or government programs, or it contractors for activities authorized by law.

    *    Legal Proceedings:    The city may disclose PHI in response to a court of administrative order, subpoena, discovery request, or other lawful process, under certain circumstances.

    *    Law Enforcement:    The city may disclose PHI to law enforcement officials     under limited circumstances.  For example, in response to a warrant or subpoena,     or for the purpose of identifying or locating a suspect, witness, or missing person,     or to provide information concerning victims of crimes.

    *    Public Health Activities:    The city may disclose PHI to a government agency     that oversees the health care system or government programs for activities such as preventing or controlling disease or activities related to the quality, safety, or effectiveness of an FDA regulated product or activity.

    *    Workers’ Compensation:    The city shall disclose PHI if so required by     worker’s compensation law or the court.

    *    Victims of Abuse, Neglect, or Domestic Violence:    The city may disclose PHI to appropriate authorities if it reasonably believes that an employee is a possible
        victim of abuse, neglect, domestic violence or other crimes.

    *    Coroners, Funeral Directors, and Organ Donation:    The city may disclose     PHI to coroners/funeral directors in connection to organ donation.

    *    Research:    The city may disclose PHI to researchers, if certain established     steps are taken to protect the employee’s privacy.

    *    Threat to Health or Safety:    The city may disclose PHI to the extent necessary to avert a serious and imminent threat to employee health or safety or the health or     safety of others.

    *    For Specialized Government Functions:    The city may disclose PHI in certain circumstances or situations to a correctional institution if the employee is an     inmate in a correctional facility, to an authorized federal official when it’s     required for lawful intelligence or other national security activities, or to an     authorized authority of the Armed Forces.

    *    Cadaver Organ, Eye, or Tissue Donation:    The city may disclose PHI for the purpose of facilitating organ, eye, or tissue donation and transplantation if the employee has provided written authorization for such to the HR Department.

    D.    Employee Rights

    An employee has the following rights regarding PHI:

    *    Restricted Access.    An employee has the right to ask the HR Department to restrict city use and disclosure of PHI for the purposes of treatment, payment or health care operations.  This includes uses and disclosures to family members, relatives, close personal friends, or other person identified by the employee who may be involved with an employee’s care or payment for treatment.  The HR Department shall consider the request, but isn’t required to agree to restrict the information.

    *    Confidential Communications.    An employee may request that communications from the city of the employee be provided via alternative means or to an alternative location. The employee must request this in writing and clearly state that city disclosure of all or part of that communication could threaten or harm their interest(s).  The employee must also provide to the city the alternative location (e.g., fax number, address, etc.) to which the employee would like the PHI sent.

    *    Inspection and Copy of PHI.      An employee may request and obtain copy of the PHI that the HR Department maintains about you in a designated record set.  A designated record set contains PHI that the City collects, maintains or uses to administer to make decisions regarding employee enrollment, payment, claims adjudication, case/medical management.  If HR doesn’t maintain the PHI, but is aware of what entity does, the employee shall be told by the HR Department.  HR may charge a reasonable, cost-based fee to provide the employee with the information.  There are exceptions as to what information can be accessed.  For example, information compiled for legal proceedings cannot be accessed.  If HR denies access to employee information, in part or in whole, they shall notify the employee in writing.  HR denial will include the reason for the denial, employee review rights (if applicable), and information on how to file a complaint.  

    *    PHI Amendment.     An employee may request the HR Department amend PHI that’s contained in a designated record set (as described above).  All amendment requests must be in writing and include a reason for the request.  The city shall respond with 60 days of receiving the request.  If the request is approved, the HR Department shall amend the information in its records and notify any other individual(s) known by the city or the employee that would be affected.  In certain cases, an employee request may be denied. For example, the city may deny a request if the information on file is accurate or if the city didn’t create the information.  For example, the city may deny a request if the information on file is accurate or if the city didn’t create the information.  The HR Department shall notify the employee in writing of any denial.  The employee may respond by filing a written statement of disagreement with the HR Department, and the HR Department has the right to rebut the disagreement statement.  Should this occur, the employee has the right to request the original employee request, the City’s request denial, and any statement of disagreement, along with the City’s rebuttal, be included in future disclosures of the PHI.

    *    Disclosure Accounting.    An employee may request an accounting of certain PHI disclosures.  An accounting will show the employee to whom HR has provided PHI.  The first accounting request in a 12-month period of time is provide free of charge. Subsequent requests are subject to a reasonable, cost-based fee, of which the employee shall be made aware of in advance.  Disclosure requests must be made in writing.  HR shall respond within 60 days of receipt.  HR isn’t always required to provide PHI disclosure.  For example, HR isn’t required to account for disclosures made for the purposes of treatment, payment, or health care operations.  Also, HR doesn’t provide accountings for disclosures that the employee has authorized, and certain other disclosures such as for national security purposes.  

For more information, or to begin the formal process connected with these rights, please contact the Human Resources Department.

    E.    Complaints and Inquires

    Employee may register a complaint to the HR Department if they believe that their privacy rights have been violated.  Employees may also file a complaint with the Department of Health and Human Services.  Complaints must be submitted in writing.  Complaints should include the following:

    *Employee name.
    *Address or other means of communicating with you in writing.
    *Telephone number where you can be reached.
    *Brief description of the nature of your complaint (who, what, where and when).
    *Other relevant information.

NOTE:  An employee shall not be retaliated against or denied any health plan benefit or service because of a PHI violation complaint.  


Effective Date of this Notice and Revisions to the Notice

This notice is effective on March 14, 2003.  The HR Department is required to abide by the terms of the notice that’s currently in effect.  The city reserves the right to change the terms of this notice.  

Coverage and Distribution of Policy

This policy applies to all City of Lawton employees and shall be distributed to all officials and employees of the City.  Every new employee is required to acknowledge his or her receipt of this policy.  A copy of that acknowledgement shall be kept in permanent file in the HR Department. Department heads and supervisors shall also be responsible for insuring that all employees under their direction are familiar with this policy.

Obligation of Employees

Employees are responsible for knowing and understanding City policy concerning PHI and required to report any know or suspected violations of PHI to the HR Department, first-line supervisor, Division Superintendent, Department Director, Assistance City Manager of the City Manager.

Employees are obligated to cooperate in every investigation of PHI violation, including, but not limited to, coming forward with evidence, both favorable and unfavorable, to a person accused of PHI violations by making a full and truthful written report or verbally answering questions when required to do so by an investigator.

Employee are also obligated to refrain from filing bad faith complaints of PHI violations.

Disciplinary action may also be taken against any employee who fails to report instances of PHI violations, or who fails or refuses to cooperate in the investigation of a complaint of PHI violations, or who files a PHI complaint in bad faith.

REFERENCES    None

EFFECTIVE DATE:    March 14, 2003

RESPONSIBLE
DEPARTMENT:    Human Resources.


____/s/ Larry Mitchell_____________
Larry Mitchell
City Manager
City of Lawton

HEALTH PLAN/CAFETERIA PLAN
REVIEW COMMITTEE

RE:    Health Insurance Portability and Accountability Act (HIPPA) of 1996 Privacy Notice


I hereby authorize by my signature below the Health Plan/Cafeteria Plan Review Committee to consider, discuss, and publish in agenda and minutes the particular health information I willingly disclose to the committee in my appeal for assistance or relief.  In authorizing this release I realize my name and health concerns may be discussed at the open meetings of the committee.  I also acknowledge receipt of a copy of the HIPPA City of Lawton Administrative Policy 3-20 by my signature below.

Signed:____________________________________________Date:_______________________


Printed name:__________________________________________________________________


Witness:_______________________________________________________________________