Section 3 Personnel
Policy 3-26 HEALTH INSURANCE PORTABILITY AND ACCOUNTIBILITY ACT (HIPPA) OF 1996 PRIVACY NOTICE
DATE: March 14, 2003
SUBJECT: Health Insurance Portability and Accountability Act (HIPPA) of
PURPOSE: To put forth in writing the City Managers position on Health
BACKGROUND: This policy describes how medical information about employees
and disclosed to third parties and how an employee can get access to this information. Any
employee having questions about Health Information Privacy should contact the Human
Resources (HR) Department.
PROCEDURES: Protected Health Information shall be maintained by the City
City of Lawton policy is to protect the privacy of health information of its employees. Federal
Law requires the city to maintain the privacy of employee health information and to provide
employees with a health privacy information notice. This policy applies to all participants in
City of Lawton Benefit Plan to include all employees and any business associates or agents of the
city. This policy describes how the city may collect, use, and disclose an employees health
information. It also describes employee rights concerning health information.
Employees should be familiar with the term protected health information or PHI. PHI is
information created or received by the city about the employee, including health and
demographic information, which can reasonably be used to identify an individual. PHI include
information that relates to an employees past, present, and future physical or mental condition,
the provision of health care, and payment for that care.
A. Privacy Official.
The HR Director is the appointed privacy officer for the City of Lawton. All
concerning PHI should be directed to the HR Department.
B. PHI Use.
Listed below are some examples of ways the city may use or share PHI without
or benefit participant consent or authorization. These examples are considered to be related to
treatment, payment and health care operations:
* Managerial and oversight functions such as auditing
and monitoring the expenditures
and claims for the Employee Group Health and Dental plan.
* Group Health and Dental Plan third party administrator
actions relating to claims activities
involving payment and medical management functions.
* Organizations that help the city conduct business operations. The city shall only share
PHI with businesses and business agents that agree to keep PHI safeguarded.
C. Health Oversight Activities:
There are state and federal laws that may require or
allow the city to release PHI. The city
may be required to provide information for the following reasons:
* Government Authorization or Law. The City
may disclose employee PHI to a
government agency authorized to oversee the health care system or government programs, or it
contractors for activities authorized by law.
* Legal Proceedings: The
city may disclose PHI in response to a court of administrative
order, subpoena, discovery request, or other lawful process, under certain circumstances.
* Law Enforcement: The
city may disclose PHI to law enforcement officials under
limited circumstances. For example, in response to a warrant or subpoena, or
for the purpose
of identifying or locating a suspect, witness, or missing person, or to provide
concerning victims of crimes.
* Public Health Activities: The
city may disclose PHI to a government agency that
oversees the health care system or government programs for activities such as preventing or
controlling disease or activities related to the quality, safety, or effectiveness of an FDA
regulated product or activity.
* Workers Compensation: The
city shall disclose PHI if so required by workers
compensation law or the court.
* Victims of Abuse, Neglect, or Domestic Violence: The
city may disclose PHI to
appropriate authorities if it reasonably believes that an employee is a possible
victim of abuse, neglect, domestic violence or other
* Coroners, Funeral Directors, and Organ Donation: The
city may disclose PHI to
coroners/funeral directors in connection to organ donation.
* Research: The city may
disclose PHI to researchers, if certain established steps are
taken to protect the employees privacy.
* Threat to Health or Safety: The
city may disclose PHI to the extent necessary to avert a
serious and imminent threat to employee health or safety or the health or safety
* For Specialized Government Functions: The
city may disclose PHI in certain
circumstances or situations to a correctional institution if the employee is an inmate
correctional facility, to an authorized federal official when its required
for lawful intelligence
or other national security activities, or to an authorized authority of the
* Cadaver Organ, Eye, or Tissue Donation: The
city may disclose PHI for the purpose
of facilitating organ, eye, or tissue donation and transplantation if the employee has provided
written authorization for such to the HR Department.
D. Employee Rights
An employee has the following rights regarding PHI:
* Restricted Access. An
employee has the right to ask the HR Department to restrict city
use and disclosure of PHI for the purposes of treatment, payment or health care operations. This
includes uses and disclosures to family members, relatives, close personal friends, or other
person identified by the employee who may be involved with an employees care or payment for
treatment. The HR Department shall consider the request, but isnt required to agree to restrict
* Confidential Communications. An
employee may request that communications from
the city of the employee be provided via alternative means or to an alternative location. The
employee must request this in writing and clearly state that city disclosure of all or part of that
communication could threaten or harm their interest(s). The employee must also provide to the
city the alternative location (e.g., fax number, address, etc.) to which the employee would like the
* Inspection and Copy of PHI. An
employee may request and obtain copy of the PHI
that the HR Department maintains about you in a designated record set. A designated record set
contains PHI that the City collects, maintains or uses to administer to make decisions regarding
employee enrollment, payment, claims adjudication, case/medical management. If HR doesnt
maintain the PHI, but is aware of what entity does, the employee shall be told by the HR
Department. HR may charge a reasonable, cost-based fee to provide the employee with the
information. There are exceptions as to what information can be accessed. For example,
information compiled for legal proceedings cannot be accessed. If HR denies access to employee
information, in part or in whole, they shall notify the employee in writing. HR denial will
include the reason for the denial, employee review rights (if applicable), and information on how
to file a complaint.
* PHI Amendment. An employee
may request the HR Department amend PHI thats
contained in a designated record set (as described above). All amendment requests must be in
writing and include a reason for the request. The city shall respond with 60 days of receiving
request. If the request is approved, the HR Department shall amend the information in its records
and notify any other individual(s) known by the city or the employee that would be affected. In
certain cases, an employee request may be denied. For example, the city may deny a request if
the information on file is accurate or if the city didnt create the information. For example,
city may deny a request if the information on file is accurate or if the city didnt create the
information. The HR Department shall notify the employee in writing of any denial. The
employee may respond by filing a written statement of disagreement with the HR Department,
and the HR Department has the right to rebut the disagreement statement. Should this occur, the
employee has the right to request the original employee request, the Citys request denial, and
any statement of disagreement, along with the Citys rebuttal, be included in future disclosures
* Disclosure Accounting. An
employee may request an accounting of certain PHI
disclosures. An accounting will show the employee to whom HR has provided PHI. The first
accounting request in a 12-month period of time is provide free of charge. Subsequent requests
are subject to a reasonable, cost-based fee, of which the employee shall be made aware of in
advance. Disclosure requests must be made in writing. HR shall respond within 60 days of
receipt. HR isnt always required to provide PHI disclosure. For example, HR isnt
account for disclosures made for the purposes of treatment, payment, or health care operations.
Also, HR doesnt provide accountings for disclosures that the employee has authorized, and
certain other disclosures such as for national security purposes.
For more information, or to begin the formal process connected with these rights, please contact
the Human Resources Department.
E. Complaints and Inquires
Employee may register a complaint to the HR Department if they believe that
rights have been violated. Employees may also file a complaint with the Department of Health
and Human Services. Complaints must be submitted in writing. Complaints should include the
*Address or other means of communicating with you in writing.
*Telephone number where you can be reached.
*Brief description of the nature of your complaint (who, what, where and when).
*Other relevant information.
NOTE: An employee shall not be retaliated against or denied any health plan benefit or
service because of a PHI violation complaint.
Effective Date of this Notice and Revisions to the Notice
This notice is effective on March 14, 2003. The HR Department is required to abide by the terms
of the notice thats currently in effect. The city reserves the right to change the terms
Coverage and Distribution of Policy
This policy applies to all City of Lawton employees and shall be distributed to all officials and
employees of the City. Every new employee is required to acknowledge his or her receipt of this
policy. A copy of that acknowledgement shall be kept in permanent file in the HR Department.
Department heads and supervisors shall also be responsible for insuring that all employees under
their direction are familiar with this policy.
Obligation of Employees
Employees are responsible for knowing and understanding City policy concerning PHI and
required to report any know or suspected violations of PHI to the HR Department, first-line
supervisor, Division Superintendent, Department Director, Assistance City Manager of the City
Employees are obligated to cooperate in every investigation of PHI violation, including, but not
limited to, coming forward with evidence, both favorable and unfavorable, to a person accused of
PHI violations by making a full and truthful written report or verbally answering questions when
required to do so by an investigator.
Employee are also obligated to refrain from filing bad faith complaints of PHI violations.
Disciplinary action may also be taken against any employee who fails to report instances of PHI
violations, or who fails or refuses to cooperate in the investigation of a complaint of PHI
violations, or who files a PHI complaint in bad faith.
EFFECTIVE DATE: March 14, 2003
DEPARTMENT: Human Resources.
____/s/ Larry Mitchell_____________
City of Lawton
HEALTH PLAN/CAFETERIA PLAN
RE: Health Insurance Portability and Accountability Act (HIPPA) of 1996 Privacy
I hereby authorize by my signature below the Health Plan/Cafeteria Plan Review Committee to
consider, discuss, and publish in agenda and minutes the particular health information I willingly
disclose to the committee in my appeal for assistance or relief. In authorizing this release I
realize my name and health concerns may be discussed at the open meetings of the committee. I
also acknowledge receipt of a copy of the HIPPA City of Lawton Administrative Policy 3-20 by
my signature below.