A2242 PATIENTS RIGHTS POLICY 9-4-18.DOCX

MARICOPA COUNTY INTERNAL POLICY
Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
10-10-2018
Date:
Board Agenda
Approved by: Number: C-49-15-032-6-01
BOARD OF SUPERVISORS Original Adoption
12-10-2014
Date:
I. PURPOSE
To ensure customers of a Maricopa County HIPAA Covered Component are
aware of, and afforded, their rights under the Health Information Portability and
Accountability Act as required under 45 CFR §164.520.
II. APPLICATION
This Policy applies to all Maricopa County HIPAA covered appointed
departments as well as the Flood Control District of Maricopa County, the
Maricopa County Library District, and the Maricopa County Stadium District. This
policy also applies to employees of County elected offices unless the elected
official has implemented a similar policy specific to his or her office.
III. DEFINITIONS
A. Covered Component: A County Department or division of a County
Department that is (1) a health plan or (2) a health care provider who
electronically transmits any PHI.
B. Health Insurance Portability and Accountability Act (HIPAA): Federal
legislation first passed in 1996. It includes the HIPAA Privacy Rule which
protects the privacy of individually identifiable health information; the HIPAA
Security Rule, which sets national standards for the security of electronic
protected health information; the HIPAA Breach Notification Rule, which
requires covered entities and business associates to provide notification
following a breach of unsecured protected health information; and the
confidentiality provisions of the Patient Safety Rule, which protect identifiable
information being used to analyze patient safety events and improve patient
safety.
C. Designated Record Set: A group of records maintained by or for a covered
entity that is: (i) the medical records and billing records about individuals
maintained by or for a covered healthcare provider; (ii) the enrollment,

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
payment, claims adjudication, and case or medical management record
systems maintained by or for a health plan; or (iii) used, in whole or in part, by
or for the covered entity to make decisions about the individual.
D. Individually Identifiable Health Information (IIHI): Any information,
whether oral or recorded in any form or medium, that is created or received
by a health care provider, health plan, public health authority, employer, life
insurer, school or university, or health care clearinghouse, which identifies an
individual or with respect to which there is a reasonable basis to believe the
information can be used to identify the individual, and that: 1) relates to the
past, present, or future physical or mental health or condition of an individual;
2) the provision of health care to an individual; or 3) the past, present, or
future payment for the provision of health care to an individual.
E. Notice of Privacy Practices: A notice that must be provided by a health
care provider or health plan that explains how the provider or plan may use
and share PHI and how a recipient may exercise rights with respect to that
PHI.
F. Personal Representative: Any person who is legally authorized to act on
behalf an individual in making decisions related to health care.
G. Protected Health Information (PHI): IIHI that is transmitted by electronic
media, maintained in electronic media or transmitted or maintained in any
other form or medium. PHI excludes education records covered by the
Family Educational Rights and Privacy Act, records described in 20 U.S.C.
§1232g(a)(4)(B)(iv), IIHI regarding a person who has been deceased more
than 50 years, and employment records held by a covered entity in its role as
employer.
H. Psychotherapy Notes: Notes recorded in any media by a health care
provider who is a mental health professional documenting or analyzing the
contents of conversation during a private counseling session or a group joint
or family counseling session and that are separated from the rest of the
individual’s medical record. Psychotherapy notes excludes medication
prescription and monitoring, counseling session start and stop times, the
modalities and frequencies of treatment furnished, results of clinical tests,
and any summary of the following items: diagnosis, functional status, the
treatment plan, symptoms, prognosis, and progress to date.
IV. POLICY
Page 2 of 12

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
All Covered Components must provide information to each individual receiving
services regarding their rights as a patient as outlined below and as further
clarified within this policy:
A. Patient Rights
1. HIPAA provides rights for patients with regards to their PHI. Under HIPAA,
patients have a right to the following:
a. Receive a Notice of Privacy Practices (45 CFR §164.520)
b. Access to their medical records to inspect and copy (45 CFR
§164.524)
c. Request an amendment or correction to their medical records (45 CFR
§ 164.526)
d. Authorize non-treatment uses via valid authorization (45 CFR
§164.508, 45 CFR §164.532)
e. Receive an accounting of certain disclosures of their PHI (45 CFR
§164.528)
f. Request restrictions on use of PHI (45 CFR §164.522)
g. Request alternative channels of communication (45 CFR §164.527)
h. Submit a complaint about alleged violations of HIPAA regulations
and/or the County’s HIPAA policies and practices to the Covered
Component, County or U.S. Department of Health and Human
Services (HHS) (45 CFR §164.530(d))
B. Notice of Privacy Practices
1. Each Covered Component must have a current Notice of Privacy
Practices (NOPP), which
a. Includes an effective date; and
b. Is promptly revised and distributed whenever a material change has
been made to any of its privacy practices; and
c. Is clearly and prominently posted in the facility; and
d. Is made available to any individual who asks for it; and
Page 3 of 12

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
e. Is available on any website that provides information about its
customer services or benefits; and
f. Is provided to the customer/patient no later than the date of first
service delivery, or if the first service was provided during an
emergency or through electronic means (internet/email), as soon after
the first service as possible; and
g. Is provided to the patient in the means requested (i.e. in person, mail,
or email).
2. If the Covered Component is acting as a health care provider, the facility
must make a good faith effort to obtain the individual’s written
acknowledgment of receipt of the notice. If acknowledgment cannot be
obtained, the facility must document the efforts to obtain the
acknowledgment and the reason why it was not obtained.
3. If the Covered Component is acting as a health plan, the covered
component must give a notice to the coverage subscriber at the time of
enrollment and must also send a reminder at least once every three years
that the patient can ask for the notice at any time.
4. The Notice of Privacy Practices must contain at minimum the following
information:
a. How the covered entity may use and disclose protected health
information about an individual; and
b. The individual’s rights with respect to the information and how the
individual may exercise these rights, including how the individual may
complain to the covered entity; and
c. The covered entity’s legal duties with respect to the information,
including a statement that the covered entity is required by law to
maintain the privacy of the protected health information; and
d. Whom the individuals can contact for further information about the
covered entity’s protected health information.
5. Covered components that are not required to develop a notice of privacy
practices (NOPP) include:
a. Healthcare clearinghouses, if the only PHI created or received is as a
business associate of another covered entity; or
Page 4 of 12

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
b. Correctional institutions that have a covered healthcare provider
component; or
c. A group health plan that provides benefits only through one or more
contracts of insurance with health insurance issuers or HMOs, and that
does not create or receive PHI other than the summary health
information or enrollment/disenrollment information.
C. Accessing Medical Records to Inspect and Copy
1. Each Covered Component must create and implement procedures
providing means for patients to inspect their records, to obtain a copy of
their records, and to direct the covered entity to transmit a copy of their
records to a designated person or entity of the individual’s choice.
2. Procedures must include the designated record set(s) that are subject to
access by individuals and the titles of the persons or offices responsible
for receiving and possessing requests for access by individuals.
3. Each Covered Component must allow individuals access to their PHI for
as long as the information is maintained by the covered entity, or the
Business Associate who is acting on behalf of the covered entity,
regardless of the format of the information, the location of the information,
and the date of the creation of the record.
4. Covered Components may charge a reasonable, cost-based fee if the
individual requests a copy of the PHI and the charge is not otherwise
prohibited by State or local law. The estimated fee must be disclosed to
the requestor in advance of the charge. The fee may only include the
costs associated with the labor for copying the PHI, the supplies for
creating the copy (paper or electronic mobile media), postage, and the
preparation of a summary or explanation of the PHI, if agreed to by the
individual. The fee may not include any other costs regardless of if State
law authorizes such costs.
5. The Covered Component must:
a. Take reasonable steps to verify the identity of the individual making a
request for access. Verification may be done orally or in writing and
may be obtained in any means determined by the entity (i.e. by mail,
phone, fax, email, secure portal, etc.).
b. Provide means by which the request can be made. The Covered
Component can require the request to be made in writing, including
email or secure web portal provided that the covered component
informs the individual of this requirement.
Page 5 of 12

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
c. Provide access to the designated record set(s) within no more than 30
days of receipt of the request unless the facility is unable to
accommodate the request within that time. If the entity requires
additional time to accommodate the request, the entity must, within the
initial 30 days, inform the individual in writing of the reasons for the
delay and the date by which the covered entity will provide access.
The request must then be completed in no more than 60 days from the
date of the original request and no further extensions are permitted.
d. Not impose unreasonable measures on an individual requesting
access that serve as barriers to, or unreasonable delays in, the
individual’s access of the information.
e. Provide the medical records in the requested form or format if possible
(i.e. on paper or in electronic format)
f. Arrange a convenient time and place to pick up a copy of the PHI or to
inspect the PHI on-site should that be the request of the individual.
g. Provide a denial in writing to the requesting individual no later than 30
calendar days from the original request, or no later than 60 calendar
days if an extension was requested. The denial must: (i) be in plain
language, (ii) describe the basis for the denial, (iii) inform the requestor
of their right to have the decision reviewed (if applicable) and how to
request a review, and (iv) how the individual may submit a complaint to
the covered entity or HHS Office of Civil Rights.
h. Allow for an individual to have a denial for access reviewed by a
license healthcare professional designated by the covered entity who
did not participate in the original decision to deny unless the denial is
for one of the reasons set forth in C.5.a-i of this policy. If a review is
requested, the entity must determine whether to affirm or overturn the
denial and promptly provide written notice to the request of the
determination.
i. Inform the requestor of the location, if known, of the records if the
entity or a business associate does not maintain the PHI requested.
6. The Covered Component can deny a request for access made by an
individual where:
a. It would create an unacceptable level of risk to the security of the PHI
on its systems; or
Page 6 of 12

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
b. The request is for psychotherapy notes; or
c. The request is for information that has been compiled in reasonable
anticipation of, or for use in, a legal proceeding; or
d. An inmate requests a copy of their PHI held by a covered entity that is
a correctional institution, or by a healthcare provided acting under the
direction of a correctional institution AND providing the copy would
jeopardize the health, safety, security, custody, or rehabilitation of the
inmate or other inmates or the safety of correctional officers,
employees, or other persons at the institution or who are responsible
for the transporting of the inmate. However, in these cases, an inmate
retains the right to inspect their PHI; or
e. Information was created in the course of research that included
treatment and is still in progress, and the patient agreed to the
temporary suspension of access when consenting to participate in the
research. In such cases the individual’s right to access is reinstated
upon completion of the research; or
f. Information was obtained from someone other than a health care
provider (i.e. a friend or family member) under a promise of
confidentiality and access will reveal the source.
g. The information is part of a set of records covered under the Privacy
Act, provided that the denial is consistent with the Act
h. The requested access is reasonably likely to (i) endanger the life of
physical safety of the individual or another person; (ii) case substantial
harm to a person other than a healthcare provider referenced in the
PHI; (iii) cause substantial harm to the individual or another person if
the access is provided to a personal representative of the individual.
D. Amending and Correcting Medical Records
1. Each Covered Component must have a process in place for patients to
request an amendment or correction to their medical record including
written documentation of the titles of the persons or offices responsible for
receiving and processing requests for amendments.
2. The Covered Component must respond to a request no later than 60 days
from the date of the request unless the Components submits a written
notification to the requestor noting an additional 30 days extension for the
request.
Page 7 of 12

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
3. The Covered Component must inform the patient of the outcome of the
request and, if the request was denied, the reason for the denial, a notice
to the patient of their right to file a statement of disagreement that must
stay with the patient’s health record, and a description of how the patient
may submit a complaint. Reasons for denial may include:
a. The information was not created by the covered entity; or
b. The information is not part of the patient’s designated record set; or
c. The information is not available for inspection as defined by CFR
§165.524; or
d. The information is deemed by the covered entity to be accurate and
complete.
4. If the requestor submits a statement of disagreement, the Covered
Component may choose to prepare a written rebuttal to the disagreement
and must provide a copy of the rebuttal to the requestor.
5. If the Covered Component accepts the request for amendment, the
component must:
a. Make the appropriate amendment to the PHI or record by identifying
the records in the designated record set(s) that are affected and
appending the information or providing a link to the location of the
amendment; and
b. Inform the requestor that the request was accepted and to obtain the
requestor’s approval to send the amended information to other relevant
persons or BAA’s that have obtained, currently hold, or have used the
impacted information; and
c. Make reasonable efforts to inform and provide the amendment to those
individuals listed in 6.b and any other individual or BAA known by the
component to have relied, or who could foreseeably rely, on the
information.
6. The Covered Component must link the identification of the designated
record set(s) subjected to the request, the request for amendment, the
written response to the request, the statement of disagreement, and the
rebuttal to the designated record set.
E. Provide authorization for certain uses and disclosures of PHI
Page 8 of 12

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
1. The Covered Component may not use or disclose PHI without a valid
authorization from the patient or legal representative, except in certain
circumstances as described in CFR §164.502, CFR §164.510 and CFR
§164.512.
2. When the Covered Component obtains or receives a valid authorization,
use or disclosure must be consistent with the authorization.
3. Valid Authorizations must contain the following elements:
a. A description of the information to be used or disclosed that identifies
the information in a specific and meaningful fashion.
b. The name or other specific identification of the person(s), or class of
persons, authorized to make the requested use or disclosure.
c. The name or other specific identification of the person(s), or class of
persons, to whom the Covered Component may make the requested
use or disclosure.
d. A description of each purpose of the requested use or disclosure. The
statement “at the request of the individual” is a sufficient description of
the purpose when a patient initiates the authorization and does not, or
elects not to, provide a statement of the purpose.
e. An expiration date or an expiration event that relates to the patient or
the purpose of the use or disclosure. The statement “end of the
research study,” “none” or similar language is sufficient if the
authorization is for a use or disclosure of PHI for research, including for
the creation and maintenance of a research database or research
repository.
f. Signature of the patient and date. If the authorization is signed by a
personal representative of the patient, a description of such
representative’s authority to act for the patient must also be provided.
g. Authorization forms must include statements of notice to the patient
that:
1. The requestor has the right to revoke the authorization in writing
and either,
i. The exceptions to the right to revoke and a description of how
the individual may revoke the authorization; or
Page 9 of 12

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
ii. To the extent that the information is included in the covered
component’s notice.
2. The covered component may not condition treatment, payment,
enrollment or eligibility for benefits on whether the individual signs
the authorization except as allowed under CFR §164.502 (b)(4).
4. An authorization is not valid if the document has any of the following
defects:
a. The expiration date has passed or the expiration is known by the
Covered Component to have occurred.
b. The authorization has not been filled out completely, with respect to
any element described in §IV.E.2, if applicable.
c. The authorization is known by the Covered Component to have been
revoked.
d. Any material information in the authorization is known by the Covered
Component to be false.
F. Minimum Necessary Disclosure
1. Even if a Covered Component is authorized to use or disclose PHI, it must
take reasonable efforts to limit the information to the minimum necessary
to accomplish the intended purpose of the use or disclosure. The
“minimum necessary” standard does not apply to the following:
a. Disclosure to a health care provider for treatment
b. Disclosure to the patient of his or her own information
c. Disclosure pursuant to an authorization requested by the patient
d. Disclosure to the Secretary of HHS to investigate compliance
e. Disclosure as required by law
f. Disclosure as required for compliance with the Privacy Standards
G. Receipt of an Accounting of Disclosures
1. Each Covered Component must have a process in place for patients to
request an accounting of non-incidental disclosures of PHI including the
Page 10 of 12

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
information required to be included in the accounting, the written
accounting that is provided to the individual, and the titles of the persons
or offices who are responsible for receiving and processing requests for
an accounting by individuals.
2. Covered Components must maintain sufficient documentation of non-
incidental disclosures of each patient’s records and make this
documentation available to patients upon request.
3. Patients can request a list of who has accessed their PHI maintained with
the Covered Component for the six years prior to the date on which the
accounting is requested except for disclosures defined in CFR §164.528.
4. Upon receipt of a valid request for an accounting of disclosures, the
Covered Component will provide the accounting of disclosures within 30
days from receipt of the request unless a written notice of a 30 day
extension is provided to the requestor that includes a reason for the delay.
5. The Covered Component may not charge any fees for providing one
accounting of disclosures in any 12 month period however a reasonable
fee may be charged for subsequent accountings by that same individual
within that same 12 month period provided that the fee is disclosed to the
individual in advance and the individual is provided the opportunity to
modify or withdraw the request.
H. Requests of privacy protection for PHI
1. Each Covered Component must have a process in place for patients to
restrict the uses or disclosures of PHI about the individual to carry out
treatment, payment, or healthcare operations and for disclosures
permitted under CFR §164.510(b).
2. Each Covered Component must document a restriction and retain the
documentation for six (6) years as defined under CFR §164.530(j).
3. The Covered Component may refuse the request to restrict use and/or
disclosure of the PHI unless the disclosure is for the purpose of carrying
out payment or healthcare operations and is not otherwise required by law
and the PHI pertains solely to a healthcare item or service for which the
individual, or person other than the health plan on behalf of the individual,
has paid the covered entity in full.
4. The Covered Component must accommodate reasonable requests made
by an individual to receive communication of PHI from the Covered
Component by alternative means or at alternative locations provided that
Page 11 of 12

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
specification is provided regarding how payment, if any, will be handled
and specification of an alternative address or method of contact is
provided
5. The Covered Component may not require an explanation from the
individual as to the basis for the request however if the Covered
Component is a health plan, the Component may require that the request
contain a statement that disclosure of all or part of the information to which
the request pertains could endanger the individual.
6. The Covered Component may terminate a restriction of uses or
disclosures if the individual agrees to the request in writing or orally and
the oral agreement is documented.
I. Complain to the Covered Component or HHS
a. Each Covered Component must ensure that individuals are aware that
there shall be no retaliation against any individual for filing such a
complaint. Complaints can be filed with the Covered Component, with
the Maricopa County Privacy Office, or directly to Health and Human
Services’ Office of Civil Rights (HHS OCR).
b. Each Covered Component must provide individuals with information
regarding how to submit a HIPAA privacy complaint to the Covered
Component, to Maricopa County, or to HHS OCR.
Revision History
Version Revision Date Description of Revision
1 10 Dec 2014 Initial version (C-49-15-032-6-00)
2 10 Oct 2018 Revisions to improve readability and provide further
specificity for compliance.
c
Page 12 of 12