{"ref":"CA-HH-PRV-01","title":"Privacy of Medical Information: HIPAA and the Confidentiality of Medical Information Act","category":"Privacy","summary":"Sets out how the Agency protects patients’ medical information under the California Confidentiality of Medical Information Act (Cal. Civ. Code §56 et seq.), the duty of every licensed home health agency to prevent unlawful or unauthorized access, use, or disclosure (Cal. Health & Safety Code §1280.15(a)), and the HIPAA Privacy Rule: the privacy official, minimum necessary use, when information may be shared without an authorization, what a valid authorization must contain (including the California 14-point type rule), the notice of privacy practices, patients’ privacy rights, business associates, conduct in the home, sanctions, and training.","inShort":["Look only at the records of patients you care for. Every view is logged.","Share only what the other person needs. Ask the patient before talking about their care in front of family or visitors.","Never text patient information from your own phone, and never post about a patient online, even without a name.","Releases to anyone outside the patient’s care team need a signed authorization unless the privacy official says otherwise.","Abuse reports are always allowed. Privacy never stops you from reporting abuse.","Tell the privacy official right away about any misdirected fax or email, or any lost papers."],"primaryCitation":"Cal. Civ. Code §56.10","citations":["Cal. Civ. Code §56.05","Cal. Civ. Code §56.10","Cal. Civ. Code §56.11","Cal. Civ. Code §56.36","Cal. Health & Safety Code §1280.15(a)","22 CCR §74731(i)","22 CCR §74743(d)","Cal. Welf. & Inst. Code §15633.5"],"federalCitations":["45 CFR §164.502","45 CFR §164.508","45 CFR §164.510","45 CFR §164.512","45 CFR §164.520","45 CFR §164.522","45 CFR §164.530","42 CFR §484.40","42 CFR §484.50(c)(6)"],"surveyorAsks":["Who is your privacy official? Show me your notice of privacy practices and how you document that each patient received it.","Show me a signed authorization for release of medical information. Does it meet California’s requirements?"],"forms":[{"ref":"CA-HH-PRV-01-A","title":"Authorization for Release of Medical Information"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (Cal. Civ. Code §56.10)","5. Everyday Rules for Staff","6. When Information May Be Shared Without an Authorization","7. Family Members and Friends","8. Authorizations","9. Uses That Are Never Allowed Without Express Permission","10. Notice of Privacy Practices","11. Patients’ Privacy Rights","12. Business Associates","13. Complaints, Sanctions, and Mitigation","14. Responsibilities","15. Records and Compliance Monitoring","16. Staff Training","17. References","18. Related Policies and Forms","19. Approval","20. Revision History"],"version":"1.0","sample":false,"pack":"ca-hha","state":"California","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}