{"ref":"DC-HH-PRV-01","title":"HIPAA Privacy, Confidentiality, and the EPD Waiver Privacy Plan","category":"Privacy","summary":"Names the privacy official, gives every patient the Notice of Privacy Practices at the first visit, limits uses and disclosures of patient information to what HIPAA and District law allow, protects privacy in patients’ homes and on phones, honors patients’ privacy rights, serves as the privacy plan required for EPD Waiver services, and sanctions staff who break the rules.","inShort":["Give every new patient the Notice of Privacy Practices at the first visit and ask them to sign that they received it.","Look only at the records of patients you care for, and share only what the task needs.","Never text, email, or photograph patient information on a personal phone or account. Use only the Agency’s apps.","Talk about care where others cannot hear, and ask the patient before discussing care in front of visitors.","Report any privacy problem at once to the privacy official, Lee Sample."],"primaryCitation":"45 CFR Part 164 Subpart E","citations":["22-B DCMR §3910.1","22-B DCMR §3912.2","29 DCMR §4207.1","29 DCMR §4207.2","29 DCMR §4254.9","29 DCMR §5013.2","29 DCMR §5014.3","D.C. Code §7-1201.01","D.C. Code §7-1201.02"],"federalCitations":["45 CFR Part 164 Subpart E","45 CFR §164.502","45 CFR §164.504(e)","45 CFR §164.506","45 CFR §164.508","45 CFR §164.510","45 CFR §164.512","45 CFR §164.520","45 CFR §164.522","45 CFR §164.524","45 CFR §164.526","45 CFR §164.528","45 CFR §164.530","42 CFR §484.40","42 CFR §484.50(c)(6)","42 CFR Part 2"],"surveyorAsks":["Who is your privacy official? Show me the designation.","Show me the Notice of Privacy Practices and this patient’s signed acknowledgment, or your record of a good-faith effort to get one."],"forms":[{"ref":"DC-HH-PRV-01-A","title":"Notice of Privacy Practices"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164 Subpart E; 22-B DCMR §3910.1(a))","5. The Privacy Official","6. Notice of Privacy Practices","7. How Patient Information May Be Used and Shared","7.1 Treatment, payment, and health care operations","7.2 Minimum necessary","7.3 Without authorization, as the law allows","7.4 With the patient’s authorization","7.5 Family, friends, and caregivers","8. Privacy Rights of Patients","9. Privacy in the Patient’s Home and in the Field","10. Mental Health and Other Specially Protected Information","11. Business Associates","12. The EPD Waiver Privacy Plan","13. Safeguards, Sanctions, and Mitigation","14. Privacy Complaints","15. Responsibilities","16. Records and Compliance Monitoring","17. Staff Training","18. References","19. Related Policies and Forms","20. Approval","21. Revision History"],"version":"1.0","sample":false,"pack":"dc-hha","state":"Washington, DC","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}