{"ref":"LA-HH-PRV-01","title":"HIPAA Privacy and OASIS Confidentiality","category":"Privacy","summary":"Sets out how the Agency protects the privacy of patient health information under the HIPAA Privacy Rule (45 CFR Part 164, Subpart E) and Louisiana's right to a confidential clinical record (LAC 48:I §9125.A.6): the privacy official, permitted uses and disclosures, authorizations, the minimum necessary rule, the Notice of Privacy Practices, patient privacy rights and their time limits, privacy in the home and the office, business associates, complaints, sanctions and documentation, and, if the Agency is Medicare-certified, the confidentiality of OASIS information under 42 CFR §484.40.","inShort":["Look at and share only the patient information you need for your job.","Talk privately with the patient, and ask before discussing care in front of visitors.","Never post about patients on social media or text patient details from a personal app.","Lock records and devices out of sight. Never leave them in view in your car.","Send privacy requests and complaints to Lee Sample the same day."],"primaryCitation":"45 CFR §164.530","citations":["LAC 48:I §9101","LAC 48:I §9125.A.6","LAC 48:I §9129.A.4","LAC 48:I §9129.A.6"],"federalCitations":["45 CFR §160.103","45 CFR §164.502","45 CFR §164.506","45 CFR §164.508","45 CFR §164.510","45 CFR §164.512","45 CFR §164.520","45 CFR §164.522","45 CFR §164.524","45 CFR §164.526","45 CFR §164.528","45 CFR §164.530","42 CFR §484.40","42 CFR §484.110(d)"],"surveyorAsks":["Who is your privacy official, and where is that designation documented?","Show me your Notice of Privacy Practices and the patient's signed acknowledgment of receiving it."],"forms":[{"ref":"LA-HH-PRV-01-A","title":"Notice of Privacy Practices"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.530)","5. Privacy Official and Complaint Contact","6. Uses and Disclosures Without the Patient's Authorization","7. Uses and Disclosures That Need a Written Authorization","8. Minimum Necessary and Role-Based Access","9. Notice of Privacy Practices","10. Patient Privacy Rights","11. Privacy in the Home, on the Road, and in the Office","12. OASIS Confidentiality (If Medicare-Certified)","13. Accounting of Disclosures","14. Business Associates","15. Complaints, Sanctions, Mitigation, and No Retaliation","16. Responsibilities","17. Records and Compliance Monitoring","18. Staff Training","19. References","20. Related Policies and Forms","21. Approval","22. Revision History"],"version":"1.0","sample":false,"pack":"la-hha","state":"Louisiana","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}