{"ref":"NC-HH-PRV-01","title":"HIPAA Privacy and Patient and Employee Confidentiality","category":"Privacy","summary":"Sets out how the Agency protects the confidentiality of patient and employee information, as 10A NCAC 13J .1001(a)(10) and G.S. 131E-144.3(5) require, and how it meets the HIPAA Privacy Rule: the Privacy Official, the Notice of Privacy Practices given at the start of care, when information may be shared without the patient’s authorization (including reports to the county department of social services and the Health Care Personnel Registry), the patient’s privacy rights and their time limits, and OASIS confidentiality.","inShort":["Talk about a patient only with the patient, people the patient has approved, the care team and the physician. Speak quietly when others can hear.","At the first visit, give the Notice of Privacy Practices and the OASIS privacy notice and ask the patient to sign the receipt. If the patient will not sign, write down your effort and the reason.","If someone asks about a patient and you do not know that the person is approved, do not share. Refer the person to the office.","Never post about a patient on social media, even without a name. Take photographs only inside the approved clinical app, with the patient’s consent.","Privacy never stops a required report: reports of suspected abuse to the county department of social services are allowed and required.","Tell the Privacy Official, Lee Sample, at once about any lost folder or phone, misdirected fax or overheard conversation."],"primaryCitation":"45 CFR Part 164 Subpart E","citations":["10A NCAC 13J .1001(a)(10)","10A NCAC 13J .1401(c)","G.S. 131E-144.3(5)","G.S. 131E-265","G.S. 108A-102","G.S. 7B-301","10A NCAC 13O .0102"],"federalCitations":["45 CFR Part 164 Subpart E","45 CFR §160.103","45 CFR §164.502","45 CFR §164.506","45 CFR §164.508","45 CFR §164.510","45 CFR §164.512","45 CFR §164.514","45 CFR §164.520","45 CFR §164.522","45 CFR §164.524","45 CFR §164.526","45 CFR §164.528","45 CFR §164.530","42 CFR §484.40","42 CFR §484.50(a)(1)(iii)","42 CFR §484.110(d)","29 CFR §1910.1020"],"surveyorAsks":["Who is your Privacy Official? Show me the designation.","How do you know this patient received the Notice of Privacy Practices?"],"forms":[{"ref":"NC-HH-PRV-01-A","title":"Notice of Privacy Practices"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (10A NCAC 13J .1001(a)(10); G.S. 131E-144.3(5); 45 CFR Part 164 Subpart E)","5. Notice of Privacy Practices","6. OASIS Confidentiality","7. When Patient Information May Be Shared","8. Patient Privacy Rights","9. Privacy Practice in the Home and the Office","10. Employee and Applicant Confidentiality","11. Responsibilities","12. Records and Compliance Monitoring","13. Staff Training","14. References","15. Related Policies and Forms","16. Approval","17. Revision History"],"version":"1.0","sample":false,"pack":"nc-hha","state":"North Carolina","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}