HIPAA Notice of Privacy Practices

Policy  

Tenovi is committed to maintaining and protecting the confidentiality of the individual’s PHI. Tenovi is required by federal and state law, including the Health Insurance Portability and Accountability Act (“HIPAA”), to protect the individual’s PHI and other personal information. When Tenovi uses or discloses an individual’s PHI, Tenovi is bound by the terms of this Notice of Privacy Practices, or the revised Notice of Privacy Practices, if applicable.

Note, as Tenovi is not a Health Care Provider, a Clearinghouse, or a Health Plan, Tenovi is not considered a “Covered Entity” under the HIPAA guidelines. However, as Tenovi contracts with Covered Entities to provide health-related services, Tenovi is considered a Business Associate. As such, Tenovi is required to enter into a Business Associates Agreement with all Covered Entities or Business Associates of Covered Entities that Tenovi does business with, which ensures that protected health information (PHI) is used, protected, and disclosed properly. As a Business Associate, Tenovi must follow the use and disclosure provisions of the Privacy Rule and the safeguard requirements of the Security Rule.

Tenovi is required by law to:

• Maintain the privacy of PHI (with certain exceptions)
• Follow the terms of Tenovi Notice of Privacy Practices that is currently in effect

Applicable Regulations

164.520 – Notice of privacy practices for protected health information

Procedures

HOW TENOVI MAY USE AND DISCLOSE PHI:

The following describes the ways Tenovi may use and disclose PHI. Except for the purposes described below, Tenovi will use and disclose PHI only with the individual’s written permission. The individual may revoke such permission at any time by writing to Tenovi.

• For Treatment. Tenovi may use and disclose PHI for the individual’s services. For example, Tenovi may disclose PHI to doctors, nurses, technicians, or other personnel, including people outside Tenovi, who are involved in the individual’s medical care and need the information to provide the individual with medical care.
• For Payment. Tenovi may use and disclose PHI so that Tenovi or others may bill and receive payment from the individual, an insurance company or third party for the treatment and services the individual received. For example, Tenovi may tell the individual’s insurance company about a treatment the individual is going to receive to determine whether the individual’s insurance company will cover the treatment.
• For Health Care Operations. Tenovi may use and disclose PHI for health care operation purposes. The uses and disclosures are necessary to make sure that patients receive quality care and to operate and manage the Tenovi offices. Tenovi also may share information with other entities that have a relationship with the individual (for example, the individual’s insurance company and anyone other than the individual who pays for the individual’s services) for the individual’s health care operation activities.
• Third Parties Involved in an Individual’s Care or Payment for an Individual’s Care. Unless the individual objects, Tenovi may share PHI with a person who is involved in the individual’s medical care or payment for the individual’s care, such as the individual’s family or a close friend. Tenovi also may notify the individual’s family about the individual’s location or general condition or disclose such information to an entity (such as Red Cross) assisting in a disaster relief effort.
• Under certain circumstances, Tenovi may use and disclose PHI for research. For example, a research project may involve comparing the health of patients who received one treatment to those who received another, for the same condition. Tenovi will generally ask for the individual’s written authorization before using the individual’s PHI or sharing it with others to conduct research. Under limited circumstances, Tenovi may use and disclose PHI for research purposes without the individual’s permission. Before Tenovi uses or discloses PHI for research without the individual’s permission, the project will go through a special approval process to ensure that research conducted poses minimal risk to the individual’s privacy. The individual’s information will be de-identified. Researchers may contact the individual to see if the individual is interested in or eligible to participate in a study.

SPECIAL SITUATIONS:

• As Required by Law. Tenovi will disclose PHI when required to do so by international, federal, state, or local law.
• To Avert a Serious Threat to Health or Safety. Tenovi may use and disclose PHI when necessary to prevent a serious threat to the individual’s health and safety or the health and safety of others. Disclosures, however, will be made only to someone who may be able to help prevent or respond to the threat, such as law enforcement or potential victim. For example, Tenovi may need to disclose information to law enforcement when a patient reveals participation in a violent crime.
• Business Associates. Tenovi may disclose PHI to Tenovi business associates that perform functions on Tenovi’s behalf or provide Tenovi with services if the information is necessary for such functions or services. For example, Tenovi may use another company to perform billing services on Tenovi’s behalf. All of Tenovi’s business associates are obligated to protect the privacy of the individual’s information and are not allowed to use or disclose any information other than as specified in our contracts and Business Associate’s Agreements.
• Lawsuits and Disputes If the individual is involved in a lawsuit or a dispute, Tenovi may disclose PHI in response to a court or administrative order. Tenovi also may disclose PHI in response to a subpoena, discovery request, or other lawful request by someone else involved in the request or to allow the individual to obtain an order protecting the information requested.
• Law Enforcement Tenovi may release PHI if asked by a law enforcement official if the information is: (1) in response to a court order, subpoena, warrant, summons or similar process; (2) limited information to identify or locate a suspect, fugitive, material witness, or missing person; (3) about the victim of a crime even if, under certain very limited circumstances, Tenovi is unable to obtain the individual’s agreement; (4) about a death Tenovi believes may be the result of criminal conduct; (5) about criminal conduct on Tenovi premises; and (6) in an emergency to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.

USES AND DISCLOSURES THAT REQUIRE THE INDIVIDUAL’S WRITTEN AUTHORIZATION:

The following uses and disclosures of the individual’s PHI will be made only with the individual’s written authorization:

1. Uses and disclosures of PHI for marketing purposes;
2. Disclosures that constitute a sale of the individual’s PHI; and
3. Disclosures of psychotherapy notes.

Other uses and disclosures of PHI not covered by this Notice of Privacy Practices or the laws that apply to Tenovi will be made only with the individual’s written authorization. If the individual gives us authorization, the individual may revoke it at any time by submitting a written revocation to Tenovi and we will no longer disclose PHI under the authorization. But disclosure that Tenovi made in reliance on an individual’s authorization before the individual revoked it will not be affected by the revocation.

INDIVIDUAL’S RIGHTS REGARDING PHI:

The following individual’s rights under the HIPAA Privacy Rule extend to PHI maintained by Tenovi on behalf of a Covered Entity. Depending on Tenovi’s contract with a specific entity, the Covered Entity may be responsible for responding to certain requests for information, rather than Tenovi. However, regardless of how Tenovi has agreed to support a Covered Entity’s obligation to provide access to an individual, a request for access submitted to Tenovi will still be acted upon within 30 calendar days (or 60 calendar days if an extension is applicable) of receipt of the request. Further, all of the access requirements that apply with respect to PHI held by a Covered Entity (e.g., limitations on fees that may be charged) apply with respect to PHI held by Tenovi.

• Right to Inspect and Copy. The individual has a right to inspect and copy PHI that may be used to make decisions about the individual’s care or payment for the individual’s care. This included medical and billing records, other than psychotherapy notes. To inspect and copy the individual’s PHI, the individual must make their request, in writing, to Tenovi or to the Covered Entity responsible for the individual’s care, as specified in Tenovi’s Business Associate’s Agreement with the Covered Entity. Tenovi has up to 30 days to make the individual PHI available to the individual or to notify the Covered Entity of the request, and Tenovi may charge the individual a reasonable fee for the costs of copying, mailing or other supplies associated with the individual’s request. Tenovi may not charge the individual a fee if the individual needs the information for a claim for benefits under the Social Security Act or any other state or federal needs-based benefit program. Tenovi may deny the individual’s request in certain limited circumstances. If Tenovi does deny the individual’s request, the individual has the right to have the denial reviewed by a licensed healthcare professional that was not directly involved in the denial of the individual’s request, and Tenovi will comply with the outcome of the review.
• Right to Get Notice of a Breach.  Tenovi is committed to safeguarding the individual’s PHI.  If a breach of the individual’s PHI occurs Tenovi will notify the individual or the appropriate Covered Entity (who will then notify the individual) in accordance with state and federal law.
• Right to Amend, Correct or Add an Addendum. If the individual feels that the PHI Tenovi has is incorrect, incomplete, or the individual wishes to add an addendum to the individual’s records, the individual has the right to make such request for as long as the information is kept by or for Tenovi. The individual must make their request in writing to Tenovi. In the case of claims that the information is incorrect, incomplete, or if the record was not created by Tenovi, Tenovi may deny the individual’s request. However, if Tenovi denies any part of the individual’s request, Tenovi will provide the individual with a written explanation of the reasons for doing so within 60 days of the individual’s request.
• Right to an Accounting of Disclosures. Individuals have the right to request a list of certain disclosures Tenovi made of PHI for purposes other than treatment, payment, health care operations, and certain other purposes consistent with law, or for which the individual provided written authorization. To request an accounting of disclosure, individuals must make their request, in writing, to Tenovi or to the Covered Entity that provided the care. The individual may request an accounting of disclosures for up to the previous six years of services provided before the date of the individual’s request. If more than one request is made during a 12-month period, Tenovi may charge a cost-based fee.
• Right to Request Restrictions. Individuals have the right to request a restriction or limitation on the PHI Tenovi uses or disclose for treatment, payment, or health care operations. Individuals also have the right to request a limit on the PHI we disclose to someone involved in the individual’s care or the payment for the individual’s care, like a family member or friend. For example, the individual could ask that Tenovi not share information about a particular diagnosis or treatment with the individual’s spouse. To request a restriction, the individual must make their request, in writing, to Tenovi. Tenovi is not required to agree to the individual’s request unless the individual is asking us to restrict the use and disclosure of the individual’s PHI to a health plan for payment or health care operation purposes and such information the individual wishes to restrict pertains solely to a health care item or service for which the individual has paid Tenovi Out-of-pocket in full. If Tenovi agrees, Tenovi will comply with the individual’s request unless the information is needed to provide the individual with emergency treatment or to comply with the law. If Tenovi does not agree, Tenovi will provide an explanation in writing.
• Right to Request Confidential Communications. Individuals have the right to request that Tenovi communicate with them about medical matters in a certain way or at a certain location.  For example, the individual can ask that Tenovi only contact individuals by mail or at work. To request confidential communications, individuals must make their request, in writing, to Tenovi.  The individual’s request must specify how or where the individual wishes to be contacted.  Tenovi will accommodate reasonable requests.
• Right to Choose Someone to Act for the Individual. If the individual gives someone medical power of attorney or if someone is the individual’s legal guardian, that person can exercise the individual’s rights and make choices about the individual’s PHI. Tenovi will use our best efforts to verify that person has authority to act for the individual before Tenovi takes any action.

CHANGES TO THIS NOTICE OF PRIVACY PRACTICES:

Tenovi reserves the right to change this Notice of Privacy Practices and make the new Notice of Privacy Practices apply to PHI Tenovi already has as well as any information Tenovi receives in the future. Tenovi will post a copy of Tenovi’s current Notice of Privacy Practice on our website. The Notice of Privacy Practices will contain the effective date on the top of the page.