1. Created by CCTC HIPAA: Notice of Privacy Practices Policy 3.1.21 in the Administrative Guide

2. Created by CCTC What is it ? The Notice of Privacy Practices is a description of: How we use and disclose Protected Health Information (PHI) The patient’s rights UAMS’ responsibilities with respect to PHI We must provide this Notice to patients no later than the first delivery of service effective April 14, 2003. Note: All employees need to be familiar with its contents

3. Created by CCTC FrontBack NOTICE OF PRIVACY PRACTICES

4. Created by CCTC Provision of Notice of Privacy Practices We are required to: Provide the notice no later than the first delivery of service effective April 14, 2003. This also applies to “service” via email or the telephone. Make a good faith effort to obtain a written acknowledgement. If not obtained, document efforts and the reason why the acknowledgement was not obtained. Retain the written acknowledgement of receipt or documentation of our good faith efforts to obtain written acknowledgement.

5. Created by CCTC A new Field at the “Corporate” level in HBO and OSCAR has been created to document we have provided the Notice. The field is called “Privacy Notice”. When arriving, admitting or registering a patient or performing CPI update functions, filling in the Privacy Notice field is mandatory. There are 6 flags to choose from: 1. IT – Indirect treatment, most commonly used with lab specimens mailed in. 2. MR – Mail requested, used by you to initiate mailing the Notice. 3. NM – Notice mailed, used by HBO/OSCAR to complete the mailing process. 4. NP – Notice Provided, used when you give the patient the Notice. 5. PB – Business Office only 6. US – Urgent Situation

6. Created by CCTC What do I do when arriving or admitting a patient? 1. When arriving, admitting or registering the patient, check the “Privacy Notice” field in HBO/OSCAR. If a flag of NP (Notice Provided) or NM (Notice Mailed) is present, the patient has already received a copy of notice and it is not necessary to give them another one. 2. If no flag is present or if the MR (Mail Requested) or IT (Indirect Treatment) or PB (Business Office Only) or US (Urgent Situation) flag is checked, the patient has not received the Notice and should be given a copy. 3. Ask them to sign the “Acknowledgment of Receipt of Privacy Notice” Form. If they do not sign, document the reason in the “Staff Use Only” section of the form. Send Acknowledgment Form for scanning in EPF under the HIPAA document type. 4. Select “Notice Provided” in HBO/OSCAR. Note: This the most common workflow. It may vary with specific situations.

7. Created by CCTC Written Acknowledgment Except in emergencies, make a “good faith” effort to obtain written acknowledgment that the patient received the notice. If unable to obtain this acknowledgment, document your efforts, and why it was not obtained

8. Created by CCTC 1.When arriving or admitting a patient, if no flag is present the patient has not received the Notice. If the patient is present, give them a copy and select NP (Notice Provided). Ask them to sign the “Acknowledgment of Receipt of Privacy Notice” Form. If they do not sign, document the reason in the “Staff Use Only” section of the form. Send the Acknowledgment Form for scanning in EPF under the HIPAA document type. NP (Notice Provided) will be selected to indicate the notice was provided in person. Today’s date will default in. The NP flag cannot be changed after it is selected.

9. Created by CCTC 2.When arriving, admitting or registering a patient and a flag of MR (Mail requested), IT (Indirect Treatment), PB (Business Office Only) or US (Urgent Situation) is in the system, the patient has not received the Notice. Give the patient a copy of the Notice and obtain their written acknowledgment. Change the flag to Notice Provided and enter today’s date. Replace the flag with the NP (Notice Provided) flag and enter today’s date. Enter today’s date

10. Created by CCTC 3.When arriving or registering the patient, check the “Privacy Notice” field in HBO/OSCAR. If a flag of NM (Notice Mailed) is present, the patient has already received a copy of the notice and no further action is required. NM (Notice Mailed) You should not manually select the “Notice Mailed” flag. HBO/OSCAR sets this flag. However, you will frequently see this flag in the system, and it tells you that a Notice has been mailed to the patient.

11. Created by CCTC 4. When arriving, admitting or registering the patient, check the “Privacy Notice” field in HBO/OSCAR. If a flag of NP (Notice Provided) is present, the patient has already received a copy of the notice and no further action is required. NP (Notice Provided) indicates the notice was provided.

12. Created by CCTC What do I do when performing CPIU functions and the patient is not here? The field is mandatory. How do I get off the screen?

13. Created by CCTC If no flag is checked the patient has not received the Notice. If the patient is not present, you will select MR (Mail Requested) unless otherwise instructed by your supervisor. If a bad address indicator is present, correct the address and then select MR. An example when you might use MR is if the patient called to change their address or phone number and you are in CPI Update. MR (Mail Requested) will be used when a notice needs to be mailed. HBO/OSCAR will generate the mailer and change the flag to “Notice Mailed”. If you correct a bad address in the system the “Mail Requested” flag will need to be updated.

14. Created by CCTC IT (Indirect Treatment) You should not use this flag unless directed by your supervisor. It will be used in cases where UAMS is acting as an indirect treatment provider such as the laboratory processing mail-in specimens. PB (Business Office) is to be used only be the Business Office

15. Created by CCTC Recap of the flags 1.IT – Indirect Treatment – Only use when directed by your supervisor. Its most common use will be for mail – in specimens to our laboratory. 2. MR – Mail Requested – Use this flag when a Notice needs to be mailed to the patient. 3.NM – Noticed Mailed – You will not select Notice Mailed. The system sets this automatically after generating the mailer when you select MR (Mail Requested). After a few months, you will see the flag often. It tells you the Notice was mailed. 4.NP – Notice Provided – This is the flag you will use most often. You will select it when you give the patient a copy of the Notice. 5.PB – Business Office Only – This flag will be used by the business office in specific situations. 6.US – Urgent Situation – Only use this flag when directed by your supervisor. It will be used in limited circumstances where the patient is present but unable to receive the Notice and sign the acknowledgment. For example, a critically ill patient in the ED who is admitted to the hospital. Admissions will monitor that patient’s situation and continue to try and get the acknowledgment signed.

16. Created by CCTC Recap of Actions If the patient is present and the: Privacy Notice Field is blank or contains IT (Indirect Treatment) or MR (Mail Requested) or PB (Business Office) or US (Urgent Situation). Provide the notice, obtain written acknowledgement and enter NP into the Privacy Notice field. The Privacy Notice Field contains NM (Notice Mailed) or NP (Notice Provided), do nothing. Exception: A specific workflow will be developed for inpatient admissions to ensure the patient received the notice when the NM (Notice Mailed) flag is present.

17. Created by CCTC Additional Information The Privacy Notice field will be optional when scheduling an appointment. Individual clinics will determine whether the “Mail Requested” flag should be activated when appointments are made according to the optimal workflow for their area. If the patient declines to sign the acknowledgment, it is not necessary to try and get their signature the next visit. The NP (Notice Provided) flag cannot be changed in the system. The other flags can be changed as appropriate There are not plans to use the Notes/Privacy Notation fields at this time.

18. Created by CCTC Draft Sample Script when Providing a Copy of the Notice Employee: Here is a copy of the Notice of Privacy Practices that we are giving to all of our patients. It describes your rights to the confidentiality of your health information. The law requires that we provide a copy to you, and we need you to sign this acknowledgment that you have received it. (Give the Notice and the acknowledgment to the patient)

19. Created by CCTC Draft script for Possible Responses by the Patient Patient: But I haven’t had a chance to read it. What if I don’t agree with what it says? Employee: You are just acknowledging that you received it. If you could go ahead and sign it now, you can read it later. Please feel free to ask me about anything that you do not understand. Patient: I don’t sign anything I haven’t read. Employee: That is not a problem. Patient: Why are you giving me this notice anyway? I’ve never gotten this when I came here before? Employee: Giving you a copy of this notice is a requirement of the new Federal Privacy Law.

20. Created by CCTC COVER LETTER