RETENTION, STORAGE, AND DISPOSAL/DESTRUCTION OF CLINICAL RECORDS

A. EFFECTIVE DATE:

August 1, 2018

B. PURPOSE:

To establish the retention, storage, and destruction requirements for all records, regardless of medium, that contains demographic or medical information about a patient (“medical records”).

C. POLICY:

It is the policy of Jocelyn R. Elliott, LSCSW to retain, store, and destroy medical records in compliance with applicable legal and regulatory requirements.

D. SCOPE:

This policy applies to the Designated Record Set. The Designated Record Set is a group of records maintained by or for Jocelyn R. Elliott, LSCSW that is:

(a) the medical records and billing records about a patient, and/or

(b) used in whole or in part, by or for Jocelyn R. Elliott, LSCSW, to make decisions about a patient. For purposes of this definition, the term “record” means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for Jocelyn R. Elliott, LSCSW

E. DEFINITIONS:

None

F. PROCEDURE:

RETENTION OF RECORDS:

• Jocelyn R. Elliott, LSCSW follows the State Agencies’ Records Schedule as outlined by Public Records Administrator’s office within the Kansas State Library. Clinical records must be retained for the entire retention period as outlined in the schedule; however, Jocelyn R. Elliott, LSCSW reserves the right to maintain records longer than what is required by the schedule.

• During the retention period the records will be protected from alteration, tampering, loss, and physical damage.

STORAGE OF RECORDS:

• Storage areas for inactive records can include either an area inside the facility that has been approved for records storage use or an off- site, private, professional record storage facility with which Jocelyn R. Elliott, LSCSW has an active contract for storage and retrieval services. NOTE: Storage warehouses, mini-storage facilities, and personal or rental property, including garages, basements, homes, trailers, etc., are NOT acceptable for storage of inactive medical records.

• Storage areas approved for records storage must be physically secure and environmentally controlled to protect records from unauthorized access and damage or loss due to temperature fluctuations, fire, water damage, pests, and other hazards.

• Any inactive records moved to off-site storage are boxed, labeled, and logged out of my clinical tracking system to allow for efficient access and retrieval if needed.

• Any paper-based records involved in litigation or investigation are considered to be active records and will be stored on-site in a secured file designated as such.

DESTRUCTION OF RECORDS:

• In the absence of investigation, litigation, or legal hold, records that have satisfied their legal, fiscal, administrative and archival requirements may be destroyed in accordance with retention as outlined in the State Records Retention Schedule or as deemed appropriate beyond the maximum retention period by Jocelyn R. Elliott, LSCSW.

• No entire clinical record shall be destroyed on an individual basis.

• Records should not be destroyed if they are currently involved in open litigation, lawsuit, subject of any government investigation, or similar activities. Once litigation, lawsuit, or government investigation is completed records may be destroyed accordingly.

• Paper records that are scanned into any electronic medical record system will be destroyed after scanning, indexing, and 100% quality checking has taken place. Records will be held on site, in paper format for a period of six months post scanning, then destroyed on site. Authorization for destruction in these circumstances will be in accordance with existing rules.

• Paper records that are not scanned may be destroyed according to the current records retention schedule.

• Clinical records will be destroyed in a manner that does not allow for the information to be retrievable, recognizable, reconstructed, or practically read.

• All destruction of clinical records should be done in accordance with existing policy.

Notice of Privacy Practices (HIPAA)

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Contact Jocelyn Elliott at jelliottlscsw@gmail.com with any questions.

Why am I providing this notice?

Jocelyn R. Elliott, LSCSW compiles information relating to you and the treatment and services you receive. This information is called protected health information (PHI) and is maintained in a designated record set. I may use and disclose this information in various ways. Sometimes your agreement or authorization is necessary for me to use or disclose your information and sometimes it is not. This Notice describes how I use and disclose your protected health information and your rights. I am required by law to give you this Notice, and I am required to follow it. I may change this Notice at any time if the law changes or when my policies change. If I change the Notice, you will be given a revised Notice.

USES AND DISCLOSURES OF YOUR HEALTH INFORMATION THAT MAY BE MADE WITHOUT YOUR AUTHORIZATION:

1. For your treatment. I may share your protected health information with other treatment providers. For example, if you have a heart condition I may use your information to contact a specialist and may send your information to that specialist. I may send your information to other treatment providers, as necessary.

2. For payment. I may share your protected health information with anyone who may pay for your treatment. For example, I may need to obtain a pre-authorization for treatment or send your health information to an insurance company so it may pay for treatment. However, if you pay out of pocket for your treatment and make a specific request that I do not send information to your insurance company for that treatment, I will not send that information to your insurer except under certain circumstances.

3. For my healthcare operations. I may use and disclose your protected health information when it is necessary for me to function as a business. For example, when I contract with other businesses to do specific tasks for me, I may share your protected health information related to those tasks. When I do this, the business agrees in the contract to protect your health information and use and disclose such health information only to the extent Jocelyn R. Elliott, LSCSW would be able to do so. These businesses are called Business Associates. Another example is if I want to see how well my staff is doing, I may use your protected health information to review their performance.

4. For appointment reminders. I may use your protected health information to remind you of appointments, including leaving a voicemail message.

5. For Surveys. I may use and disclose your protected health information to contact you to assess your satisfaction with my services.

6. For providing your information on treatment alternatives or other services. I may use and disclose protected health information to tell you about or recommend possible treatment options or alternatives that may be of interest to you. I may also use and disclose protected health information to tell you about health-related benefits or services that may be of interest to you. I will give you the opportunity to let me know if you no longer wish to receive this type of information.

7. To discuss your treatment with other people who are involved with your care. I may disclose your health information to a friend or family member who is involved in your care. I may also disclose your health information to an organization assisting in a disaster relief effort so that your family can be notified about your condition, status, and location. [Unless you inform me that you do not want any information released, I may tell individuals who ask, about your location in the hospital and provide a general statement of your condition.]

8. Research. Under certain circumstances, I may use and disclose your protected health information for medical research. All research projects, however, are subject to a special approval process. Before I use or disclose your health information for research, the project will have been approved.

9. As Required By Law. I will disclose your protected health information when the law requires me to do so.

10. To Avert a Serious Threat to Health or Safety. I may use and disclose your protected health information when necessary to prevent a serious threat to your health and safety or the health and safety of another person.

11. Military and Veterans. The protected health information of members of the United States Armed Forces or members of a foreign military authority may be disclosed as required by military command authorities.

12. Employers. I may disclose your protected health information to your employer if I provide you with health care services at your employer's request and the services are related to an evaluation for medical surveillance of the workplace or to evaluate whether you have a work-related illness or injury. I will tell you when I make this type of disclosure.

13. Workers' Compensation. I may release your protected health information for workers' compensation or similar programs providing you benefits for work-related injuries or illness.

14. Public Health Risks. I may disclose your protected health information for public health activities which include the prevention or control of disease, injury, or disability; reporting births and deaths; reporting child abuse or neglect; reporting reactions to medications or problems with products; notifying people of recalls of devices or products; to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; or to notify the appropriate government authority if I believe you have been the victim of abuse, neglect or domestic violence.

15. Health Oversight Activities. I may disclose your protected health information to a health oversight agency for activities authorized by law. These activities are necessary for the government to monitor the health care system, government programs, and civil rights laws.

16. Legal Proceedings. I may disclose your protected health information when I receive a court or administrative order. I may also disclose your protected health information if I get a subpoena, or another type of discovery request. If there is no court order or judicial subpoena, the attorneys must make an effort to tell you about the request for your protected health information.

17. Law Enforcement. When a law enforcement official requests your protected health information, it may be disclosed in response to a court order, subpoena, warrant, summons, or similar process. It may also be disclosed to help law enforcement identify or locate a suspect, fugitive, material witness, or missing person. I may also disclose protected health information about the victim of a crime; about a death I believe may be the result of criminal conduct; about criminal conduct in the community; or in an emergency to report a crime, the location of the crime, victims of the crime, or to identify the person who committed the crime.

18. Coroners, Medical Examiners, and Funeral Directors. I may disclose your protected health information to a coroner, medical examiner, or a funeral director.

19. National Security and Intelligence Activities. I may disclose your protected health information to federal officials for intelligence, counterintelligence, and other national security activities when authorized by law.

20. Protective Services for the President and Others. I may disclose your protected health information to certain federal officials so they may provide protection to the President, other persons, or foreign heads of state, or to conduct special investigations.

21. Inmates or Persons in Custody. If you are an inmate of a correctional institution or under the custody of a law enforcement official, I may release your protected health information to the correctional institution or a law enforcement official when it is necessary for the institution to provide you with health care; when it is necessary to protect your health and safety or the health and safety of others; or when it is necessary for the safety and security of the correctional institution.

OTHER USES AND DISCLOSURES:

1. Psychotherapy notes are a particular type of protected health information. Mental health records generally are not considered psychotherapy notes. Your authorization is necessary for me to disclose psychotherapy notes.

2. Your authorization is also necessary for some marketing uses of your protected health information.

3. Other uses and disclosures of your protected health information not covered by this Notice or the laws that apply to me will be made only with your written authorization. You may revoke your authorization in writing at any time, provided you notify me. If you revoke your authorization, it will not take back any disclosures I have already made.

YOUR HEALTH INFORMATION RIGHTS:

1. Right to Access. You have the right to access, or inspect and obtain a copy of your protected health information. To exercise this right, you should contact Jocelyn R. Elliott because you must complete a Use and Disclosure so I have the information I need to process your request. You may request that your records be provided in an electronic format You and I can work together to agree on an appropriate electronic format. Or you can receive your records in a paper copy. You may also direct that your protected health information be sent in electronic format to another individual. You may be charged a reasonable fee for access. I can refuse access under certain circumstances. If I refuse access, I will tell you in writing and in some circumstances you may ask that a neutral person review the refusal.

2. Right to Amend Your Records. If you feel that your protected health information is incorrect or incomplete, you may ask that I amend your health records. To exercise this right, you must contact Jocelyn R. Elliott to complete the Request to Amend PHI Form stating your reason for the request and other information that I need to process your request. I can refuse your request if I did not create the information, if the information is not part of the information I maintain, if the information is part of information that you were denied access to, or if the information is accurate and complete as written. You will be notified in writing if your request is refused, and you will be provided an opportunity to have your request included in your protected health information.

3. Right to an Accounting. You have a right to an accounting of disclosures of your protected health information that is maintained in a designated record set. This is a list of persons, government agencies, or businesses who have obtained your health information. To exercise this right, you should contact Jocelyn R. Elliott because you must complete the Request for Accounting of Disclosures of PHI Form to provide me with the information that I need to process your request. There are specific time limits on such requests. You have the right to one accounting per year at no cost.

4. Right to a Restriction. You have the right to ask me to restrict disclosures of your protected health information. To exercise this right, you should contact Jocelyn R. Elliott because you must complete a Request to Restrict Uses and Disclosures of PHI Form to provide me with the information that I need to process your request. If you self-pay for a service and do not want your health information to go to a third party payor, I will not send the information, unless it has already been sent, you do not complete payment, or there is another specific reason I cannot accept your request. For example, if your treatment is a bundled service and cannot be unbundled and you do not wish to pay for the entire bundle, or the law requires me to bill the third party payor (e.g., a governmental payor), I cannot accept your request. I do not have to agree to any other restriction. If I have previously agreed to another type of restriction, I may end that restriction. If I end a restriction, I will inform you in writing.

5. Right to Communication Accommodation. You have the right to request that I communicate with you in a certain way or at a specific location. To exercise this right, you should contact Jocelyn R. Elliott because you must complete the Request for Communication Accommodation Form to provide me the information that I need to process your request.

6. Breach Notification. You have the right to be notified if I determine that there has been a breach of your protected health information.

7. Right to Obtain the Notice of Privacy Practices. You have the right to have a paper copy of this Notice. You may request a copy from Jocelyn R. Elliott, LSCSW or you may print this document.

8. Right to File a Complaint. If you believe your privacy rights as described in this Notice have been violated, you may file a written complaint with Jocelyn R. Elliott or with:

U.S. Department of Health and Human Services – Office for Civil Rights

(Regional Office at Kansas City), 601 East 12th Street Room 248

Kansas City, MO 64106

816.426.7277,

www.hhs.gov/ocr/privacy/hipaa/complaints/index.html.

You will not be penalized for filing a complaint.

YOUR RIGHTS REGARDING ELECTRONIC HEALTH INFORMATION TECHNOLOGY

Jocelyn R. Elliott, LSCSW participates in electronic health information technology or HIT. This technology allows a provider or a health plan to make a single request through a health information organization or HIO to obtain electronic records for a specific patient from other HIT participants for purposes of treatment, payment, or health care operations. HIOs are required to use appropriate safeguards to prevent unauthorized uses and disclosures.

You have two options with respect to HIT. First, you may permit authorized individuals to access your electronic health information through an HIO. If you choose this option, you do not have to do anything.

Second, you may restrict access to all of your information through an HIO (except as required by law). If you wish to restrict access, you must submit the required information either online at:

http://www.KanHIT.org

or by completing and mailing a form

available at http://www.KanHIT.org.

You cannot restrict access to certain information only; your choice is to permit or restrict access to all of your information.

If you have questions regarding HIT or HIOs, please visit http://www.KanHIT.org for additional information.

If you receive health care services in a state other than Kansas, different rules may apply regarding restrictions on access to your electronic health information. Please communicate directly with your out-of-state health care provider regarding those rules.

CHANGES TO THIS NOTICE:

I reserve the right to change this Notice at any time. I reserve the right to make the revised Notice effective for protected health information that I currently maintain in our possession, as well as for any protected health information I receive, use, or disclose in the future.

Effective Date: 08.01.18