Staff HR Policy D-747.01
Institutional Effectiveness Criterion: Culture

Health Insurance Portability and Accountability Act (HIPAA) Procedure

This staff procedure is intended to carry out policy D-747.00 in order to comply with all requirements and regulations of The Health Insurance Portability and Accountability Act of 1996 HIPAA), regarding the use and disclosure of employee and/or plan member (hereafter referred to as plan member) Protected Health Information (PHI) and access to this information by plan members.

Any questions about this procedure or policy D-747.00 should be directed to the College's privacy officer, who is the Director of Human Resources:

Human Resources Department
Privacy Officer
Northwestern Michigan College
1701 East Front Street
Traverse City, Michigan, 49686
(231) 995-1350

Northwestern Michigan College's Pledge Regarding PHI.
Northwestern Michigan College is committed to protecting its plan members' personal health information. The College's claims administrators create a record of the health care claims reimbursed under the Plan for Plan administration purposes, and this policy applies to all of the medical records and other PHI maintained by the College. Personal doctors or health care providers may have different policies or notices regarding the use and disclosure of PHI created in their facilities. The HIPAA Procedure (D-747.01) will describe how the College may use and disclose PHI about plan members, as well as their obligations and plan member rights regarding this use and disclosure.

The College's health plans and their claims administrators (hereafter referred to as NMC) are required by law to keep all PHI that identifies plan members private, as required by the HIPAA Privacy Rule, give plan members a notice of their legal duties and privacy practices regarding plan members PHI, and follow the terms of the policy and procedure currently in effect.

Use and Disclosure of PHI

The following categories describe different ways that NMC may use and disclose PHI without the member's written authorization, presenting examples for each category, but not listing every possible use or disclosure. However, all of the permissible uses and disclosures fall within one of these categories.

• Treatment. NMC may use or disclose plan member PHI to facilitate medical treatment or services by providers.
  For example, NMC may disclose plan member PHI to providers, including doctors, nurses, technicians, medical students, or other hospital personnel who are involved in plan member care.
• Payment. NMC may use and disclose plan member PHI to determine eligibility for plan benefits, to facilitate payment for the treatment and services the plan member receives from health care providers, to determine benefit responsibility under the plan, or to coordinate plan coverage.
  For example, NMC may disclose a plan member's medical history to the plan member's health care provider to determine whether a particular treatment is medically necessary or to determine whether the plan will cover the treatment. NMC may also share PHI with another health plan to coordinate benefit payments.
• Health Care Operations. NMC may use and disclose plan member PHI in order to operate the plan.
  For example, NMC may use PHI in connection with the following: (1) conducting quality assessment and improvement activities; (2) underwriting, premium rating, and other activities relating to plan coverage; (3) submitting claims for stop-loss coverage; (4) conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; and (5) conducting general business management and development tasks.
• As Required by Law. NMC will disclose a plan member's PHI when required to do so by federal, state, or local law.
  For example, NMC may disclose PHI when required by a court order in a litigation proceeding, such as a malpractice action.
• To Avert a Serious Threat to Health or Safety. NMC may use and disclose a plan member's PHI when necessary to prevent a serious threat to the health and safety of the plan member, another person, or the public. NMC would only disclose this information as permitted by law to someone able to help prevent the threat.
  For example, NMC may disclose plan member PHI in a proceeding regarding the licensure of a physician.

Special Situations

NMC may also use and disclose plan member PHI without the member's written authorization in the following special situations:

• Health Plan Sponsor. NMC may disclose PHI to another employer-sponsored health plan to facilitate claim payments under that plan, and to a plan member's Human Resources Department solely for purposes of administering benefits under a plan.
• Organ and Tissue Donation. NMC may release PHI to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank as necessary to facilitate organ or tissue donation and transplantation.
• Military and Veterans. If the plan member is a member of the armed forces, NMC may release plan member PHI as required by military command authorities. NMC may also release PHI about foreign military personnel to the appropriate foreign military authority.
• Workers' Compensation. NMC may release PHI for Workers' Compensation or similar programs that provide benefits for work-related injuries or illnesses.
• Public Health Risks. NMC may disclose PHI for public health activities, including the following: (1) prevention or control of disease, injury, or disability; (2) report of births and deaths; (3) report of child abuse or neglect; (4) report of reactions to medications or problems with products; (5) notification of product recalls; (6) notification of disease exposure or risk of disease contraction or proliferation; and (7) notification of patient abuse, neglect, or domestic violence to the appropriate government authority (only if the plan member agrees or when required or authorized by law).
• Health Oversight Activities. NMC may disclose PHI to a health oversight agency for activities authorized by law, e.g., audits, investigations, inspections, and licensure, which are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
• Lawsuits and Disputes. If the plan member is involved in a lawsuit or a dispute, NMC may disclose plan member PHI in response to a court or administrative order or a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if NMC has attempted to inform the plan member of the request or to obtain an order protecting the information requested.
• Law Enforcement. NMC may release PHI if requested by a law enforcement official in the following circumstances: (1) in response to a court order, subpoena, warrant, summons, or similar process; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime in emergency circumstances; and (4) to disclose information about the victim of a crime if (under certain limited circumstances) NMC is unable to obtain the person's agreement, about a death NMC believe may be the result of criminal conduct, and about criminal conduct at a hospital.
• Coroners, Medical Examiners, and Funeral Directors. NMC may release PHI to a coroner or medical examiner if necessary (e.g., to identify a deceased person or determine the cause of death), and NMC may release hospitalized patients' PHI to funeral directors as necessary for them to carry out their duties.
• National Security and Intelligence Activities. NMC may release plan member PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
• Inmates. If a plan member is an inmate of a correctional institution or under the custody of a law enforcement official, NMC may release PHI to the institution or official to provide the plan member with health care, to protect the health and safety of the plan member or others, or for the safety and security of the correctional institution.

Rights of Individuals Regarding PHI

A plan member has the following rights regarding plan member PHI that NMC maintains, and the plan member must submit requests in writing to the Privacy Officer: to exercise these rights

• Right to Access. The plan member may request access to PHI in a "designated record set" that may be used to make decisions about plan benefits, including the right to inspect the information and the right to a copy of the information. NMC may charge a fee for the costs of copying, mailing, or other supplies associated with the request. NMC may deny the request in certain very limited circumstances. If access is denied, the member or the member's personal representative will be provided with a written denial setting forth the basis for the denial, a description of how the member may exercise PHI review rights, and a description of how the member may complain to the Secretary of the U.S. Department of Health and Human Services.
  "Designated Record Set" includes the enrollment, payment, billing, claims, adjudication and case or medical management records systems maintained by or for a health plan; or other information used in whole or in part by or for the health plan to make decisions about individuals.
  The requested information will be provided within thirty (30) days if the information is maintained on site or within sixty (60) days if the information is maintained off site. A single thirty (30) day extension is allowed if NMC is unable to comply with the deadline.
• Right to Amend. If a plan member feels that NMC's records of his or her PHI are incorrect or incomplete, the plan member may request an amendment to the information for as long as the information is kept by or for the plan. The plan member's written request must include a supporting reason; otherwise NMC may deny the plan member's request for an amendment. In addition, NMC may deny the plan member's request to amend information that is not part of the PHI kept by or for the Plan; was not created by NMC (unless the person or entity that created the information is no longer available to make the amendment); is not part of the information that the plan member would be permitted to inspect and copy, or is accurate and complete.
• Right to an Accounting of Disclosures. The plan member may request an accounting of disclosures where such disclosures were made for any purpose other than treatment, payment, or health care operation; to individuals about their own PHI; or based upon the requestor's written authorization. The plan member's written request must state a time period for the accounting not longer than six years (starting after April 2003) and indicate the plan member's preferred form (e.g., paper or electronic). NMC will provide for free the first accounting the plan member requests within a 12-month period, but NMC may charge the plan member for the costs of providing additional lists. NMC will notify the plan member prior to provision and the plan member may cancel the request.
• Right to Request Restrictions. The plan member may request a restriction or limitation on his or her PHI that NMC uses or discloses for treatment, payment, or health care operations or that NMC discloses to someone involved in plan member care or the payment for plan member care (e.g., a family member or friend). For example, the plan member could ask that NMC not use or disclose information about a surgery the plan member had. The plan member's written request must describe what information to limit; whether to limit NMC's use, disclosure, or both; and to whom the limits apply (e.g., the plan member's spouse). NMC is not required to agree to the plan member's request.
• Right to Request Confidential Communications. The plan member may request that NMC communicate with him or her about health matters in a certain way or at a certain location (e.g., only by mail or at work), and NMC will accommodate all reasonable requests. The plan member's written request must specify how or where the plan member wishes to be contacted and does not need to state the reason for the request.
• Right to a Paper Copy of this Procedure. If the plan member received this procedure electronically, the plan member may receive a paper copy at any time by contacting the Privacy Officer.

Minimum Necessary Standard

When using or disclosing PHI or when requesting PHI from another covered entity, NMC will make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request, taking into consideration practical and technological limitations.

However, the minimum necessary standard will not apply in the following situations:

• Disclosures to or requests by a health care provider for treatment;
• Uses or disclosures made to the individual;
• Disclosures made to the Secretary for the U.S. Department of Health and Human Services;
• Disclosures made pursuant to express written authorization.

This notice does not apply to information that has been de-identified. De-identified information is information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual.

In addition, NMC may use or disclose "summary health information: to a Health Plan Sponsor for obtaining premium bids or modifying, amending or terminating the group health plan, which summarizes the claims history, claims expenses or type of claims experienced by individuals for whom a Plan Sponsor has provided health benefits under a group health plan; and from which identifying information has been deleted in accordance with HIPAA.

Complaints

If a plan member believes his or her privacy rights have been violated, the plan member may file a complaint with the Secretary of the U.S. Department of Health and Human Services. The plan member may file a complaint with the plan by contacting the Privacy Officer in writing. The plan member will not be penalized for filing a complaint.

Other Uses of PHI

NMC will only use and disclose PHI not covered by this procedure or the laws that apply to them with the plan member's written permission. If the plan member permits NMC to use or disclose PHI, the plan member may revoke that permission in writing, at any time. If the plan member revokes his or her permission, NMC will no longer use or disclose the plan member's PHI for the reasons covered by the written authorization. However, NMC is unable to retract any disclosures already made with the plan member's permission, and NMC is required to retain records of the care provided to the plan member.

Changes to this Procedure

The Director of Human Resources, with the appropriate involvement of the College Privacy Officer or designee reserves the right to revise or change this procedure which may be effective for the plan member's PHI NMC already possesses as well as any such information NMC receives in the future.

If any provision(s) of this policy or set of bylaws conflicts with laws applicable to Northwestern Michigan College, including the Community College Act of 1966, the Freedom of Information Act, or the Open Meetings Act, as each may be amended from time to time, such laws shall control and supersede such provision(s).