Notice of Privacy Practices Policy

Scope

This policy applies to any HIPAA Affected Area that provides health care at Indiana University or is part of the management of the IU health plans. This policy is in accordance with the Privacy and Security Rules of the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.           

Please refer to the IU HIPAA Affected Areas document for a full list of departments impacted within Indiana University.  

Back to top

Policy Statement

Notice of Privacy Practices

1. IU HIPAA Affected Areas that provide health care or are part of the IU health plans shall maintain a Notice of Privacy Practices that explains how protected health information may be used and disclosed, as well as an individual’s rights and the provider’s legal duties under HIPAA and HITECH. 
   The following clinical areas are responsible for complying with this policy and for developing operating procedures that implement it:
   • IU’s health plans (Human Resources)
   • School of Dentistry (IUSD)
   • School of Optometry (IUSO)
   • Indiana University Health Center (IUB)
   • IUPUI Campus Health Center
   • School of Arts & Science -Speech & Hearing Clinics
2. The Notice shall be written in plain language and shall contain the elements required by the HIPAA Privacy Rule.
3. These IU HIPAA Affected Areas may not use or disclose protected health information in a manner inconsistent with their Notice of Privacy Practices.

Distribution/Publication of the Notice

1. Notice will be provided to individuals with whom the HIPAA Affected Area has a direct treatment relationship:
   1. No later than the date of the first service delivery, including service delivered electronically to suchindividual;
   2. Upon request; an
   3. On or after the effective date of a revision of the IU HIPAA Affected Area’s Notice.
2. Following an emergency treatment situation, the HIPAA Affected Area will provide the individual with the Notice as soon as reasonably practicable.
3. In the case of patients who are minors, Notice should be given to the minor’s parent or legal guardian.
4. The Notice must be posted in a prominent location where it is reasonable to expect that patients will see and have an opportunity to read the Notice.
5. If the Notice is revised, the HIPAA Affected Area must post the revised Notice and make the Notice available upon request. Former Notices must be retained for six (6) years.
6. The IU HIPAA Affected Areas shall prominently post the Notice on any web sites it maintains that provide information about its customer services or benefits, and it shall make the Notice available electronically through its web site.

Acknowledgement of the Notice of Privacy Practices

1. Except in an emergency treatment situation, reasonable effort shall be made by the IU HIPAA Affected Area to obtain a written acknowledgement from the patient or the patient’s legally authorized representative that he or she has received the HIPAA Affected Area’s Notice of Privacy Practices.
2. Documentation of reasonable attempts to provide the current Notice shall be maintained in the medical record. Refusals to sign the acknowledgementor refusals to accept the Notice shall also be documented.

Back to top

Reason for Policy

The Health Insurance Portability and Accountability Act requires that health plans and covered health care providers develop and distribute a Notice of Privacy Practices (“Notice”) which describes the provider’s uses and disclosures of protected health information, an individual’s rights with regard to his/her own protected health information, the provider’s duties with regard to the individual’s protected health information, the complaint process, a contact number, and the effective date of the Notice.

This policy describes IU’s Notice of Privacy Practices, the method for distributing the Notice and documenting its distribution.

Back to top

Definitions

See Glossary of HIPAA Related Terms for a complete list of terms.

Back to top

Sanctions

See HIPAA-G01: HIPAA Sanctions Guidance.

Back to top

History

07/01/2015      Effective Date
08/01/2016      Updated retention requirements for NPPs

Back to top