Resources for our Patients

Arthritis Northwest
Effective Date: December 10, 2006
(in compliance with HIPAA Federal and State Regulations)

This notice describes how health information about you may be used and disclosed and how you can get access to this information.

Our Pledge regarding your Healthcare Information:
We understand that health information about you and your health is personal. We are committed to protecting health information about you. We create a record of the care and services you receive from us. We need these records to provide you with quality care and to comply with certain legal requirements. This Notice applies to all of the records of your care generated by this office, whether made by your personal doctor or others working in this office. This notice will tell you about the ways in which we may use and disclose health information about you. We also describe your rights to the health information we keep about you, and describe certain obligations we have regarding the use and disclosure of your health information.

We are required by law to:

• Make sure that health information that identifies you is kept private
• Give you this Notice of our legal duties and privacy practices with respect to health information about you; and
• Follow the terms of the Notice that is currently in effect.

How we may use and disclose health information about you:

• For treatment
• For payment
• For health care operations
• For appointment reminders
• As required by Law
• To avert a serious threat to health and safety
• To allow Worker’s Compensation Claims
• To allow Health oversight activities for Quality of Care
• As required for Lawsuits and disputes (when subpoenaed) & Law enforcement
• Coroners, health examiners and funeral directors

Your rights regarding Health Information about you:

• Right to Inspect and copy your health records.
• Right to Amend or ask us to correct a mistake in your health records.
• Right to an Accounting of Disclosures
• Right to Request Restrictions
• Right to Request Confidential Communications
• Right to a Paper copy of this Notice (a complete copy of the ANW Notice of Privacy Practices is available upon request)

Changes to this Notice:

• We reserve the right to change this Notice. We will post a copy of the current Notice in our facility with the current effective date on the first page.

Complaints:

• If you believe that your privacy rights have been violated, you may file a complaint with us. All complaints must be in writing. Please contact Karen Ferguson, Practice Administer.

Acknowledgement of Receipt of this Notice:

• We will request that you sign our form acknowledging you have received a copy of this notice. This acknowledgement will become part of your records.

Purpose:
Implement security practices to help protect employees and patients of Arthritis Northwest from damages related to the loss or misuse of sensitive information by undertaking the following:

• Define sensitive information
• Describe the physical security of data when it is printed on paper
• Describe the electronic security of data when stored and distributed
• Comply with state and federal law regarding identity theft protection

This policy enables Arthritis Northwest to comply with rules intended to protect existing patients, reduce further risk from identity theft; and minimize potential damage to the organization from fraudulent new accounts by undertaking the following:

• Identify risks that signify potentially fraudulent activity within new or existing covered accounts 
• Detect risks when they occur in covered accounts
• Respond to risks to determine if fraudulent activity has occurred and act if fraud has been attempted or committed.
• Update the policy periodically , including reviewing patient accounts and the identified risks that are part of the program

Definitions of Terms used in the Program:

Covered Accounts: A covered account includes any account that involves, or is designed to permit multiple payments or transactions; this includes personal accounts of clients as well as the business accounts of Arthritis Northwest, PLLC. 

Identify Information: is defined under this Rule as any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including name, address, telephone number, social security number, date of birth, government issued driver’s license or identification number, alien registration number, passport number, employer or taxpayer identification number, unique electronic identification number, computer’s internal address or routing code.

Identify Theft: is fraud committed using the identifying information of another person, which can be medical identity theft and/or financial identity theft.

Compliance officer: is the practice’s administrative personnel charged with the implementation of this program.

Red Flags: Red Flags are potential indicators of fraud. Any time a red flags or relevant warning sign is detected it should be investigated for verification. Red flags also include consumer reports that indicate a pattern of activity inconsistent with the history and usual pattern of activity of an applicant or customer. 

Suspicious Documents and Suspicious Personal Identify Information: Suspicious documents are those materials that appear to have been altered or forged, or give the appearance of having been destroyed and reassembled. Suspicious personal identifying information is any information or document that is inconsistent when compared against external information sources used by Arthritis Northwest. For example: driver’s license photograph is inconsistent when compared with the appearance of the patient, or the address on an application is fictitious, a mail drop, or prison.

Suspicious Account or Medical Record Activity: Payments stop on an otherwise consistently up to date account, mail sent to the patient is repeatedly returned as undeliverable. Breach in the practices computer system security. Records showing that medical treatment that is inconsistent with a physical examination or with a medical history as reported by the patient.

Alerts from Others: Include a complaint or questions from a patient based on patient’s receipt of a bill for another individual, a bill for a product or service that the patient denies receiving. A bill from Arthritis Northwest that the patient never patronized, an explanation of benefits for health services never received.

Scope:
This policy applies to all Arthritis Northwest employees, consultants, temporary employees and business associates.

Policy:

Arthritis Northwest employees are responsible for ensuring protection and security of sensitive information in accordance with state and federal laws.

1: Sensitive Information Policy (refer to HIPAA privacy and security policy/procedures.)

ANW employees are encouraged to exercise common sense and discretion in securing sensitive information. Sensitive information pertains to electronic or printed format of credit card information, tax identification, payroll information, medical record information, patient demographic information (i.e. date of birth, address phone number etc.)

2: Hard copy distribution

Each employee will ensure that sensitive and confidential hard copy documents are safeguarded while in use and secured when not in use. When documents containing sensitive information are discarded they will be destroyed or locked in discard bins for destruction.

3: Electronic Distribution

ANW employees will ensure cautious electronic transmission of sensitive information
Sensitive information may be internally transmitted using approved ANW network email.
No sensitive information should be sent outside of ANW secure network unless the information is encrypted and password protected and only to approved recipients.
Additionally confidentially statement should be included in any such emails.

Detecting Red Flags

New Accounts: In order to detect any the red flags identified above associated with the opening of a new covered account, ANW personnel will take the following steps to obtain and verify the identity of the person opening the account:

• Require identifying information such as: picture identification such as a driver’s license, state identification card or any other document that verifies patient’s address, name, and date of birth. If patient declines to have picture scanned into the computer, staff will remind the patient that he/she may be required to present proof of identity at each office visit.

Existing Accounts: In order to detect any of the red flags identified above for an existing account ANW personnel will take the following steps to monitor the transactions and activity on an account, in compliance with ANW’s HIPAA privacy policies and procedures:

• Verify the identification of a patient who requests information (either in person, via telephone, fax, or email.)
• Verify the identity of the patient checking in for services, either with presenting picture identification at each appointment or by having the patient’s picture taken. If patient declines to have picture scanned into the computer, staff will remind the patient that he/she may be required to present proof of identity at each office visit.
• Verify the validity of requests to change the billing address
• Verify changes in credit card or other information given for the purposes of billing and payment.
• Requiring when a patient is paying a bill via credit card in person, must present a form of identification. 

Responding to any Red Flags

In the event that ANW personnel detect any identified Red Flags, the practice shall take one or more of the following steps, depending on the Red Flag detected and on the degree of risk posed by the Red Flag:

• Notify the compliance officer who may determine it is necessary to contact the practice’s legal counsel for determination of appropriate steps to take. Fill out an incident report detailing Red Flag violations.
• Comply with state and federal requirements related to a breach of computer security
• If someone (front desk, MA etc ) detects a red flag violation, the appropriate people will be notified and the person will be roomed by the MA, as if the person will be seen, but the doctor will not go to that exam room. 
• Notify law enforcement, in compliance with the applicable law. 
• Contact the patient, in compliance with applicable law
• The appropriate personnel will fill out an incident report.
• Continue to monitor account for evidence of identity theft
• Change any passwords or other security devices that permit access to a covered account
• Do not open a covered account for a new patient if a Red Flag is detected
• Place a hold on further transactions related to an account for which a Red Flag has been detected

Protect Patient’s Identifying Information
Arthritis Northwest HIPAA privacy and security program will be utilitized, and updated along with this program, if necessary, to further prevent the likelihood of identity theft occurring with respect to the practice’s accounts.

Protecting and Correcting Medical Information
If Arthritis Northwest determines that medical identity theft has occurred, there may be errors in the patient’s chart as a result. Fraudulent information may have been added to a pre-existing chart, or the contents of an entire chart may refer only to the health condition of the identity thief, but under the victim’s personal identifying information. In such cases, Arthritis Northwest shall take the appropriate steps to avoid mistreatment due to fraudulent information, such as file extraction, cross-referencing charts etc. 

Program Updates:

Oversight of the Program
The compliance officer will periodically, but no less than annually, review and update this program to reflect changes in risks to patients and the soundness of the practice in protecting against identity theft, taking into consideration the practice’s experience with identity theft occurrences, changes in methods of how identity theft is being perpetrated, changes in methods of detecting, preventing and mitigating identity theft, changes in the types of accounts the practice offers and changes in the practices business relationships with other entities. After considering these factors the compliance officer will determine whether changes to this program are warranted. The compliance officer will present any recommended changes to the Practice Administrator for Arthritis Northwest, who will make a determination whether to accept, modify or reject the recommended changes to the program.

Staff Training and Reporting
Arthritis Northwest personnel whose role requires their participation in implementing this program will be trained by the compliance officer. Training shall cover the Red Flags identified in the program, detecting red flags, and reporting and responding to detected Red Flags. The compliance officer shall report annually to Arthritis Northwest’s practice administrator on the practice’s compliance with this Rule in terms of effectiveness of addressing identity theft, service provider arrangements, significant incidents involving identity theft and the practice’s response and recommendations for material changes to the program.