HIPAA COMPLIANCE POLICY
Effective Date: 12/01/2023
1. Purpose
This policy is designed to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) for Niche Psychiatry and to safeguard the privacy and security of Protected Health Information (PHI) in both in-person and online psychiatric practice.
2. Applicability
This policy applies to all employees, contractors, and agents of Niche Psychiatry who have access to PHI, whether in person or through online platforms.
3. Privacy and Security Officer
Niche Psychiatry designates Dr. Rosemary Wright as the Privacy Officer and Security Officer. They are responsible for the development, implementation, and maintenance of HIPAA compliance within the practice.
4. Protected Health Information (PHI) Handling
4.1. In-Person Practice:
- Ensure that all physical records containing PHI are stored in secure and locked locations.
- Limit access to physical records to authorized personnel.
- Implement measures to prevent unauthorized individuals from overhearing discussions related to PHI.
4.2. Online Practice:
- Use secure and HIPAA-compliant platforms for telehealth sessions.
- Ensure that all electronic communication containing PHI is encrypted.
- Implement strong access controls for online platforms to prevent unauthorized access.
5. Patient Consent
5.1. In-Person Practice:
- Obtain written consent from patients before disclosing their PHI to third parties.
- Clearly explain to patients the limitations of privacy in shared physical spaces.
5.2. Online Practice:
- Obtain informed consent from patients for telehealth services, clearly outlining the potential risks and limitations.
- Ensure the use of secure and private virtual environments for telehealth sessions.
6. Training and Awareness
- Provide ongoing training to employees on HIPAA regulations and the policies and procedures outlined in this document.
- Ensure that all staff members are aware of the importance of safeguarding PHI in both in-person and online interactions.
7. Breach Notification
- Establish a process for promptly notifying affected individuals, the Department of Health and Human Services (HHS), and any other relevant entities in the event of a breach of unsecured PHI.
8. Auditing and Monitoring
- Regularly audit and monitor systems and procedures to ensure compliance with HIPAA regulations.
- Conduct periodic risk assessments to identify and address potential vulnerabilities.
9. Enforcement
- Establish consequences for non-compliance with HIPAA policies and procedures, up to and including termination of employment or contract.
10. Review and Revision
- Regularly review and update this policy to reflect changes in technology, regulations, or the business environment.
11. Contact Information
- Provide contact information for the Privacy Officer and Security Officer for reporting concerns or seeking clarification on HIPAA-related matters.