Data Privacy Policy

Policy

Apex Home Care recognizes the right to confidentiality and data privacy for each person receiving services from Apex Home Care. This policy provides general guidelines and principles for safeguarding service recipient rights to data privacy and access to their records.

Procedures

1. Private Data

   1. Private data includes all information on persons that has been gathered by Apex Home Care or from other sources for program purposes as contained in an individual data file, including their presence and status in Apex Home Care programs.

   2. Data is private if it is about individuals and is classified as private by state or federal law. Only the following persons are permitted access to private data:

      • The individual who is the subject of the data or a legal representative of that subject.

      • Anyone to whom the individual gives signed consent to view the data.

      • Employees of the welfare system whose work assignments reasonably require access to the data. This includes staff persons in Apex Home Care.

      • Agents of the welfare system or investigators.

      • Anyone the law says can view the data.

   3. Data collected within the welfare system about individuals are considered welfare data. Welfare data are private data on individuals, including medical and/or health data. Agencies in the welfare system include, but are not limited to the Department of Human Services; local social services agencies, including a person’s case manager; county welfare agencies; human services boards; the Office of Ombudsman for Mental Health and Developmental Disabilities; and persons and entities under contract with any of the above agencies. This includes Apex Home Care and other licensed caregivers jointly providing services to the same person.

   4. Once informed consent has been obtained from the person or the legal representative, there is no prohibition against sharing welfare data with other persons or entities within the welfare system for the purposes of planning, developing, coordinating, and implementing needed services.

   5. Data created prior to the death of a person retains the same legal classification (public, private, confidential) after the person’s death that it had before the death.

2. Providing notice: At the time of service initiation, the person and his/her legal representative, if any, will be notified of Apex Home Care's data privacy policy. Staff will document that this information was provided to the individual and/or their legal representative in the individual record.

3. Obtaining informed consent or authorization for release of information

   1. At the time informed consent is being obtained staff must tell the person or the legal representative individual the following:

      • Why the data is being collected;

      • how the agency intends to use the information;

      • whether the individual may refuse or is legally required to furnish the information;

      • what known consequences may result from either providing or refusing to disclose the information;

      • with whom the collecting agency is authorized by law to share the data;

      • what the individual can do if they believe the information is incorrect or incomplete;

      • how the individual can see and get copies of the data collected about them; and

      • any other rights that the individual may have regarding the specific type of information collected.

   2. A proper informed consent or authorization for release of information form must include the below factors (unless otherwise prescribed by the HIPAA Standards of Privacy of Individually Identifiable Health Information).

      • It must be written in plain language.

      • It must be predated.

      • It must designate the particular agencies or person(s) who will get the information.

      • It must specify the information that will be released.

      • It must indicate the specific agency/agencies or person/persons who will release the information.

      • It must specify the purposes for which the information will be used immediately and in the future.

      • It must contain a reasonable expiration date of no more than one year.

      • It must specify the consequences for the person by signing the consent form, including this: Consequences: I know that state and federal privacy laws protect my records. I know why I am being asked to release this information. I do not have to consent to the release of this information. But not doing so may affect Apex Home Care's ability to provide needed services to me. If I do not consent, the information will not be released unless the law otherwise allows it. I may stop this consent with a written notice at any time, but this written notice will not affect information Apex Home Care has already released. The person(s) or agency(ies) who get my information may be able to pass it on to others. If my information is passed on to others by Apex Home Care, that information may no longer be protected by this authorization. This consent will end one year from the date I sign it, unless the law allows for a longer period.

   3. Apex Home Care must maintain all informed consent documents in the consumer's individual record.

4. Staff access to private data

   1. This policy applies to all program staff, volunteers, and persons or agencies under contract with Apex Home Care.

   2. Staff persons do not automatically have access to private data about the persons served by Apex Home Care or about other staff or agency personnel. Staff persons must have a specific work function need for the information. Private data about persons are available only to those program employees whose work assignments reasonably require access to the data; or who are authorized by law to have access to the data. All computers are password-protected as are specific databases. Offices and consumer records rooms are locked when unsupervised

   3. Any written or verbal exchanges about a person's private information by staff with other staff or any other persons will be done in such a way as to preserve confidentiality, protect data privacy, and respect the dignity of the person whose private data is being shared.

   4. As a general rule, doubts about the correctness of sharing information should be referred to a supervisor.

5. Individual access to private data

   1. Individuals or their legal representatives have a right to access and review that individual’s own record.

   2. A staff person will be present during the review and will make an entry in the person's progress notes as to the person who accessed the record, will record the date and time of access, and will list any copies made from the record.

   3. An individual may challenge the accuracy or completeness of any information contained in the record. Staff will refer the individual to the grievance policy for lodging a complaint.

   4. Individuals may request copies of pages in their record.

   5. No individual, legal representative, staff person, or anyone else may permanently remove or destroy any portion of the person’s record.

6. Case manager access to private data: A person’s case manager and the foster care licensor have access to the records of persons served by Apex Home Care.

7. To request release of an individual’s information, the following must be completed:

   1. Complete Apex Home Care’s release of information authorization form.

   2. Carefully list all the consults, reports, or assessments needed, giving specific dates whenever possible.

   3. Identify the purpose for the request.

   4. Clearly identify the recipient of information. If information is to be sent to the program's health care consultant or other staff at the program, include “Attention: [name of person to receive the information]”, and the name and address of the program.

   5. Assure informed consent to share the requested private data with the person or entity has been obtained from the person or the legal representative.

   6. Keep the request for information form in the person’s record.