HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT (HIPAA)

Effective Date: 8/2015

Revision Date: 6/11/2021

The Health Insurance Portability and Accountability Act (HIPAA) privacy law generally prohibits the use and disclosure of health information without written permission. Amity Foundation complies with this regulation AND Amity Foundation and its Faculty agree to comply with management and disclosure of protected health information including reporting of child abuse; workplace-related illness, injury, or surveillance.

Certain Faculty and student (participant) information is protected under HIPAA. That information is called Protected Health Information, or PHI. PHI is past, present, or future mental or physical health or healthcare information that can be used to identify an individual and that is transmitted electronically or maintained in any other form.

Amity Foundation requires campuses to control and monitor physical access to information and areas where PHI is kept, as described in Amity’s Policy and Procedures Manual, HIPAA, Confidentiality, and Retention of student Records of PHI. Amity Foundation has established procedures for handling, processing, and storing PHI.

Authorization to Disclose Protected Health Information. All disclosures except the following must be authorized by the student (participant):  To the individual (student or health plan member) himself or herself, or to a personal representative of the individual (that is, to a person who has a legal relationship with the individual that establishes a right to make decisions concerning the health care of the individual).

• To demonstrate compliance with HIPAA regulations (cooperation with the Department of Health and Human Services when it conducts compliance reviews or investigates complaints).
• To cooperate with courts, public health authorities, law enforcement agencies or for other “public purposes” such as averting a series threat to health or safety.
• For service (treatment), payment or health care operations.
• For facility directories or to persons involved in the care of the individual, (provided that the individual has been given the opportunity to object to such disclosures).
• Those required by law.
• Permitted disclosures for public health activities (such as reporting diseases, collecting vital statistics, etc).
• Disclosure about victims of abuse, neglect, or domestic violence.
• Disclosure for research purposes.

If the faculty is authorized to have access to a student (participant) PHI, they may use that PHI within Amity Foundation for:

• Service (Treatment) (i.e., Treatment is the provision, coordination, or management of health care and related services by Amity Foundation or other health care providers. This includes consultation with other health care providers relating to a student and referring students to other health care providers.);
• Payment (i.e., obtaining premiums, determining eligibility or coverage, coordination of benefits, adjudication or subrogation of health benefit claims, risk adjusting amounts, billing, claims management, collection activities, obtaining payment under a contract for reinsurance, related health care data processing, medical necessity or coverage review, utilization review (regardless of when it is performed), and disclosure of information to consumer reporting agencies; and,
• Health Care Operations. (i.e., conducting quality assessment and improvement  activities, including outcomes evaluation and development of clinical guidelines; population-based activities relating to protocol development, case management and care coordination, contacting of health care providers and student s with information about treatment alternatives, and related functions that do not include treatment of student s; reviewing the competence or qualifications of health care professionals or evaluating practitioner and provider performance; conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health  care providers,  or training  of non-healthcare professionals; certification, licensing, or credentialing activities; conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs; business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating Amity Foundation, and resolution of internal grievances.

In the event the requests for PHI if for a faculty member, the request must be sent to the Human Resources Specialist, located at Home Office. Faculty must follow Amity Foundation’s policy on verifying the identity and authority of the requestor. Before disclosing PHI to the third party to assist Amity Foundation, Human Resources will determine whether Amity Foundation has a business associate agreement in place with the third party if one is required by Amity Foundation policy.

The Specialist will comply with the request. No Faculty or other agent shall disclose information without the express permission of the Specialist, who in turn will be authorized by the Administrative Director and the Executive Vice President. Prior to releasing any PHI to public health authorities or regulated persons pursuant to the foregoing policy, Amity Foundation shall verify the identity and authority of the public health authority/regulated person. In addition, for workplace surveillance-related disclosures, the notice process described above shall be followed.

Minimum Necessary Rule. The Amity Foundation is required that when PHI is used or disclosed, only the minimum necessary amount if information should be accessed or revealed; provided, however, that if the disclosure is being made to a public official, then Amity Foundation may rely on the representations of the public official that the type and amount of PHI requested is the minimum necessary type and amount of PHI.

Accounting. Disclosures made pursuant to these policies are subject to a request for an accounting by an Individual. Accordingly, Amity Foundation must document the disclosure and maintain this documentation for six years after the disclosure.

Faculty indicates that he or she has been made aware of and understands Amity’s Health Insurance Portability and Accountability Act (HIPAA) Agreement and the consequences for breach of agreement and that Faculty agrees to all the terms and conditions it contains.

UPDATING YOUR INFORMATION

If you would like to update your contact information, you may do so by contacting us at 520.749.7178 or by email at communications@amityfdn.org.

OPT-OUT

You may choose not to receive mail or email communications from us by emailing us at communications@amityfdn.org.

CONTACT INFORMATION

If you have questions, concerns or comments about our privacy policies or practices, we would like to know what they are so we can address them. Please contact us at 520.749.7178 or email us at communications@amityfdn.org.