No.  819-AR
SCHOOL DISTRICT OF SPRINGFIELD TOWNSHIP
ADMINISTRATIVE RULE
Policy 819-AR.

1.         General.

            1.1       Source.  These administrative regulations (“Administrative Regulations”) have been adopted pursuant to Policy No. 819 of the School District of Springfield Township  (“District”).  The purpose of these Regulations is to implement the Standards for Privacy of Individually Identifiable Health Information, which are set forth in regulations adopted by the U.S. Department of Health and Human Services at 45 C.F.R. Parts 160 and 164 (the “HHS Regulations”).  The Regulations were adopted to implement certain provisions set forth in the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §1320d et seq. (the “Act”).

            1.2       Purpose.  Certain actions of the District with regard to employees and students may currently or subsequently fall within the scope of being a Health Care Provider for purposes of the HHS Regulations.  In such instances the District is required to afford certain protections to certain information and documents created in connection with those actions.  To the extent such actions are within the scope of being a Health Care Provider, it is the intent of the District to comply with the Act and the HHS Regulations and the Act (the HHS Regulations and the Act shall be referred to as “HIPAA”).

            1.3       Application.  These Administrative Regulations shall apply to Protected Health Information, as defined below.

            1.4       Protected Health Information.

1.4.1   Definition. Protected Health Information is information that: (a) is created or received by the District; (b) relates to the past, present or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present or future payment for the provision of healthcare to an individual; (c) specifically identifies the individual if there is a reasonable basis to believe that the information can be used to identify the individual; and (d) is transmitted by electronic media, maintained in an electronic media (which includes the internet, extranet, leased lines, dial-up lines, private networks), including transmissions that are physically moved from one location to another using magnetic tape, disc or compact disc media; or transmitted or maintained in any other form or medium.
1.4.2   FERPA Exclusion.  Protected Health Information does not include any education records covered by the Family Educational Right and Privacy Act, currently and as it may be amended, 20 U.S.C. 1232g (“FERPA”).  Personnel implementing these Administrative Regulations should consult the District’s FERPA policy to determine whether information or a document falls within the scope of FERPA.

1.4.3   Employee Record Exclusion.  Protected Health Information does not include employment records held by the District as an Employer.

            1.6       Mitigation.  The District shall mitigate, to the extent practicable, any harmful effect that is known to the District, caused by the use or disclosure of Protected Health Information by the District or any Business Association of the District in violation of these Administrative Regulations or HIPAA.

            1.7       No Waiver.  The District  shall not require individuals to waive their right to file a complaint with the Secretary of Health and Human Services as provided in the HHS Regulations or any other rights they may have under the HHS regulations as a condition for the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits.

            1.8       HIPAA Definitions. Capitalized terms within these Administrative Regulations shall have the meaning as set forth in the Act and the HHS Regulations.

2.         Designation of Privacy Official and Contact Office.

2.1       Privacy Official.  The District has designated the Board Secretary as the privacy official who is responsible for the development and implementation of the HIPAA document policies and procedures for the District.  Any change in the privacy official shall be documented.

2.2       Contact Office.  The District has designated the Board Secretary as the official responsible for receiving complaints and for providing further information about matters covered by the privacy notice provided by the District. Any change in the contact office or person shall be documented.

3.         Documentation Requirements and Retention. 

3.1       Policies and Procedures.  The District shall maintain its policies and procedures implemented under HIPAA in written or electronic form. 

3.2       Documentation.  If a communication is required by HIPAA or these Administrative Regulations to be in writing, the District shall maintain such writing, or an electronic copy, as documentation in accordance with these retention requirements.  If an action, activity, or designation is required by HIPAA or these Administrative Regulations to be documented, the District shall maintain a written or electronic record of such action, activity, or designation in accordance with these retention requirements.

3.3       Retention Period.  The District shall retain the documentation required by the foregoing sections for a period of six (6) years from the date of its creation or the date when it last was in effect, whichever is later.

4.         Training

4.1       Scope.  The District shall train all employees or independent contractors providing services on behalf of the District who have or may have access to Protected Health Information on the policies and procedures set forth in these Administrative Regulations, as necessary and appropriate for the members of the workforce to carry out their functions for the District.  A copy of these Administrative Regulations shall be provided to each individual.

4.2       Timing.  The District shall provide training as follows:

4.2.1   Initial Implementation.  To each individual subject to Section 4.1 on initial implementation of these Administrative Regulations, no later than April 14, 2003.

4.2.2   Additional Individuals.  To each newly hired or engaged individual who is subject to Section 4.1, within a reasonable period of time after such individual joins the District.

4.2.3   Changes in Administrative Regulations/HIPAA.  In the event there is a material change to these Administrative Regulations or HIPAA, to such individuals subject to Section 4.1, within a reasonable period of time after the material change becomes effective.

4.3       Documentation.  The District shall document that the training described above has been provided.

5.         Safeguards

5.1       Purpose.  The District shall adopt and review as appropriate, administrative, technical, and physical safeguards to reasonably safeguard Protected Health Information: (a) from any intentional or unintentional use or disclosure that is in violation of these Administrative Regulations or HIPAA; and (b) to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.

5.2       Protective Safeguards.   The District has adopted the following appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.

6.         Procedures.

6.1       General.  The District  shall implement policies and procedures with respect to Protected Health Information that are designed to comply with HIPAA, District regulations and applicable law.  The District hereby adopts the provisions set forth in the HHS Regulations with respect to Protected Health Information.   

6.2       Modifications.  The District shall change its policies and procedures as necessary and appropriate to comply with changes in the law, including the standards, requirements, and implementation specifications of the HHS Regulations. Whenever there is a change in any law or regulation that necessitates a change to the District’s policies or procedures, the District shall promptly document and implement the revised policy or procedure. If the change in law materially affects the content of the notice, the District shall promptly make the appropriate revisions to the notice.

6.3       Notice.  If the District changes a privacy practice that is stated in its privacy notice and makes corresponding changes to its policies and procedures, it may make the changes effective for Protected Health Information that it created or received prior to the effective date of the notice revision, if the District has included in the notice a statement reserving its right to make such a change in its privacy practices. 

7.         Complaints

7.1       Process.  The District shall allow any individual to make a written or verbal complaint concerning District’s Administrative Regulations or its compliance with the Administrative Regulations or HIPAA.  The complaints shall be made or referred to the Contact Office.  Verbal complaints shall be documented by the Contact Office.  The Contact Office shall review the complaint, implement any appropriate action and notify the individual in writing of its response to the complaint, including if any action has been taken.

7.2       Documentation.  The Contact Office shall document all complaints, responses and any action taken as a result of such complaint in accordance with these Administrative Regulations. 

8.         Accounting Rights.

8.1       General.  An individual has a right to receive an accounting of disclosures of Protected Health Information made by the District in the six (6) years prior to the date on which the accounting is requested except for disclosures identified below.  The accounting may be required to be requested in writing by such individual.  The District shall document all requests for any accounting.

8.2       Exclusions.  The following disclosures are not subject to an accounting:  (a)  To carry out treatment, payment and health care operations;  (b)  To individuals of Protected Health Information about themselves;  (c)  Incident to a use or disclosure otherwise permitted or required by HIPAA;  (d)  Pursuant to an authorization under HIPAA regulations;  (e)  For a directory to persons involved in the individual’s care or other notification purposes;  (f) For national security or intelligence purposes, as defined in the HHS Regulations; or  (g)  To correctional institutions or law enforcement officials in accordance with HHS Regulations. 

            8.3       Suspension of Audit Rights.  The District shall temporarily suspend an individual’s right to receive an accounting of disclosures to a health oversight agency or law enforcement official, for the time specified by such agency or official, if such agency or official provides the District with a written statement that such an accounting to the individual would be reasonably likely to impede the agency’s activities and specifying the time for which such a suspension is required.  If the request is made orally, the District must:  (a) document the statement, including the identity of the agency or official making the statement;  (b) temporarily suspend the individual’s right to an accounting of disclosures subject to the statement; and (c) limit the temporary suspension to no longer than thirty (30) days from the date of the oral statement unless and until a written statement is submitted during such time period.

            8.4       Accounting Content.  The District shall provide the individual with a written accounting as follows:

8.4.1   Time Period.  Except to the extent excluded as provided in these Regulations, the accounting must include disclosures of protected health information that occurred during the six (6) years (or such shorter time period as requested) prior to the date of the request for the accounting, including disclosures to or by business associates of the District.

8.4.2   Content.  With respect to each disclosure, the following information shall be provided: (a) the date of the disclosure; (b) the name of the entity or person who received the Protected Health Information and, if known, the address of such entity or person; (c)  a brief description of the information disclosed; and (d) a brief statement of the purpose of the disclosure that reasonably informs the requesting individual of the basis for the disclosure or, in lieu of such statement, a copy of a written request for a disclosure. 

8.5       Response Deadline.  The District  shall respond to the request for an accounting no later than sixty (60) days after receipt of such a request. The District  shall either provide the accounting or, if unable to provide the accounting within the sixty (60) day period, a thirty (30) day extension may be implemented, provided that within the initial sixty (60) day period the District  provides the requesting individual with a written statement of the reasons for the delay and the date by which the information will be provided.

8.6       Costs.  The first accounting request must be provided free of charge to the requesting individual in any twelve (12) month period.  The District may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same individual within the twelve (12) month period.  The District  shall notify the requesting individual in advance of any applicable fee and provide the individual with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee.

8.7       Documentation.  The District shall document and retain all information required to be included in an accounting; the written accounting that is provided to the individual; and the titles of the persons or offices responsible for receiving and processing requests for an accounting by individuals.

9.         Request for Privacy Protection for Protected Health Information.

            9.1       General.  The District shall permit an individual to request that the District restrict:  (a) uses or disclosures of Protected Health Information about the individual to carry out treatment, payment, or health care operations; and (b)  disclosures for involvement in the individual’s care and for notification as provided under HHS Regulations.  Such requests shall be submitted to the Privacy Official.

9.2       District Discretion.  The District shall consider such requests on a case-by-case basis but shall not be obligated to agree to a requested restriction, unless required by HHS Regulations.  If the District accepts such restriction, it shall notify the individual in writing of the acceptance. 

9.3       Restricted Information.  If the District agrees to a requested restriction, the District shall document such agreement and identify the Protected Health Information as restricted in accordance with its agreement.  The District may not use or disclose Protected Health Information in violation of such restriction, except as provided below. 

9.3.1   Emergency Use.  If the individual who requested the restriction is in need of emergency treatment and the restricted Protected Health Information is needed to provide the emergency treatment, the District may use such restricted information or may disclose such restricted information to a health care provider to provide such treatment to the individual.  In such case, the District shall request that such health care provider not further use or disclose the protected information.

9.3.2   HHS Regulations.  An agreed upon restriction shall not prevent uses or disclosures permitted or required under HHS Regulations. 

9.4       Termination of Restriction.  The District may terminate its agreement to a restriction if:  (a)  the individual agrees to or requests the termination in writing; (b)  the individual orally agrees to the termination and the oral agreement is documented; or (c) the District informs the individual that it is terminating its agreement to a restriction, except that such termination is only effective with respect to Protected Health Information created or received after it has so informed the individual.

10.       Requests for Confidential Communications. 

10.1    General.  The District shall permit individuals to request and shall accommodate reasonable requests by individuals to receive communications of Protected Health Information by alternative means or at alternative locations. 

10.2    Procedure.  The District shall require an individual requesting confidential communications to make such request in writing.  The District may condition the provision on a specification of an alternative address or other method of contact.  The District shall not require an explanation from the individual as to the basis for the request as a condition of providing communications on a confidential basis.  The District shall document such request and agreement. 

11.       Access of Individuals to Protected Health Information.

11.1    Right of Access. Except as otherwise provided in Sections (a)(2) or (a)(3) of this section, an individual has a right of access to inspect and obtain a copy of Protected Health Information about the individual in a Designated Record Set, for as long as the Protected Health Information is maintained in the Designated Record Set, except for:

11.2    Exclusions.   An individual shall not have access to:  (a) Psychotherapy notes; (b) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding; and (c) Protected health information maintained by the District which is either (i) subject to the Clinical Laboratory Improvements Amendments of 1988 (42 U.S.C. §263a) to the extent the provision of access to the individual would be prohibited by law; or (ii) exempt from the Clinical Laboratory Improvements Amendments of 1988, pursuant to 42 C.F.R. §493.3(a)(2).

11.3    Denial of Access.

11.3.1 Unreviewable grounds for denial.  The District may deny an individual access without providing the individual an opportunity for review of such denial, in the following circumstances:  (a)  The Protected Health Information falls within an exclusion under Section 11.2; (b)  If the protected health information is subject to the Privacy Act, 5 U.S.C. §552a, and the denial of access under that statute would meet the requirements of that statute;  (c) If the Protected Health Information was obtained from someone other than a Health Care Provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information; or (d) as otherwise permitted under HHS Regulations.

11.3.2 Reviewable grounds for denial.  The District may elect to deny an individual access to Protected Health Information in the following circumstances, provided that the individual is given a right to have such denials reviewed, as set forth below:  (a) A licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person; (b)  The Protected Health Information makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person; or (c) The request for access is made by the individual's personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.

11.3.3 Review of a denial of access.  If access is denied on a ground permitted under Section 11.3.2, the individual has the right to have the denial reviewed by a licensed health care professional who is designated by the District to act as a reviewing official and who did not participate in the original decision to deny access. The District shall provide or deny access in accordance with the determination of the reviewing official under this section.

11.4    Request for Access.   The District shall permit an individual to request access to inspect or to obtain a copy of the Protected Health Information about the individual that is maintained in a Designated Record Set. The requests for access must be in writing and submitted to the Privacy Official.  The District shall inform individuals of this requirement.  The District shall act on a request for access no later than 30 days after receipt of the request as follows:

11.4.1 Grant of request.  If the request is granted, in whole or in part, the District shall inform the individual of the acceptance of the request and provide the access requested, in accordance with these Administrative Regulations. 
 
11.4.2 Denial of request.  If the request is denied, in whole or in part, the District must provide the individual with a written denial as set forth below.

11.4.3 Off-Site Information.  If the request for access is for Protected Health Information that is not maintained or accessible to the District on‑site, the District shall take action no later than sixty (60) days from the receipt of such a request.  Within such applicable time period, the District may extend the time for fulfilling the request by no more than thirty (30) days, provided that the District provides the individual with a written statement of the reasons for the delay and the date by which the District will complete its action on the request; and that the District shall have only one such extension of time for action on a request for access.

11.5    Provision of Access.  If the District elects to provide an individual with access, in whole or in part, to Protected Health Information:

11.5.1 Scope of Access.  The District shall provide the access requested by the individual, including inspection or obtaining a copy, or both, of the Protected Health Information about them in Designated Record Sets. If the same information that is the subject of a request for access is maintained in more than one Designated Record Set or at more than one location, the District shall only produce the Protected Health Information once in response to a request for access.

11.5.2 Form of Access.  The District shall provide the individual with access to the Protected Health Information in the form or format requested by the individual, if it is readily producible in such form or format; or, if not, in a readable hard copy form or such other form or format as agreed to by the District and the individual.

11.5.3 Summary.  The District may elect to provide the individual with a summary of the Protected Health Information requested, in lieu of providing access to the Protected Health Information or may provide an explanation of the Protected Health Information to which access has been provided, if:  (a)  The individual agrees in advance to such a summary or explanation; and (b) The individual agrees in advance to the fees imposed, if any, by the District for such summary or explanation.

            11.6    Time of Access.   The District shall provide the access as requested by the individual in a timely manner, including arranging with the individual for a convenient time and place to inspect or obtain a copy of the Protected Health Information, or mailing the copy of the Protected Health Information at the individual's request. The District may elect to discuss the scope, format, and other aspects of the request for access with the individual as necessary to facilitate the timely provision of access.

            11.7    Fees.  If the individual requests a copy of the Protected Health Information or agrees to a summary or explanation of such information, the District may impose a reasonable, cost‑based fee, provided that the fee includes only the cost of: (a) Copying, including the cost of supplies for and labor of copying the Protected Health Information requested by the individual; (b) Postage, when the individual has requested the copy, or the summary or explanation be mailed; and (c) Preparing an explanation or summary of the protected health information, if agreed to by the individual as required by these Administrative Regulations. 

11.8    Denial of Access. If access is denied, in whole or in part, to Protected Health Information, the District shall:

11.8.1 Other information. The District shall, to the extent possible, give the individual access to any other Protected Health Information requested, after excluding the Protected Health Information to which the District has grounds to deny access.

11.8.2 Notice.  The District shall provide a timely, written denial to the individual and shall contain in plain language: (a) The basis for the denial; (b) If applicable, a statement of the individual's review rights under these Administrative Regulations, including a description of how the individual may exercise such review rights; and (c) A description of how the individual may complain to the District in accordance with these Administrative Regulations or to the Secretary of Health and Human Services pursuant to the HHS Regulations.  The description must include the name or title and telephone number of the contact person or office designated in these Administrative Regulations.

11.8.3 Absence of Requested Records.   If the District does not maintain the Protected Health Information that is the subject of the individual's request for access, and the District knows where the requested information is maintained, the District shall  inform the individual where to direct the request for access.

11.8.4 Review of denial. If the individual has requested a review of a denial under this section, the District shall designate a licensed health care professional, who was not directly involved in the denial to review the decision to deny access. The District shall promptly refer a request for review to such designated reviewing official. The designated reviewing official must determine, within a reasonable period of time, whether or not to deny the access requested based on the standards in this Section. The District shall promptly provide written notice to the individual of the determination of the designated reviewing official and take other action as required by this Section to carry out the designated reviewing official's determination.

12.       Amendment of Protected Health Information.

12.1    Right to Amend.  An individual has the right to have the District amend Protected Health Information or a record about the individual in a Designated Record Set for as long as the Protected Health Information is maintained in the Designated Record Set.

12.2    Denial of Amendment.  The District may deny an individual's request for amendment if it determines that the Protected Health Information or record that is the subject of the request: (a)  Was not created by the District, unless the individual provides a reasonable basis to believe that the originator of Protected Health Information is no longer available to act on the requested amendment; (b) Is not part of the Designated Record Set; (c) Would not be available for inspection under these Administrative Regulations or HHS Regulations; or (d) Is accurate and complete.

12.3    Requests for Amendment.  The District shall permit an individual to request that the District amend the Protected Health Information maintained in the Designated Record Set. The request for amendment must be in writing and provide a reason to support a requested amendment.  The District shall informs individuals in advance of these requirements.

12.4    Response.  The District shall act on the individual's request for an amendment no later than sixty (60) days after receipt of such a request, as follows:  (a) If the District grants the requested amendment, in whole or in part, it shall take the actions set forth below; (b) If the District denies the requested amendment, in whole or in part, it shall provide the individual with a written denial, as set forth below; (c) If the District is unable to act on the amendment within the time required by this Section, the District may extend the time for such action by no more than thirty (30) days, provided that: (i) The District provides the individual with a written statement of the reasons for the delay and the date by which the District will complete its action on the request; and (ii) The District shall have only one such extension of time for action on a request for an amendment.

12.5    Acceptance of the Amendment.  If the District accepts the requested amendment, in whole or in part, it shall:

12.5.1  Making the amendment. The District shall make the appropriate amendment to the Protected Health Information or record that is the subject of the request for amendment by, at a minimum, identifying the records in the Designated Record Set that are affected by the amendment and appending or otherwise providing a link to the location of the amendment.

12.5.2 Informing the individual. The District shall inform the individual in a timely manner that the amendment is accepted and obtain the individual's identification of and agreement to have the District notify the relevant persons with which the amendment needs to be shared in accordance with this Section.

12.5.3 Informing others. The District shall make reasonable efforts to inform and provide the amendment within a reasonable time to: (a) Persons identified by the individual as having received Protected Health Information about the individual and needing the amendment; and (b) Persons, including business associates, that the District knows have the Protected Health Information that is the subject of the amendment and that may have relied, or could foreseeably rely, on such information to the detriment of the individual.

12.6    Denial of the Amendment.  If the District denies the requested amendment, in whole or in part, it shall:

12.6.1 Informing the Individual.  The District shall provide the individual with a timely, written denial in accordance with this section. The denial shall use plain language and contain: (a)  The basis for the denial, in accordance with this section; (b) The individual's right to submit a written statement disagreeing with the denial and how the individual may file such a statement; (c) A statement that, if the individual does not submit a statement of disagreement, the individual may request that the District provide the individual's request for amendment and the denial with any future disclosures of the Protected Health Information that is the subject of the requested amendment; and (d) A description of how the individual may complain to the District pursuant to the complaint procedures in these Administrative Regulations or to the Secretary of Health and Human Services pursuant to the procedures established in the HHS Regulations. The description must include the name or title and telephone number of the contact person or office designated in these Administrative Regulations. 

12.6.2 Statement of disagreement. The District shall permit the individual to submit to the District a written statement disagreeing with the denial of all or part of a requested amendment and the basis of such disagreement. The District may elect to reasonably limit the length of a statement of disagreement.

12.6.3 Rebuttal statement. The District may elect to prepare a written rebuttal to the individual's statement of disagreement. Whenever such a rebuttal is prepared, the District shall provide a copy to the individual who submitted the statement of disagreement.

12.6.4 Recordkeeping. The District shall, as appropriate, identify the record or Protected Health Information in the Designated Record Set that is the subject of the disputed amendment and append or otherwise link the individual's request for an amendment, the District’s denial of the request, the individual's statement of disagreement, if any, and the District’s rebuttal, if any, to the Designated Record Set.

12.6.5 Future disclosures. (a) If a statement of disagreement has been submitted by the individual, the District shall include the material appended in accordance with Section 12.6.4 or at the election of the District, an accurate summary of any such information, with any subsequent disclosure of the Protected Health Information to which the disagreement relates. (b)  If the individual has not submitted a written statement of disagreement, the District shall include the individual's request for amendment and its denial, or an accurate summary of such information, with any subsequent disclosure of the Protected Health Information only if the individual has requested such action in accordance with this Section.

13.       Employee Sanctions.

13.1    Non-Compliance.  The District  shall impose appropriate sanctions against members of its workforce who are required comply with these Administrative Regulations or HIPAA but fail to do so.  The Privacy Officer shall be responsible for
determining whether non-compliance has occurred and if a sanction is required and shall recommend a sanction in accordance with this Section.  The sanction shall be reviewed with the immediate supervisor of the individual and shall be implemented after review.  Sanctions shall be tailored to the nature of the failure and the history of the individual.  If sanctions are imposed, they shall be in accordance with existing employment policies, labor contracts and applicable law.

13.2    Documentation.   If any sanctions are applied, they shall be documented and shall be placed in the employee file of the individual and shall be maintained as a separate record by the Privacy Officer.

14.       Prohibition From Intimidating and Retaliatory Acts.

14.1    Individuals.  Neither the District nor any employee of the District shall intimidate, threaten, coerce, discriminate against, or take other retaliatory action against anyindividual for the exercise by the individual of any right under, or for participation by the individual in any process established by these Administrative Regulations or HIPAA, including the filing of a complaint.

            14.2    Individuals and Others. Neither the District nor any employee of the District shall intimidate, threaten, coerce, discriminate against, or take other retaliatory action against any individual or other person for:  (a) filing of a complaint with the Secretary of Health and Human Services as provided by HIPAA;  (b) testifying, assisting, or participating in an investigation, compliance review, proceeding, or hearing under the processes provided by HIPAA; or  (c) opposing any act or practice made unlawful by HIPAA, provided the individual or person has a good faith belief that the practice opposed is unlawful and the manner of the opposition is reasonable and does not involve a disclosure of protected health information in violation of HIPAA.