Privacy Policy

Private Data

• Private data includes all information on persons that has been gathered by this program or from other sources for program purposes as contained in an individual data file, including their presence and status in this program.
• Data is private if it is about individuals and is classified as private by state or federal law. Only the following persons are permitted access to private data:
  
  • The individual who is the subject of the data or a legal representative.
  • Anyone to whom the individual gives signed consent to view the data.
  • Employees of the welfare system whose work assignments reasonably require access to the data. This includes staff persons in this program.
  • Anyone the law says can view the data.
  • Data collected within the welfare system about individuals are considered welfare data. Welfare data is private data on individuals; including medical and/or health data. Agencies in the welfare system include, but are not limited to: Department of Human Services; local social services agencies, including a person’s case manager; county welfare agencies; human services boards; the Office of Ombudsman for Mental Health and Developmental Disabilities; and persons and entities under contract with any of the above agencies; this includes this program and other licensed caregivers jointly providing services to the same person.
  • Once informed consent has been obtained from the person or the legal representative there is no prohibition against sharing welfare data with other persons or entities within the welfare system for the purposes of planning, developing, coordinating and implementing needed services
• Data created prior to the death of a person retains the same legal classification (public, private, confidential) after the person’s death that it had before the death.

Providing Notice

At the time of service initiation, the person and his/her legal representative, if any, will be notified of this program’s data privacy policy. Staff will document that this information was provided to the individual and/or their legal representative in the individual record.

Obtaining Informed Consent or Authorization for Release of Information

• At the time informed consent is being obtained staff must tell the person or the legal representative individual the following:
  
  • why the data is being collected;
  • how CHHC intends to use the information;
  • whether the individual may refuse or is legally required to furnish the information;
  • what known consequences may result from either providing or refusing to disclose the information; and with whom CHHC is authorized by law to share the data. What the individual can do if they believe the information is incorrect or incomplete;
  • how the individual can see and get copies of the data collected about them; and any other rights that the individual may have regarding the specific type of information collected.
• A proper informed consent or authorization for release of information form must include these factors (unless otherwise prescribed by the HIPAA Standards of Privacy of Individually Identifiable Health Information 45 C.F.R. section 164):
  
  • be written in plain language;
  • be dated;
  • designate the particular agencies or person(s) who will get the information;
  • specify the information which will be released;
  • indicate the specific agencies or person who will release the information;
  • specify the purposes for which the information will be used immediately and in the future;
  • contain a reasonable expiration date of no more than one year; and
  • specify the consequences for the person by signing the consent form, including:
  • “Consequences: I know that state and federal privacy laws protect my records. I know:
    
    • Why I am being asked to release this information.
    • I do not have to consent to the release of this information. But not doing so may affect this program’s ability to provide needed services to me.
    • If I do not consent, the information will not be released unless the law otherwise allows it.
    • I may stop this consent with a written notice at any time, but this written notice will not affect information this program has already released.
    • The person(s) or agency(ies) who get my information may be able to pass it on to others.
    • If my information is passed on to others by this program, it may no longer be protected by this authorization.
    • This consent will end one year from the date I sign it, unless the law allows for a longer period.”
  • Maintain all informed consent documents in the consumer’s individual record.

Staff Access to Private Data

• This policy applies to all program staff, volunteers, and persons or agencies under contract with this program (paid or unpaid).
• Staff persons do not automatically have access to private data about the persons served by this program or about other staff or CHHC personnel. Staff persons must have a specific work function need for the information. Private data about persons are available only to those program employees whose work assignments reasonably require access to the data; or who are authorized by law to have access to the data.
• Any written or verbal exchanges about a person’s private information by staff with other staff or any other persons will be done in such a way as to preserve confidentiality, protect data privacy, and respect the dignity of the person whose private data is being shared.
• As a general rule, doubts about the correctness of sharing information should be referred to the supervisor.

Individual Access to Private Data

Individuals or their legal representatives have a right to access and review the individual record.

• A staff person will be present during the review and will make an entry in the person’s progress notes as to the person who accessed the record, date and time of review, and list any copies made from the record.
• An individual may challenge the accuracy or completeness of information contained in the record. Staff will refer the individual to the grievance policy for lodging a complaint.
• Individuals may request copies of pages in their record.
• No individual, legal representative, staff person, or anyone else may permanently remove or destroy any portion of the person’s record.

Case Manager Access to Private Data

A person’s case manager and the foster care licensor have access to the records of person’s served by the program under section 245D.095, subd. 4.

Requesting Information from Other Licensed Caregivers or Primary Health Care Providers

• Complete the attached release of information authorization form. Carefully list all the consults, reports or assessments needed, giving specific dates whenever possible. Also, identify the purpose for the request.
• Clearly identify the recipient of information. If information is to be sent to the program’s health care consultant or other staff at the program, include Attention: (name of person to receive the information), and the name and address of the program.
• Assure informed consent to share the requested private data with the person or entity has been obtained from the person or the legal representative.
• Keep the document in the person’s record.

Legal Authority: MS § 245D.11, subd. 3