Delaware Health and Social Services Division of Developmental Disabilities Services Dover, Delaware Signed Copy in Office of PARC Chair Title: HIPAA Privacy Complaints Approved By: ___________________ Division Director Written by: HIPAA Privacy Committee Date of Origin: April 14, 2003____ Reviewed by: DDDS Policy & Records Committee Revision Date: May 09, 2006____ I. PURPOSE The Health Insurance Portability and Accountability Act (HIPAA) Privacy Regulation 164.530(a) requires that health care providers establish a process for individuals to file a complaint concerning the use and disclosure of protected health information. This policy shall establish a process to meet this regulation. II. POLICY The Division of Developmental Disabilities Services (DDDS) shall provide a system designed to address privacy violation complaints filed by or on behalf of individuals receiving services. III. APPLICATION All DDDS Staff Individuals (and their family/guardian) receiving services from a DDDS operate program. DDDS Business Associates IV. DEFINITIONS A. HIPAA Privacy Committee - Individuals appointed by the Division Director to address HIPAA related issues and provide support/guidance to the Privacy/Complaints Officer. B. Privacy/Complaints Officer - In accordance with CFR Section 164.530 (a)(1)(i) and (ii), this designated individual shall be responsible for the development and implementation of the policies and procedures required of the HIPAA Privacy Regulations for its entity (DDDS), receive complaints related to alleged violations of HIPAA Privacy Regulations and provide information about matters covered by the Notice of Health Information Practices . The HIPAA Privacy Committee shall advise and support the Privacy/Complaints Officer. C. Protected Health Information - Individually identifiable information including demographic information relating to the past, present or future physical or mental health or condition, provision of health care or the past, present or future payment for health care as it relates to a person receiving services from a DDDS operated program. Approved Pending D.A.G.'s Review V. STANDARDS A. The name, or title, and telephone number of the contact person or office designated to receive privacy violation complaints concerning DDDS’ policies and procedures required by the HIPAA, or its compliance with such policies and procedures shall be conspicuously posted in all work areas. Such shall be accomplished via the posting of the HIPAA Complaint Form. B. The Privacy /Complaints Officer shall maintain documentation of all complaints received, investigations and their disposition, for a period of six (6) years. A recording of complaints received and their respective disposition shall be maintained in a standard format. C. DDDS staff receiving a complaint regarding a violation of HIPAA privacy regulations shall inform the complainant how to file a complaint with the Privacy/Complaints Officer. D. Persons filing a HIPAA Privacy complaint shall not be penalized or face retaliation. E. Complaints shall be investigated within 30 calendar days of receipt. F. A written outcome of the complaint review shall be sent to the complainant within 45 days of receipt. VI. PROCEDURES Responsibility Action Individual or person acting on his/her behalf 1. Submits HIPAA Privacy Complaint Form to DDDS Privacy/Complaints Officer to report alleged violation(s) of HIPAA Privacy regulations or specifications, in accordance with the Codified Federal Register. Privacy/Complaints Officer 2. Ensures that complaint is thoroughly investigated within 30 calendar days of its receipt. 3. Notifies Division Director of all violations of HIPAA Privacy Regulations. 4. Notifies the applicable supervisors responsible for accused employee and requests a corrective plan of action. 5. Reviews complaint and recommended follow-up with the HIPAA Privacy Committee. 6. Submits a written outcome response of the investigation to the complainant within 45 days of receipt of the complaint. 7. Maintains accountability of complaints received and their resolution. 8. Submits summation of each complaint reveived and the respective outcome(s) to the chair of the HIPAA Privacy committee twice per year. The summation shall be received by the 15th day following the end of each reporting period (Jan. 1- June 30 and July 1-Dec. 31). VII. SYNOPSIS This policy describes the process for filing a complaint with the designated DDDS Privacy Complaint Officer relative to how protected health information is used and disclosed. VIII. REFERENCES Notice of Health Information Practices HIPAA Privacy Regulations- CFR 164.530 IX. EXHIBITS A. HIPAA Privacy Act Complaint Form EXHIBIT A Division of Developmental Disabilities Services HIPAA Privacy Complaint Form I. Please explain the reason for submitting a HIPAA Privacy Complaint. It is important that you are as specific as possible so that your complaint can be thoroughly reviewed/investigated. ______________________________________________________________________________ ______________________________________________________________________________ ______________________________________________________________________________ ______________________________________________________________________________ ______________________________________________________________________________ ______________________________________________________________________________ ______________________________________________________________________________ II. Please explain your response (what you did, what you said) when you became aware of a violation of a HIPAA Privacy Regulation. _____________________________________________________________________________________ _____________________________________________________________________________________ _____________________________________________________________________________________ _____________________________________________________________________________________ ______________________________________________________________________ III. Please complete information about yourself in case you need to be contacted for further information and so you can be sent documentation re: the outcome of the complaint review. Name: ______________________________________________________________ Title: ______________________________________________________________ Address: _____________________________________________________________ _____________________________________________________________ Phone # and best time to contact you:_____________________________________ IV. Please submit this completed form to the following address: Stockley Center Attention: HIPAA Privacy/Complaints Officer, Mail # 24 26351 Patriots Way Georgetown, DE 19947 (302) 934-8031 PARC Approved: 04/11/05 Form #34/Admin