WIXLIB

a. A description of the PHI to be used or disclosed, thatidentifies the purpose of the information in a specificand meaningful fashion;b. The name or other specific information about theperson(s), classification of persons, or entity (i.e., DHS orspecified DHS program) authorized to make therequested use or disclosure;c. The name or other specific identification of the person(s),classification of persons, or entity to whom DHS maymake the requested use or disclosure;d. A description of each purpose of the use or disclosure.The statement “at the request of the individual” is asufficient description of the purpose when an individualinitiates the authorization and does not, or elects not to,provide a statement of the purpose;e. An expiration date or an expiration event that relates tothe individual or to the purpose of the use or disclosure;f. Signature of the client/patient, or of the client/patient’spersonal/legal representative (when applicable), and thedate of signature; andg. If the client/patient’s personal/legal representative signsthe authorization form instead of the client/patient, adescription or explanation of the representative’sauthority to act for the individual, including a copy of thelegal court document (if any) appointing thepersonal/legal representative, must also be provided.2. In addition to the core elements the authorization shallinclude statements that:a. The client/patient has the right to revoke theauthorization in writing at any time, how to revoke theauthorization, and any exceptions to the client/patient’sright to revoke the authorization;b. Treatment, payment, enrollment or eligibility for benefitsor services cannot be conditioned on obtaining theclient/patient’s authorization (with the exceptions asoutlined in section X. of these procedures); andc. The potential for the PHI to be re-disclosed by therecipient and thus, no longer protected under DHSpolicies and the HIPAA Privacy Rule.3. The authorization must be written in plain language and acopy of the signed authorization shall be given to theclient/patient.10

4. DHS must document and retain each signed AuthorizationForm for a minimum of six years.5. An authorization form that is signed by the individual’spersonal representative must state the personalrepresentative’s name and the relationship that gives thepersonal representative authority to act on the individual’sbehalf, in addition to the other information required.6. Upon request, DHS must give the individual (or the personalrepresentative) a copy of the signed authorization form.7. A copy of the signed authorization form must be retained byDHS.II.Defective AuthorizationsAn authorization is not valid if it has any of the following defects:A.B.C.D.E.F.III.It is not signed or dated;The expiration date or event on the form has passed;It is not filled out completely;It has been revoked;It violates requirements regarding compound authorizations; orIt contains any material information known to be false.Compound AuthorizationsAn authorization for use or disclosure of PHI may not be combined withany other document to create a compound authorization except asfollows:A. An authorization for use and disclosures of PHI created for researchthat includes treatment;B. An authorization for a use or disclosure of psychotherapy notes mayonly be combined with another authorization for a use or disclosureof psychotherapy notes; andC. An authorization, other than for psychotherapy notes, may becombined with another authorization except when a covered entityhas conditioned the provision of treatment, payment, enrollment in11

the health plan, or eligibility for benefits on the provision of one ofthe authorizations.IV.Psychotherapy NotesAn authorization is required for use and disclosure of psychotherapynotes except DHS may use psychotherapy notes without obtaining anindividual’s authorization to carry out its own treatment, payment, oroperations as follows:A. Use by the originator of the psychotherapy notes for treatment;B. Use or disclosure by DHS’ own training programs in which students,trainees, or practitioners in mental health learn under supervision topractice or improve their skills in group, joint, family, or individualcounseling; andC. Use or disclosure by DHS to defend a legal action or otherproceedings brought by the individual.V.MarketingMarketing means to make a communication about a product or servicethat encourages recipients of the communication to purchase or use theproduct or service. Marketing does not include a communication made:A. To provide refill reminders or otherwise communicate about adrug or biologic that is currently being prescribed for theindividual, but only if any financial remuneration received by thecovered entity in exchange for making the communication is notreasonably related to the covered entity’s cost of making thecommunication.B. For treatment of an individual by a health care provider, includingcase management or care coordination for the individual, or todirect or recommend alternative treatments, therapies, health careproviders, or settings of care to the individual; except where thecovered entity receives financial remuneration in exchange formaking such communication.12

Written authorization from the individual is required for acommunication that meets the definition of marketing except in thefollowing cases: A face-to-face communication made by DHS to individual; or A promotional gift of nominal value provided by DHS.If the marketing involves financial remuneration to DHS from a thirdparty, the individual’s authorization must so state.VI.Sale of PHIDHS must obtain an authorization for any disclosure of PHI which is asale of PHI. Such authorization must state that the disclosure will resultin remuneration to DHS. Sale of PHI means: A disclosure of PHI by a covered entity or business associate, ifapplicable, where the covered entity or business associate directlyor indirectly receives remuneration from or on behalf of therecipient of the PHI in exchange for the PHI.Sale of PHI does not include a disclosure of PHI:1. For public health purposes;2. For research purposes where the only remuneration received bythe covered entity or business associate is a reasonable costbased fee to cover the cost to prepare and transmit the PHI forsuch purposes;3. For treatment and payment purposes;4. For the sale, transfer, merger, or consolidation of all or part ofthe covered entity and for related due diligence as described inparagraph (6)(iv) of the definition of health care operations;5. To or by a business associate for activities that the businessassociate undertakes on behalf of a covered entity, or on behalfof a business associate in the case of a subcontractor, and theonly remuneration provided is by the covered entity to thebusiness associate, or by the business associate to thesubcontractor, if applicable, for the performance of suchactivities;6. To an individual, when requested under § 164.524 or §164.528;7. Required by law as permitted under § 164.512(a); and13

8. For any other purpose permitted by and in accordance with theapplicable requirements of the Privacy Rule, where the onlyremuneration received by the covered entity or businessassociate is a reasonable, cost-based fee to cover the cost toprepare and transmit the PHI for such purpose or a feeotherwise expressly permitted by other law.VII.FundraisingAn authorization is required for fundraising purposes unless thefollowing requirements are met. Without an authorization, DHS may use,or disclose PHI to a business associate or to an institutionally relatedfoundation for the purpose of raising funds for its own benefit. The PHIthat may be used or disclosed is limited to: Demographic information relating to an individual, includingname, address, other contact information, age, gender, and date ofbirth; Dates of health care provided to an individual; Department of service information; Treating physician; Outcome information; and Health insurance status.DHS may not use or disclose PHI for fundraising purposes unless theDHS Notice of Privacy Practices informs members that they may becontacted in such a manner.With each fundraising communication made to an individual, DHS mustprovide the individual with a clear and conspicuous opportunity to electnot to receive any further fundraising communications. The method foran individual to elect not to receive further fundraising communicationsmay not cause the individual to incur an undue burden or more than anominal cost.DHS may not condition treatment or payment on the individual’s choicewith respect to the receipt of fundraising communications.DHS may not make fundraising communications to an individual underthis paragraph where the individual has elected not to receive suchcommunications.14

DHS may provide an individual who has elected not to receive furtherfundraising communications with a method to opt back in to receivesuch communications.VIII. Authorization Is Not RequiredAn authorization is NOT required for uses and disclosures for thefollowing purposes:A. Treatment, including the provision, coordination, or management ofhealth care and related services by one or more health care providers,including the coordination or management of health care by a healthcare provider with a third party; consultation between health careproviders relating to a patient; or the referral of a patient for healthcare from one health care provider to another.B. Payment, including activities undertaken to obtain or providereimbursement for the provision of health care.C. Health care operations, including quality assessments; certain healthimprovement and cost-reduction activities; case management, carecoordination, communication of alternative treatments and relatedfunctions; certain credentialing and training activities; underwritingor premium rating for contract renewals; performance orarrangement of audits and legal services; various business planningand management activities; creation and provision of aggregate datafor analysis; resolution of internal grievances, and certain corporatetransactions, including the sale, transfer, merger or consolidation ofall or part of a covered entity, to another covered entity, includingdue diligence.D. Disclosures to another covered entity or to any health care providerfor the payment activities of the entity that receives the information;E. Disclosures to another covered entity, if both DHS and the otherentity has/had a relationship with the individual, the PHI pertains tosuch relationship, and the disclosure is for the certain specifiedhealth care operations of the other entity health care or for healthcare fraud and abuse detection or compliance.15

A. Disclosures for any health care operations activities pursuant to anorganized health care arrangement;B. Disclosures to the individual who is the subject of the information;C. Disclosures to the personal representative of the subject individual;D. Uses and disclosures of PHI permitted under the Rule that require anopportunity for the individual to agree or object, such as facilitydirectories; and notifying family or friends and for involving family orfriends in the individual’s care;E. Disclosures of PHI in a limited data set for purposes of research,public health, or health care operations;F. Required disclosures to the Secretary of Health and Human Servicesfor enforcement of the HIPAA Privacy Rule;G. Uses and disclosures: Required by law; For public health activities (for prevention or control of diseaseand for vital statistics; and to the Food and Drug Administration); About victims of abuse, neglect or domestic violence; For health oversight activities (licensure, audit, inspections); For judicial and administrative proceedings (subpoena, discoveryrequests, or legal process); For law enforcement purposes; To coroners, medical examiners, and funeral directors regardingdecedents; For cadaveric organ, eye or tissue donation purposes; For research purposes; To avert a serious threat to health or safety; For specialized government functions (military and veterans’activities, national security, intelligence activities); and For workers’ compensation.IX.Incidental Uses or Disclosures of PHI16

DHS may make the minimum necessary uses or disclosures of PHI thatare incidental to an otherwise permitted or required use or disclosure ofthe PHI, as long as DHS has complied with all minimum necessarylimitations applicable to the otherwise permitted or required use ordisclosure; implemented appropriate administrative, physical, andtechnical safeguards to preserve the privacy of PHI from any intentionalor unintentional improper use or disclosure; and implementedappropriate administrative, physical, and technical safeguards to limitincidental use or disclosure to reasonable levels.X.Prohibition on Conditioning of AuthorizationsDHS may not condition treatment, payment, enrollment in a health plan,or benefits eligibility on an individual providing it with an authorizationexcept:A. A health plan may condition an individual’s enrollment or eligibilityfor benefits on the individual providing an authorization toenrollment in the plan, in certain conditions.B. DHS may condition the provision of research-related treatment onprovision of an authorization for the use or disclosure of PHI forsuch research.C. DHS may condition the provision of health care that is solely for thepurpose of creating PHI for disclosure to a third party on provision ofan authorization for the disclosure of PHI to such third party.XI.Revocation Of An AuthorizationAn individual may revoke an Authorization at any time by providingwritten notice to the Privacy Officer or his/her designee. Theindividual’s Authorization is no longer valid once DHS knows of therevocation, except to the extent that DHS has already taken action inreliance of the Authorization or to the extent the Authorization wasobtained as a condition of obtaining insurance and other law providesthe insurer the right to contest the policy or claim under the policy.XII.Documentation17

DHS must retain any signed authorization or revocation. Thedocumentation must be retained for at least six years from the date itwas created or from the date it was last in effect, whichever is later.XIII. Citations §164.506(a) - Discusses the standards for consents and how consentsdiffer from authorizations§164.508(a) – Standard for requirements and exceptions forauthorizations§164.508(b) – Implementation specifications for authorizations§164.508(c) – Core elements and requirements§164.508(d) – Specifications for an entity’s own uses and disclosure§164.508(e) – Specifications for an entity’s disclosure to others§164.508(f) – Specifications for research and treatment§164.520 – Requirements for plain English language§164.512 – Defines the uses and disclosures for which consent, anauthorization, or opportunity to agree or object is not required18

BREACHES OF UNSECURED PROTECTED HEALTH INFORMATIONPOLICY:The South Dakota Department of Human Services (DHS) establishes consistentguidelines regarding the handling of Breaches of Unsecured protected healthinformation (PHI), including notifications of affected individuals. A Breach ofPHI response process has been implemented to provide Breach of UnsecuredPHI notifications as required. The Privacy Officer is responsible forimplementing and overseeing this policy and procedure. It is the policy of DHSto quickly identify Breaches of Unsecured PHI and to provide any requirednotifications within required timeframes.PROCEDURES:I.Breach of PHI ProceduresA Breach is the use or disclosure of unsecured protected healthinformation (PHI) in a manner not permitted by HIPAA, unless a riskassessment demonstrates a low probability that the PHI wascompromised.Unsecured PHI is PHI that is not rendered unusable, unreadable, orindecipherable to unauthorized persons through the use of a technologyor methodology specified in guidance issued by HHS.A. Upon discovery of a potential Breach, Privacy Officer begins aninvestigation to determine if a breach requiring notification hasoccurred. Such investigations shall address the following: Was there a violation of

6 NOTICE OF PRIVACY PRACTICES POLICY: Individuals have a right to adequate notice of the uses and disclosures of protected health information (PHI) and the legal duties of the South Dakota