CONFIDENTIALITY AND HIPAA COMPLIANCE AGREEMENT
Cultural Responsiveness Considerations and Anchor to CSS’ Confidentiality Policy.
As part of CSS’ commitment to our JEDI values, consideration of cultural responsiveness is important to the foundation of any policy related to confidentiality. We are not only following the law but we are also concerned with confidentiality because it helps to ensure that clients feel safe and respected when sharing sensitive information. Cultural responsiveness also involves understanding and valuing the cultural context of a client, and making sure that confidentiality practices are respectful of that context. In terms of culture, looking at the difference between privacy and confidentiality is important. Privacy is about access to the person (the body, choices, and certain kinds of information about the client) while confidentiality is an expectation of control or limitation on disclosure of information shared by the client with a privileged person. Privacy can be “invaded,” while confidentiality is “breached.” Acknowledging that different cultures have differing ideas of what privacy means and what is considered appropriate and inappropriate to share is part of being culturally responsive. At CSS, we acknowledge that minorities and other vulnerable populations have historically had their privacy “invaded” and confidentiality breached as part of systemic racism. It also means being transparent about confidentiality and privacy practices as a key component of establishing rapport and trust. It means being able to hear clients out regarding their mistrust that data and client information will not be held in confidence. I agree to hold cultural responsiveness in all areas related to confidentiality.
Agreement
I agree to hold in confidence all information regarding callers/texters and clients including third party callers/texters of Crisis Support Services of Alameda County (“CSS”). I will not violate the confidential relationships between and among CSS, its volunteers, Board of Trustees, staff, and callers and clients. I will maintain privacy regulations under the umbrella of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). I will not remove from the offices of CSS any digital or written client records or any other information without the explicit consent of the Executive Director.
I accept full responsibility for maintaining the confidential and private nature of all client records and information. This applies to all forms of communications including phone conversations, texts, emails, faxing, and social media technology. Social media technology includes, but is not limited to Instagram, Twitter, YouTube, etc. I understand that I will be held responsible for any violation of this agreement.
In regards to record keeping, CSS maintains a HIPAA compliant database (Apricot) which keeps client records indefinitely. Transcripts are held for 30 days before being safely digitally discarded. I agree not to delete any client records and not share database or platform access with anyone outside of CSS.
Protected Health Information
CSS strictly prohibits transmitting protected health information (PHI) via email unless using a secure method. Retrieve all printed PHI immediately from the printer and ensure that any PHI sent via fax, BOX.com, email or snail mail is correctly addressed. All PHI must be properly stored and disposed of. PHI must be handled in accordance with the Health Insurance Portability and Accountability Act (HIPAA).
CSS requires that all employees receive HIPAA training when they join the Agency, and may require that HIPAA and other security related training(s) are completed on a regular basis as a condition of continued employment. Security, privacy and HIPAA protections are important and should be taken seriously by all CSS employees.
Breaches in Confidentiality
Any employee who willfully discloses confidential information either internally or externally, unless legally compelled to do so, is subject to discipline up to and including termination. In addition, CSS may receive fines ranging from $100-$50,000 or more. To read more about HIPAA violations please see this article by the HIPPA Journal HIPAA Fines and Penalties
Mandated Reporting and Ensuring Safety
California law requires that certain information regarding child or elder abuse, potential violence and/or homicidal threats to others be reported to mandated agencies. As a result of our compliance with these requirements, or in response to a court order or search warrant, it is possible that client/volunteer conversations may become a part of some other agency’s records.
If compelled or mandated to provide information about a client, CSS will attempt to keep the last names of volunteers private and not release them with the records. In no case will the last name of a volunteer be released for a judicial purpose without first informing the volunteer of the request.
Section 215 of the Patriot Act precludes counselors from informing clients regarding requests for and the release of records requested by the FBI.
Alameda County Behavioral Health (ACBH)
As a contractor with the county, all CSS staff and volunteers are also held to the standards put forth by ACBH. These standards, though don’t deviate from the practices outlined above, do add additional reporting requirements in cases of a breach to the County QA department. The full text can be found HERE
