Privacy Statement

DEFINITIONS
A. “Confidential Information” includes the following:

Information that is “individually identifiable health information” within the meaning of the federal HIPAA privacy rule, in that it identifies or can be used to identify individual patients.
Information pertaining to the proceedings, reports, records, findings, recommendations, evaluations and opinions of any study group, steering committee or the VPQHC Board of Directors or any project participant in a meeting thereof, unless otherwise designated according to an information release plan.
Information identified as confidential under a project-specific information release policy which has been approved by the VPQHC Board of Directors.

B.            “Disclosure” means the release, transfer, provision of access to, or divulging in any other manner, confidential or non-confidential information.

C.            “Project participants” are the members of a study group or steering committee, for projects that have one, or any organization or individual that contracts with VPQHC to undertake a project.

3.             GENERAL RULES

A.            Confidential information shall not be disclosed unless permitted or required by law or this policy.

B.            Confidential information provided to VPQHC by a health plan, health care clearinghouse or health care provider (a “covered entity” under HIPAA) shall not be used or disclosed except as permitted by any Business Associate Agreement between VPQHC and the covered entity.

C.            Confidential information provided to VPQHC by the Vermont Department of Banking, Insurance, Securities and Health Care Administration (BISHCA) shall not be used or disclosed except as permitted by the BISHCA Confidentiality Code (as revised July 1, 1996).

D.            Confidential information provided to VPQHC as part of a Limited Data Use Agreement or other contract shall not be used or disclosed except as permitted by the terms of the Agreement or applicable contract.

E.            Prohibition against disclosure applies to VPQHC personnel, Board Members, project participants, contractors, consultants and relevant hospital personnel.

F.             Violation of the prohibition on disclosure can result in disciplinary action, including employment termination and/or loss of contract rights.

4.             PERMITTED DISCLOSURES OF CONFIDENTIAL INFORMATION

A.            Disclosures permitted by a project information release plan, unless inconsistent with any applicable Business Associate Agreement, Confidentiality Code or contractual arrangement.

B.            Disclosure to contractors and consultants when necessary for performance of tasks.

C.            Disclosure of peer review information is subject to permissible disclosure as follows:

          i.      Upon request of a practitioner, disclosure of information regarding said practitioner;

          ii.      Upon request of a hospital, disclosure of information to the hospital with notice of same to any affected practitioners; or

          iii.      By law, under 26 V.S.A. §1445, when the Board of Directors of VPQHC determines that such disclosure is necessary to achieve professional accountability.

D.            Any disclosure of peer review information shall be accompanied by a notice that prohibits redisclosure of the information, with two exceptions:

          i.      A practitioner may redisclose peer review information concerning himself; or

          ii.      Such disclosures as are otherwise permitted or required by law (i.e. under the rules of Medical Practice Board and the state right to know law).

5.             OTHER DISCLOSURE OF INFORMATION

A.            VPQHC will disclose norms, criteria, and standards underlying practice guidelines.

B.            VPQHC will disclose contractual arrangements with consultants, contractors, and hospitals.

C.            VPQHC will disclose information regarding applications for and receipt of grants and other funding sources.

D.            VPQHC will disclose its own administrative procedures and proceedings, except peer review activities.

6.             CONFIDENTIALITY SAFEGUARDS

A.            VPQHC will designate employee responsible for maintaining confidentiality.

B.            All contracts with contractors or consultants will contain conditions that they are bound by VPQHC confidentiality policy and any restrictions or conditions on use or disclosure of confidential information applicable to VPQHC pursuant to a Business Associate Agreement, Confidentiality Code, or provision in a Limited Data Use Agreement or other applicable contract.

C.            No VPQHC employee, representative, agent, contractor or consultant shall have access to confidential information until he or she has executed written assent to be legally bound by restrictions or conditions on use or disclosure required by any applicable Business Associate Agreement, Confidentiality Code, or other contract, which may include, among other conditions, affirmative obligations to:

          i.      Timely report unpermitted use or disclosure;

          ii.      Prevent unauthorized use or disclosure;

          iii.      Cooperate with HIPAA compliance investigations;

          iv.      Timely comply with HIPAA-mandated requests for amendment of information or accounting of disclosures; and

          v.      Timely satisfy applicable obligations to return or destroy protected health information.

D.            VPQHC will instruct and train its employees, contractors, Board Members, consultants and relevant hospital personnel of confidentiality requirements.

E.            In order to have access to confidential information, individual must be trained or undergoing training as per (B) and have signed a statement acknowledging responsibility to maintain confidentiality and the penalties for violating the confidentiality requirement.

F.             Employees with access to confidential information shall take all reasonable steps necessary to safeguard confidentiality.

G.            All requests for confidential information by those other than VPQHC employees will be made in writing on a standard Request for Information form.

H.            Patient-practitioner identifiers will be coded, with index of same being securely maintained.