AGING AND DISABILITY SERVICES ADMINISTRATION

April 30, 2003

ADSA: AFH #2003-004
PRIVACY RULE PROVISIONS IN THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) CLARIFICATION

Dear Adult Family Home Provider:

The Privacy Rule provisions in the Federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) became effective April 14, 2003. This letter is to inform you that the new law does not change your responsibility to provide RCS licensors and complaint investigators with all records and information related to the residents’ health, services, and care.

Government regulatory programs that function as health oversight agencies, and need resident Protected Health Information (PHI) to determine a facility’s compliance with program standards, continue to have access to that information, and do not need to obtain an individual’s authorization to use that individual’s health records. Residential Care Services functions as a health oversight agency, and acts under the authority of state and federal law.

Adult family homes, nursing homes and boarding homes do not need to execute a business associate agreement with Residential Care Services (RCS) prior to releasing PHI, as RCS is not a business associate of these entities under the HIPAA Privacy Rule definition of “business associate.”

Sincerely,

Patricia K. Lashway, Director
Residential Care Services