In fact an employment law attorney represents workers in cases such as discrimination, wrongful termination, workplace safety and unfair labor practices in general. As stated, in the Equal Employment Opportunity Commission, an employee can not be discriminated based on his race, color, religion, sex or national origin. An EEO lawyer is here to help protect such rights.

One area of expertise of Alan Lescht & Associates is into federal employee issues. Those types of cases can be extremely complex and they do take time. Thus, dealing with a federal employment lawyer can be a necessity, as they have experience in this kind of environment.

If you have suffered any kind of harassment or discrimination, Alan Lescht & Associated is the law firm with the experience and results you need. They got several multi-million-dollar settlements in the past. They will remain attentive and answer any questions you may have during your case.

Contact information:

Alan Lescht & Associates, P.C.
1050 17th Street, NW Suite 220
Washington, DC 20036-5545
tel: (202) 463-6036
fax: (202) 463-6067

Federal and state privacy laws such as HIPAA are designed to protect both paper and electronic health records. Systems must be designed to meet these stringent requirements. Any certified electronic system must be password protected, and all files need to be encrypted.

Unlike with paper health records, a log is created every time someone views an electronic health record. In addition, access to certain parts of health records can be regulated by password and system design.

Just like paper records, EHR must comply with the federal Health Insurance Portability and Accountability Act (HIPAA) as well as other state and federal laws on privacy. Patient privacy security is built into all systems. Unlike paper records, electronic health records can be encoded so that only authorized individuals can view them.

System developers and governmental agencies are working to protect patient security. EHR systems use state-of-the-art computer programs to block hackers and those who might want access to private information without permission. Patients can rest assured their records are secure.

Privacy and Security Principles

Federal and state privacy laws, such as HIPAA, are designed to protect both paper and electronic health records. Systems must be designed to meet these stringent requirements:

• Individuals should know how their personally identifiable health information may be used and who has access to it.
• Individuals should have control over whether and how their personally identifiable health information is shared.
• Systems must protect the integrity, privacy, security and confidentiality of an individual’s information.
• The governance and administration of electronic health information exchanges and networks should be transparent and publicly accountable.

Contact:

Patricia Ruddick, Project Director of West Virginia Health Information Security and Privacy Collaboration (HISPC)

Phone: 304-346-9864, ext. 4211
Toll Free: 800-642-8686, ext. 4211
Fax: 304-342-5527

Source: http://www.ehealthwv.org/

Your Health Information Is Protected By Federal Law

Most of us believe that our medical and other health information is private and should be protected, and we want to know who has this information. The Privacy Rule, a Federal law, gives you rights over your health information and sets rules and limits on who can look at and receive your health information.

Who Must Follow This Law

We call the entities that must follow the Privacy Rule covered entities.

Covered entities include:

• Health Plans, including Health Insurance companies, HMOs, company health plans, and certain government programs that pay for health care, such as Medicare and Medicaid.
• Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.
• Health Care Clearinghouses—entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.

Who Is Not Required to Follow This Law

Many organizations that have health information about you do not have to follow this law.

Examples of organizations that do not have to follow the Privacy Rule include:

• life insurers,
• employers,
• workers compensation carriers,
• many schools and school districts,
• many state agencies like child protective service agencies,
• many law enforcement agencies,
• many municipal offices.

What Information Is Protected

• Information your doctors, nurses, and other health care providers put in your medical record
• Conversations your doctor has about your care or treatment with nurses and others
• Information about you in your health insurer’s computer system
• Billing information about you at your clinic
• Most other health information about you held by those who must follow this law

How Is This Information Protected

• Covered entities must put in place safeguards to protect your health information.
• Covered entities must reasonably limit uses and disclosures to the minimum necessary to accomplish their intended purpose.
• Covered entities must have contracts in place with their contractors and others ensuring that they use and disclose your health information properly and safeguard it appropriately.
• Covered entities must have procedures in place to limit who can view and access your health information as well as implement training programs for employees about how to protect your health information.

Mailing Address and Telephone Number

The U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Telephone: 202-619-0257
Toll Free: 1-877-696-6775

Source: http://www.hhs.gov

The co-regulatory approach offered by the legislation allows for flexibility in how organisations (including health service providers) deal with their privacy obligations, while ensuring standards apply to the protection of personal information, including health information. The legislation recognises the particularly sensitive nature of health information, and places extra protections around its handling, including enforcement mechanisms to deal with breaches of the privacy standards.

In the private health sector, the legislation will complement the existing culture of confidentiality that is fundamental to many health service providers’ professional practice obligations.

The legislation, through its ten National Privacy Principles, promotes greater openness between health service providers and consumers regarding the handling of health information. The legislation introduces, for instance, a general right of access for consumers to their own health records, and requires health service providers to have available documentation that clearly sets out their policies for the management of personal information.

Clear and open communication between the health service provider and health consumer is integral to good privacy. This document recognises that when such communication occurs, then ordinarily, many of the privacy obligations of health service providers will be met. When providers are open about the health information they hold, and how they use and disclose it, surprises are unlikely and with fewer surprises there are likely to be fewer complaints.

The recent research on community attitudes toward privacy, conducted by the Office, shows the importance Australians place on controlling their health information, even when used in relation to their treatment.

The guidelines acknowledge that the health service provider’s principal concern is the health care of the patient. The Privacy Act realises individuals’ wishes to have their privacy protected. Therefore, the guidelines aim to assist health service providers to meet their obligations under the National Privacy Principles while providing treatment and care.

The document aims to assist the private health sector in better understanding the application of the National Privacy Principles to its business and services. The document is supported by Information Sheets on the application of the Privacy Act in a number of other areas. These are available on the Office’s website at www.privacy.gov.au. Health service providers are also advised to refer to information and advice on privacy from their respective professional bodies.

Source and Full Article: http://www.privacy.gov.au/publications/hg_01.html

The Commission d’accès à l’information, which is under the authority of the Québec National Assembly, was created in 1982 further to increasing public concern over the issues involved in protecting privacy and providing access to information. From the start of the 70s, this interest in the so-called “new law” showed up gradually in a number of statutes enacted at that time. As early as 1971, with the passage of the Consumer Protection Act, the legislator broke new ground by ensuring all persons right of access to their credit record. Laws governing professions, such as the Professional Code, enshrined principles such as professional secrecy and the confidential nature of personal information.

In enacting the Charter of human rights and freedoms, the Québec National Assembly recognized the right of all persons to respect for their privacy as well as their right to information and, in so doing, took an historic legislative step that would lay the legal foundations for fundamental principles.

Despite these legislative initiatives, several pressure groups demanded specific measures designed to ensure the operational transparency of public bodies through access to information contained in administrative documents, and to better protect Quebecers from the increasing incursion of public authorities into their private lives.
To meet these expectations, the Québec government set up, in 1980, the Commission d’étude sur l’accès du citoyen à l’information gouvernementale et sur la protection des renseignements personnels (the Paré Commission), which had the following mandate: to propose administrative and juridical means of ensuring the public’s right to administrative documents and to privacy, from the standpoint of the protection of personal information. In May 1981, the Paré Commission tabled a report entitled Information et liberté. On the basis of that report, a bill was tabled before the National Assembly; the Act respecting Access to documents held by public bodies and the Protection of personal information was enacted on June 22, 1982, thereby creating the Commission d’accès à l’information du Québec.

During the next decade, the National Assembly continued its efforts to protect privacy by enacting the Act respecting the protection of personal information in the private sector, which came into force on January 1, 1994.

1. access your personal health information, and
2. have your personal health information kept private

when that information is held by a health care provider, health care facility or public body (referred to in the Act as “trustees“).

Access

The right of access means that you can ask to see, or get a copy of, personal health information about you.  You also have the right to request a correction to this information if you feel it is inaccurate or incomplete.

Access to your health records allows you to make informed decisions, based on complete information, about your health and health care.

Privacy

PHIA also recognizes that personal health information is private and should be held in confidence by those who maintain it. This enables you to discuss things you might find sensitive or embarrassing with trustees without worrying that they will discuss it with others inappropriately.

In order to protect your right to privacy, PHIA imposes obligations on trustees when they collect, maintain, use and share your personal health information.

When trustees collect personal health information from you, they will normally use that information for the reasons it was provided. For example, if you discuss personal health information with a health care provider, he or she will use that information to provide you with the care you are seeking.

Before trustees can use this information for other reasons — or share it with people outside their organization — they should generally get your consent. There are some exceptions to this obligation, however. Here are a few examples:

• A health care provider may share information about you with another provider who is involved in your care, as long as the information is relevant and as long as you haven’t asked the first provider not to.
• A hospital may contact your family and inform them that you are hurt or injured if you can’t inform them yourself.
• A hospital or personal care home may discuss, with family members and close friends, care you are currently receiving in the facility, as long as the facility believes you wouldn’t object.
• A trustee might share personal health information with an outside agency if it is necessary to prevent serious harm to you or someone else.
• A trustee might also have to share personal health information about you if another law requires them to do so.

Source: http://www.gov.mb.ca/health/phia/index.html

The HIA requires that the Information and Privacy Commissioner receive a privacy impact assessment for review and comment before a custodian implements proposed administrative practices and information systems relating to the collection, use or disclosure of individually identifying health information. Privacy impact assessments are mandatory under the HIA if the project fits the foregoing definition.

The Office of the Information and Privacy Commissioner has developed a Privacy Impact Assessment (PIA) process to assist organizations in reviewing the impact that the new project may have on the individual privacy. The process is designed to ensure that the public body or custodian evaluates the program or scheme to ensure compliance with the FOIP Act or HIA.

The PIA process requires a thorough analysis of potential impacts on privacy and a consideration of measures to mitigate or eliminate any such impacts. The privacy impact assessment is a due diligence exercise, in which the organization identifies and addresses potential privacy risks that may occur in the course of its operations.

While PIA’s are focussed on specific projects, the process should also include an examination of organization-wide practices that could have an impact on privacy. Organizational privacy policy and procedures, or the lack of them, can be significant factors in the ability of the organization to ensure that privacy protecting measures are available for specific projects.

Because the onus always remains on the organization to ensure adequate levels of privacy protection, as required in the applicable legislation, the Commissioner will not “approve” a PIA submitted to him by an organization. Once satisfied that the organization has addressed the relevant considerations and is committed to the provision of the necessary level of privacy protection, the Commissioner will “accept” the PIA. Acceptance is not approval; it merely reflects the Commissioner’s acceptance that the organization has made reasonable efforts to protect privacy. A PIA cannot be used to obtain a waiver of, or relaxation from, any requirement of the relevant legislation.

Source and Full Article: http://www.oipc.ab.ca/pia/

Recognizing the importance of privacy, the Federal/Provincial/Territorial Conference of Deputy Ministers of Health tasked its Advisory Committee on Information and Emerging Technologies to develop a Pan-Canadian Health Information Privacy and Confidentiality Framework.

The objective of the Framework is to respond to Canadians’ privacy and confidentiality expectations and to suggest a harmonized set of core provisions for the collection, use and disclosure of personal health information in both the publicly and privately funded sectors. Consistent, or at least more consistent, privacy regimes among jurisdictions would facilitate health care renewal, including the development of electronic health record systems and primary health care reform.

The Framework is a valuable tool to inform and influence any privacy legislative process within jurisdictions affecting personal health information. Since the Personal Information Protection and Electronic Documents Act (PIPEDA) applies in jurisdictions which, unlike Quebec and British Columbia, have not adopted “substantially similar” legislation, the Framework can also serve as a guide to achieving that objective. However, it is also understood that it is only a guide, not a prescription. The actual intent and wording of jurisdictional legislation will ultimately determine whether the legislation can result in an exemption from PIPEDA. Quebec did not participate in the development of the Framework, while Saskatchewan withdrew near the end of the process.

Overview

The Pan-Canadian Health Information Privacy and Confidentiality Framework is the result of extensive analysis and consultation. The analysis included a review of both domestic and international approaches to protecting personal health information privacy. As part of the consultation process, jurisdictions generally consulted their respective government departments, ministries and stakeholder communities. Health Canada consulted national care provider associations while provinces and territories generally conducted parallel activities with the associations’ provincial and territorial counterparts (Consultation Groups – see Appendix B). Feedback was received from federal, provincial and territorial privacy commissioners, experts on genetic information and Canadians by means of a public opinion survey. The results of the consultations demonstrated strong support for the Framework and its objective of harmonizing privacy principles governing personal health information derived from both commercial and other activities. According to the survey, Canadians, for the most part, expressed strong confidence in the provisions of the Framework that were surveyed.

The Framework is comprised of core provisions aimed at protecting the privacy and confidentiality of individuals with respect to their health information, while enabling the flow of information where appropriate to support effective health care, the management of the health system and an interoperable health record. The core provisions are consistent with the requirements of the Canadian Charter of Rights and Freedoms and PIPEDA and reflect the realities of the health system. appendix A to the Framework is a listing of ancillary provisions that are provided for consideration. These ancillary provisions are not essential nor required by PIPEDA.

A principle that underpins the provisions is that the collection, use and disclosure of health information is to be carried out in the most limited manner, on a need-to-know basis and with the highest degree of anonymity possible in the circumstances. The Framework also recognizes that privacy is a consent-based right and, unless otherwise stated in legislation, the individual’s consent must be obtained for any collection, use and disclosure of personal health information. In keeping with current practices within the health care sector, an implied knowledgeable consent model is proposed for the collection, use and disclosure of personal health information within the circle of care.

The Framework applies to recorded and unrecorded personal health information, whether in paper or electronic format. It does not propose a separate or exceptional legislative vehicle to govern genetic information but views genetic information as a component of personal health information.

The Pan-Canadian Health Information Privacy and Confidentiality Framework is a guide rather than a prescription as legislators have the ultimate authority to determine the type of privacy legislation they wish to adopt. However, the Framework is also a valuable tool to achieve more consistent privacy provisions across jurisdictions and across the commercial and non-commercial sectors of health care.

Source and Full Article: http://www.hc-sc.gc.ca/hcs-sss/pubs/ehealth-esante/2005-pancanad-priv/index-eng.php

1. Personal health information is privileged and confidential and should not be released to any person without the consent of the patient or the patient’s agent (someone legally entrusted to handle the patient’s affairs). Confidentiality is owed to all patients, regardless of age. Therefore, pharmacists should use professional judgement in releasing information to the parent of a minor. In the case of older children, the consent of the child should be obtained prior to the release of personal health information.

2. Demographic information (address, date of birth, etc.) is also considered confidential. To ensure that this type of information is not inadvertently disclosed during the process of confirming patient identity, pharmacists should ask patients to provide information for confirmation purposes.

3. Pharmacists should not release any data which reveals any specific identifier or demographic information about patients or provide information about medication dispensed which could compromise the patient’s identity.

4. Pharmacists should take care that patient information is not seen or overheard by other customers, tradespeople, service crews, pharmaceutical representatives, etc., who may be in or about the dispensary.

5. Pharmacist/patient communication should take place in an area where discussion cannot be heard by others. An appropriate area should be established for consultation purposes, which includes at least one of the following:

· a private consulting room,

· a secluded area of the pharmacy, or

· a semi-private area with suitable traffic/noise barriers.

6. If a fax machine is used by a pharmacy to obtain any type of confidential patient information from outside sources, the fax machine should be physically located within the dispensary.

7. Pharmacists should develop a system to ensure patient confidentiality when delivering prescriptions. Only the information necessary for proper delivery should be visible on the package and all items should be packaged to prevent tampering.

8. Pharmacists should refer to the Society’s Policy on the Disposal of Prescription Information when disposing of prescription files, computer records and old vials.

9. A system should be developed to ensure that all dispensary staff respect the patient’s right to confidentiality. All dispensary personnel should be required to sign a confidentiality declaration.

10. Pharmacists should use caution when considering the release of personal health information to the patient’s agent. If unsure whether the person making the request is the patient’s agent, pharmacists should ask for written proof.

11. In the case of a deceased patient, the executor of the estate is entitled to ask for confidential information. A family member should have the legal authority to handle the deceased patient’s affairs before personal health information can be released.

12. Requests from family members (e.g. a spouse requesting duplicate receipts for income tax purposes) should be given cautious consideration. Personal health information should not be released unless the patient consents to the release.

13. If the best interest of the patient calls for the disclosure of personal health information to other pharmacists or attending physicians, and the pharmacist is unable to obtain the patient’s opinion on this disclosure, the pharmacist should use professional judgement in releasing this information. Steps should be taken to ensure that the person requesting the information is a legitimate pharmacist or physician.

14. Pharmacists should use caution when providing confidential information to third party payors. Generally, payors’ rights to personal health information is governed by the agreements they have with the patient and the pharmacy. Pharmacists should refer to these agreements when in doubt. Steps should be taken to ensure that the person requesting the information legitimately represents the third party and only the information necessary for claim submission should be disclosed.

15. Pharmacists are encouraged to cooperate with law enforcement agencies, however, confidential health information should not be released without a search warrant or court order. Pharmacists may testify in court and produce personal health records if they are ordered to do so by the courts. Only information referred to in the search warrant or court order should be disclosed.

Inspectors representing the Nova Scotia Pharmaceutical Society or the federal Department of Drug Surveillance may have access to personal health records by virtue of provincial and federal legislation.

16. Patients have the right to request and receive, from their pharmacy, a copy of their personal health information. Patients also have the right to expect that their health information will be maintained for at least two years.

Source: http://www.napra.ca/docs/0/203/245/594/680.asp