Billing Manual for Community Care Network Providers

Confidential data and information sent by email must be flagged as confidential andbear a confidentiality notice similar to the following at the beginning of the message:“This email contains confidential and privileged information for use only by theintended recipient. Do not read, copy, or disseminate this material unless you arethe intended recipient. If you believe you have received this email in error, pleasenotify the sender by return email, securely delete this file, and any electronic ormagnetic copies, and destroy any paper copies.”Protected health information will not be transmitted via email.Confidential data and information no longer required for legitimate businesspurposes must be destroyed in a secure manner.Paper records must be thoroughly shredded.Magnetic files must be deleted in a manner that does not permit the files to beundeleted; for example, by reformatting a floppy disk using the “secure” formatoption.Optical storage media must either have the files securely deleted or, if this is notpossible, the storage media must be destroyed.If the receiver does not have the necessary means to destroy this information, theymust return the information back to Community Care in order for it to be destroyed.The transfer of confidential information other than to Community Care’s agents,contractors, employees, staff, and volunteers in their official capacities asrepresentatives of Community Care is considered an external transfer and must bemade in accordance with Community Care’s procedure on Disclosure of Information.Oversight of Confidentiality PracticesCommunity Care’s privacy officer is responsible for:Approving and annually reviewing all policies and procedures related toconfidentiality.Identifying, developing, and implementing mechanisms to oversee theimplementation and application of Community Care’s confidentiality policies andprocedures.At least annually, the privacy officer, in collaboration with the FWA Department, willevaluate ways to:Reduce the collection of member identifiable data and information.Aggregate or de-identify (the process of separating medical information frompersonal identification such as, removing a name or social security number in orderto prevent the identification of a specific member) such data and information asclose to the collection point as possible by surveying Community Carerepresentatives, conducting focus groups with Community Care representatives, andreviewing complaints.Community Care has identified circumstances necessitating special protection ofmember identifiable data and information as described in the procedure on Handling ofCommunity Care Provider Manual | 1-888-251-CCBH | © 2012 All Rights Reserved | Page 134