Confidentiality Policy

Confidentiality Policy

A child’s early intervention record is considered an educational, not medical, record and is governed by the Federal Family Educational Rights and Privacy Act (FERPA). EIP billing/claiming records must also meet the requirements of the Federal Health Insurance Portability and Accountability Act (HIPAA). Cooper Kids Therapy Associates assures that all employees, independent contractors, consultants, and volunteers with access to personally identifiable information are informed about, and required to adhere to, all confidentiality requirements applicable to personally identifiable information within the Early Intervention and CPSE Program. We also assure knowledge of and compliance with all legal requirements that protect records containing sensitive information (such as sexual or physical abuse, treatment for mental illness or mental health problems, HIV status, communicable disease status, the child’s parentage, etc.). EI/CPSE providers who are licensed, registered, or certified under New York Education Law must maintain their records in accordance with the laws and regulations that apply to their profession.

Ellen Cooper shall be responsible for ensuring the confidentiality of personally identifiable information in records, including electronic records. Only children’s ID# will be used in emails and electronic transmissions and not their names or any identifying information. Computers that contain information about children should be password protected. There is also a firewall in place. Our emails are encrypted. If the parent requests the use of unencrypted email for communication of personally identifiable information, the specific written parental consent for email use must specify the dangers to breach of confidentiality inherent in using email, the parties who will be involved in email communication including their email address, and what information will be shared via email. Only authorized staff within our office has access to our computers. All records must be secured and kept confidential when being transported anywhere. Providers of services for eligible children and their families shall maintain the confidentiality of all personally identifiable data, information, or records pertaining to an eligible child. The provider shall ensure that no information regarding the conditions, services, needs or other individual information regarding a child and/or family is communicated to any parties other than the service coordinator and other service providers currently serving the child and family, without the written consent of the parent. Individuals authorized to routinely access EIP/CPSE records and/or those that have written consent must be informed about, and required to adhere to the confidentiality policies and procedures of the EIP/CPSE and must adhere to all legal requirements that protect EIP records containing sensitive information (such as sexual or physical abuse, HIV status, treatment for mental illness, the child’s parentage, etc.). All records containing personally identifiable information are maintained securely when stored off-site.

When information about a child/family is contained in records that include information about multiple children, only information pertaining to that child/family can be released. Personally identifiable information about others must be protected. Other names are blacked out in a child’s file.

Only individuals who collect or use information for the express purposes of facilitating the child/family’s participation in the EI/CPSE Program should be authorized to routinely access a child’s record. Our office staff is authorized to routinely access a child’s record. Written consent will be obtained before personally identifiable information is disclosed to anyone other than authorized individuals. The written consent for release of or obtaining information must include the name of the entity, which record will be obtained or released; the specific record(s) to be used and the purpose of such use; the date the parent signed the consent, and the parent’s signature and relationship to the child. An access sheet is included in each file for any individual other than authorized individuals, who access a child’s record along with the date and purpose for which the record was accessed. When a general release is used the parent shall be informed of the right to refuse to sign a general release and offered the opportunity to sign a more selective release. Parents will be informed of the names of individuals that request access and the purpose of the access and provide written consent for such access. Only information appropriate to a request should be released. Other information and sensitive information about the child and family will be protected. If consent is given, those individuals must be informed about, and required to adhere to, all confidentiality requirements applicable to personally identifiable information within the EIP. They must comply with all legal requirements that protect records containing sensitive information (such as sexual or physical abuse, treatment for mental illness or mental health problems, HIV status, communicable disease status, the child’s parentage, etc.)

The identity of any child regarding their HIV status cannot be disclosed to anyone without the specific consent to the release of such protected information by the parent or legal guardian. This information will be contained in a binder in Ellen Cooper’s office. She will be the only one with access to it. The office is locked.

A record must be kept of any individual, other than authorized individuals, who access a child’s record, along with the date and purpose for which the record was accessed. Only information appropriate to a request should be released. Extraneous or sensitive information about the child and family should be protected.

It is required that any e-mail containing personally identifiable information have password protection which locks the computer after a period of inactivity, a firewall for the whole system and encryption for the e-mail message or encryption of the server where all communication takes place on the server itself. When canvassing providers for service needs such as specialty, service type, frequency, length, geographic area, etc., e-mail can be sent without encryption provided that no personally identifiable information is included. Child specific identifiable information includes a list of personal characteristics or other information that would make it possible to identify the child, the parent or other family members with reasonable certainty. In addition to obvious identifiers such as name, address, etc., the combination of facts presented in the e-mail (e.g., initials, family composition, unique diagnosis, heritage, neighborhood, ect.) should not be able to identify a particular family or child.

Our agency files are kept in a locked file room in our office which is locked when unattended. The office is only used for administrative purposes and therefore only employee and prospective employees have reason to visit the office. Confidentiality is maintained when files are being retrieved.

Retention of Records Policy

All children’s records will be maintained until the child turns 21 years of age. Providers who are licensed, registered, or certified under state education law must retain records in accordance with the laws and regulations that apply to their profession. Children’s records should be shredded when they are disposed of.

Because the Medicaid status of children is unknown to providers, all Medicaid requirements must be adhered to, including preparing and maintaining contemporaneous records. Records must meet the general and specific requirements of the regulation as to content. It must be possible to determine when the record was created. There must be a process to document alteration of the record and also a process to prevent alteration. The direct provider must be identified in the record.

Our policies and procedures for confidentiality should apply throughout the stages of collection, storage, disclosure and destruction of records, including electronic records.

Access to and Amending Records

Parents are notified in writing that they can request and inspect and review all records pertaining to their child. They are informed that the request should be made to Judi Cobian at the office of Cooper Kids Therapy Associates. If a parent cannot submit a request in writing, a verbal request is accepted. Access to records includes a review of the record by the parent or a representative on behalf of the parent (unless such access is prohibited under State or federal law); an explanation and interpretation of material included in any EI record upon request; and, a copy of any record within 10 working days of the request (if the request is made as part of a mediation or impartial hearing, a copy must be provided within 5 days). The copy will be in a sealed envelope with no identifying information with the word Confidential Information on the outside of the envelope. Each provider, evaluator or service coordinator shall keep a record of parties obtaining access to records gathered, maintained, or used for purposes of the Early Intervention Program (except access by parents and authorized employees of the municipality or approved evaluator, provider or service coordinator) including the name of the party, the date access was given and the purpose for which the party is authorized to use the records. Written consent must be obtained before personally identifiable information is disclosed to anyone other than authorized individuals. If the purpose is for any other reason, (e.g. record review for quality assurance by individuals not directly involved in the child/family’s participation in the EI/CPSE Program), the parent must be informed of the names of the individuals that request access and the purpose for the access, and provide written consent for such access. If consent is given, those individuals must also be informed about, and required to adhere to the confidentiality policies and procedures of the EIP and must adhere to all legal requirements that protect EIP records containing sensitive information (such as sexual or physical abuse, HIV status, treatment for mental illness, the child’s parentage, etc.).

The parent has the right to request an amendment to their child’s record when the parent believes the information contained in the record is inaccurate, misleading, or violates the privacy or any other rights of their child. If a provider agrees to a parent’s request to have their child’s record amended, the provider amends the information and informs the child’s service coordinator. The service coordinator ensures that the contents of the record are amended and notifies the parent in writing. If the provider decides not to amend the record as requested, inform the parent of this decision and that the parent has the right to a hearing. The EIOD should be informed if the provider declines to amend a record. The EIOD is responsible for informing the parent in writing of the provider’s decision not to amend the record and that the parent has the right to a hearing. An individual designated by the municipality, who does not have a direct interest in the outcome of the hearing, will conduct the hearing. If information in the record is found to be inaccurate, misleading, or to violate the privacy of the child/gamily, the provider will amend the information and will inform the family’s service coordinator. The service coordinator ensures the contents of the record are amended and notifies the parent of the amendment in writing.

A fee not to exceed 10 cents per page for the first copy and 25 cents per page for additional copies may be charged the parent to copy EI records, unless the fee prevents the parent from inspecting and reviewing the record. No fee is charged for records related to evaluations and assessments or for the search and retrieval of records. An evaluator or service provider licensed by NYSED may charge for copies as permitted under PHL 18.

All faxes must contain a fax cover sheet with the following information:

The information contained in this fax is privileged and confidential information under the Family Education Rights and Privacy Act and is intended only for the individual entity named above. The contents must be secured in accordance with all applicable state and federal requirements and guidelines related to the privacy and confidentiality of information. If the reader of this message is not the intended recipient, you are hereby notified that any distribution or copying of this communication is strictly prohibited; please notify us immediately at Cooper Kids Therapy Associates, (516) 496-4460.

The fax recipient must maintain a secure sight where faxed information would not be accessible to unauthorized personnel or to the general public.
Electronic signatures are not accepted.