I.  PURPOSE
 

It is the policy of the Los Angeles County Department of Mental Health (DMH) to mitigate, to the extent practicable, any harmful effects that arise out of the use or disclosure of Protected Health Information (PHI) by either DMH workforce or Business Associates in violation of the Privacy Regulations of the Health Insurance Portability and Accountability Act of 1996, 45 CFR Parts 160 and 164 (HIPAA Privacy Regulations).  
 

II.  DEFINITIONS
 

Business Associate Agreement (BAA) means the contract language between DMH and its business associates that allows the business associate to create or receive PHI on behalf of DMH. The term “Business Associate Agreement” includes both stand-alone contracts and amendments to existing services agreements, as well as Business Associate Agreement language that is part of a new services agreement. A Business Associate Agreement is not required for disclosures by DMH to a health care provider regarding an individual’s treatment, if the individual is a mutual client of both parties. (See policy on HIPAA Business Associates)

Protected Health Information (PHI) means information that (i) is created or received by a health care provider, health plan, employer or health care clearinghouse; (ii) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (iii) identifies the individual (or for which there is a reasonable basis for believing that the information can be used to identify the individual). PHI does not include employment records maintained by DMH personnel files in its role as employer.

Disclose means with respect to PHI, the release of, transfer of, provision of access to, or divulging in any manner, PHI outside of DMH internal operations, external individuals and workforce members who do not have a need to know.  

Workforce Members means any employee, volunteer, intern, trainee, contracted provider, locum tenens, consultant, or other individual whose conduct in performing work for DMH is under the responsibility of DMH.
 
Use means with respect to PHI, the sharing, employment, application, utilization, examination or analysis of such information within DMH internal operations.

Privacy Violation means behaviors demonstrating an intentional or unintentional disregard of DMH privacy-related policies or any of the provisions of HIPAA. The term “violation” does not include disclosures by whistleblowers or disclosures by workforce crime victims, as defined in the policy on Workforce Sanctions.
 

III.  POLICY
 

This policy and procedure applies to all DMH workforce members and contracted providers performing work or services on behalf of DMH, in accordance with applicable federal and state privacy laws, HIPAA, contractual obligations, and DMH privacy policies. 
 

IV.  PROCEDURES
 

Procedure - Mitigation of Harm
 

V.  AUTHORITY
 

HIPAA 45 CFR Section 164.530(f)
 

VI. ATTACHMENTS