Privacy Information

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Scroll down to the Notice of Privacy Practices and Signatures on File section.
3. Privacy Notice — Check this checkbox. The current date appears in the date field to the right of the checkbox.
   Note: If you select the Privacy Notice option, athenaOne automatically sets the Providers have legal authority to obtain medication history? option to Yes (if you have not yet selected Yes or No for this field).
4. Verify, enter, or select the date that the Notice of Privacy Practices was given in the date field to the right of the checkbox.
5. Notice Not Given Reason — If you are unable to give a patient your Notice, select the reason why the notice was not given.
6. If Reason is 'Other', Please Specify — If you select Other from the Notice Not Given Reason list, enter the reason to document the "best effort" used by your practice.
7. Click Save.

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Scroll down to the Notice of Privacy Practices and Signatures on File section.
3. Release of Billing Information — Check this checkbox and enter or select the date range for which this signature is valid.
4. Assignment of Benefits — Check this checkbox and enter or select the date range for which this signature is valid.
5. Signature Source — Select (or verify) the method by which the signatures were obtained.
6. Click Save.

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Scroll down to the Release Authorizations and Consents heading.
3. Click the add authorization link to display the Release Authorizations page.
   For more instructions, see the Release Authorizations page.
   

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Scroll down to the Release Authorizations and Consents heading.
3. Click the update link for the authorization that you want to update. The Release Authorizations page appears.
   For more instructions, see the Release Authorizations page.
   

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Scroll down to the Release Authorizations and Consents heading.
3. Click the print form link to display the Print Form or Document page.
   
   For more instructions, see the Print Form or Document page.

1. Display the Privacy Information page: On the Check-in page, click Manage Privacy (under the Privacy heading).
2. Scroll down to the Health Data Sharing heading.
3. Click the show portal e-signature history link.
   A window displays the list of forms that the patient signed electronically during the self check-in process, along with the date that the patient signed the form and the name entered as the signature. You can click the name of the form to display the form in a new window.

For more information, see Patient Record Sharing.

Using the Privacy Information page, you can stop sharing a patient's records with a particular site, and you can also connect a patient to a different patient profile.

1. Display the Privacy Information page.
   • On the Quickview or Check-in page, scroll down to the Privacy section and click Manage Privacy.
   • In the Intake stage of the encounter, click Patient Preferences in the Intake checklist. Scroll down to the Patient Record Sharing section and click Manage data sharing.

   The Privacy Information page appears.

2. Scroll down to the Health Data Sharing section, which displays the patient profile and each site that the patient is connected to.
   
   Note: You can click the show history link to display an audit history.
3. To stop sharing the patient's information with a connected site:
1. Click Manage.
   The Shared Medical Records list displays all the sites that share data about the patient.
   
2. Select Stop Sharing from the menu to disconnect a site for the patient.
   Note: When you stop sharing records with a site, you cannot reconnect the site for this patient in the future. Previously downloaded documents from the site remain in the patient chart unless you remove them manually.
3. Click Submit.
4. If you determine that the patient is linked to the wrong shared patient record and you need to connect the patient to a different patient profile, click Connect to a different profile.
   A confirmation message appears. Click Continue or click Cancel.
   Note: If you click Continue, patient record sharing is disabled for the patient (the Patient Record Sharing option is set to No).

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).

2. Click the record access restriction, record sharing restriction, reporting restriction, or confidential communications link (under the Privacy Notes heading — Restrictions).
   

    

   The difference between privacy notes is as follows:

   • “Record access restriction” restricts user access to patient records. The rendering, scheduling, or supervising provider assigned to an appointment for a patient with a record access restriction can access the patient’s record for 15 days before and after the appointment. Users with "Privacy: Access Blocked Patients" or the "Emergency Access: Privacy: Access Blocked Patients" permissions can also access charts that have this privacy protection. For more information, see User Guide — Record Access Restriction.
   • "Record sharing restriction" prevents sharing of a patient’s records with other people. For example, a patient can request that their medical information be withheld from a spouse or other family member.
   • "Reporting restriction" excludes a patient from report results when you run reports using the Report Builder. No reports will include a patient with a reporting restriction unless you select the Show Reporting Restricted Patients option when running the report.
   • “Confidential communications” requests an alternative means or alternative location for communicating a patient’s health information. For example, a patient might request that you use a cell phone number instead of a home phone number to communicate medical information.

   The Privacy Protection Notes page appears. For more instructions, see the Privacy Protection Notes page.
   

    

   Note: Approved privacy restriction notes also appear on the View Appointment Ticklers page under the Patient Notes column.

1. Display the patient's Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
   At the bottom of the Privacy Information page under the Privacy Notes heading, the Other Requests field has a link for each type of request that affects the patient's record. Any existing requests are displayed in a list. Click update to view or edit a request.
   
2. To add a record amendment request, click the record amendment link. The Patient Request Notes page appears.
   
3. Type — Verify or select the type of privacy note that you want to create.
4. Source — Select the source of the request.
5. Form — Select the appropriate form (if applicable) from the Form list. (Your practice must have at least one form or document defined to use this list.)
6. Request Date — Enter the date that the request was made (usually the current date).
7. Review Date — If you are authorized to adjudicate patient privacy requests, set the date that you reviewed the request.
8. Status — Verify that the status of the request is set to REVIEW. (If you are authorized to adjudicate patient privacy requests, you can determine and set the appropriate status at this time.)
9. Request Note — Enter a description of the request. It is essential to fully describe what restrictions are being requested.
10. Review Note — Enter a description of the review and decisions made.
11. Click Save. The patient Quickview page appears, with the number of privacy notes in REVIEW status updated. The new request also appears on the Privacy Information page under the Privacy Notes heading.

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Click the complaint link to add the complaint. The Privacy Complaint Notes page appears.
3. Source — Select the source of the request.
4. Form — Select the appropriate form (if applicable). Your practice must have at least one form or document defined to use this list.
5. Request Date — Verify, enter, or select the complaint date (usually the current date).
6. Review Date — If you are authorized to review complaints, enter or select the date that you reviewed this complaint. This is usually the current date.
7. Status — Verify that the status of the complaint is set to REVIEW. (If you are authorized to adjudicate complaints, you can determine and set the appropriate status at this time.)
8. Request Note — Enter the description of the complaint. Describe the nature of the privacy complaint.
9. Review Note — If you are authorized to review complaints, enter any notes about reviewing this complaint.
10. Click Save. The Quickview page appears, with the number of privacy notes in REVIEW status updated. The complaint also appears on the Privacy Information page under the Privacy Notes heading.  

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Click the disclosure link (under the Privacy Notes section: Disclosures). The Patient Disclosure Notes page appears.
   For more instructions, see the Patient Disclosure Notes page.

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Click the update link next to the note that you want to update (under the Privacy Notes section). The Privacy Notes page appears.
   
   For more instructions, see the Privacy Notes page.
   
   

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Click the record restriction link under the Privacy Notes heading. The Privacy Protection Notes page appears.
3. Enter the date of dismissal in the Request Date field.
4. Set the Status to REVIEW.
5. Note — Enter the name of the physician who is dismissing the patient and the name of the practice from which the patient is dismissed.
6. Click Save.

Note: Your practice must have the athenaCommunicator service enabled.

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).

Under the Communicator Privacy Status heading

2. Do not place any automated calls or emails — Select this option to prevent the sending of automated reminder calls and other automated calls to this patient.
3. Block Portal Access — Select this option to prevent the patient from having access to the Patient Portal.
4. Patient Portal Terms and Conditions accepted? — This checkbox is updated automatically when the patient logs on to the Patient Portal and accepts the Patient Portal Terms and Conditions.
   The Patient Portal Terms and Conditions cover all aspects of the Patient Portal and are available via a link at the bottom of all Patient Portal pages.
5. Portal Access — Click view portal access to display the Portal Accounts page. This page lists the Patient Portal accounts that this patient has access to.
6. Do not send Portal Adoption Emails — Select this option to prevent the sending of Patient Portal adoption emails to this patient.
7. Consent to Call — This field indicates whether you obtained "express consent" (as defined by the Telephone Consumer Protection Act) from the patient to receive automated calls from your practice to the patient's mobile phone. Automated calls include ReminderCall, GroupCall, ResultsCall, and Self-Pay calls.

Under the Communicator Automated Messaging Preferences heading

8. Select the phone, email, and text options according to the patient's preferences. Patients can also set these messaging preferences themselves on the Patient Portal.
   Note: Practice staff can select text message contact preferences on behalf of the patient only if the Consent to text option is set to Yes. The Consent to text option appears on the Check-in, Quickview, and Patient Registration pages.
   
9. Click Save.

Patients can set their own contact preferences on the Patient Portal by selecting the Notification settings option from the patient profile menu.

To receive text messages from your practice, the patient can select Include text messaging as a contact option and accept the Terms of Use for text messaging on this page.

After agreeing to receive text messages, patients can go to the Notification settings tab of the My profile page to select and deselect the types of text messages to receive from the practice: health notifications, appointment reminders, updates and announcements, and billing information.

Note: Patients are charged standard message and data rates for text messages from your practice.

Practice staff can select Phone and Email contact preferences on behalf of the patient using the checkboxes under the Communicator Automated Messaging Preferences heading on the Privacy Information page.

Note: Practice staff can select text message contact preferences on behalf of the patient only if the Consent to text option is set to Yes. The Consent to text option appears on the Check-in, Quickview, and Patient Registration pages.

To set email, phone, and text preferences for a patient:

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).

Under the Communicator Automated Messaging Preferences heading

2. Health Notifications — Select the preferred methods of communication for lab results and other health notifications (used by the ResultsCall and Order Reminders services).
3. Appointments — Select the preferred methods of communication for appointment related messages (used by the ReminderCall service).
   Note: Appointment reminder emails include the provider's Display Name (from the Providers page) and the department's Communicator Display Name (from the Departments page). If the Communicator Display Name field is blank, the email does not include a department.
4. Announcements — Select the preferred methods of communication for general messages (used by the GroupCall and Automated Wellness Outreach services).
5. Billing — Select the preferred methods of communication for billing related messages (used by the Self-Pay Reminders and Guest Payments services).
6. Click Save.

In accordance with HIPAA's Privacy Rule 45 CFR 164.522(a)(1)(vi), patients can request that fully self-paid services not be disclosed to their health plan (payer). You can enable this non-disclosure for a patient on the Privacy Information page. When you select the Patient Requested Health Plan Restriction for Self-Pay Services option:

• athenaOne does not run eligibility checks (including coverage scan eligibility checks) on self-pay claims for this patient.
• The patient is excluded from Pay for Performance programs.
  Note: To ensure that self-pay services are exempt from periodic reporting (monthly, quarterly, yearly, etc.) related to quality programs, athenahealth recommends that this option remain selected for an extended period.

Note: You can report on self-pay patients excluded from pay for performance programs using the Report Builder. Select the "Patient Self-Pay Restricted Yes/No" column in a Patient Demographics report.

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Scroll down to the HIPAA Self-Pay Restrictions heading.
3. Patient Requested Health Plan Restriction for Self-Pay Services — Select this option if a patient requests that fully self-pay services not be disclosed to the patient's health plan (payer).
   Note: This option applies to all self-pay services until it is deselected.
4. Click Save.

1. Display the Privacy Information page: On the Quickview, click Manage Privacy (under the Privacy heading).
2. Under the Communicator Privacy Status heading, select the Block Portal Access option to prevent the patient from having access to the Patient Portal.
3. Click Save.
   The patient's Quickview displays the message "This patient will not be able to access the Patient Portal."

In addition to the standard checkboxes for privacy and consent, you may also see checkboxes for other privacy and consent items that are state-specific, such as state immunization registries, or client-specific interfaces. Please contact your practice administrator for guidance on these items.

Reporting Restriction

This type of privacy restriction applies only to Report Builder. When you run any report in Report Builder, patients with a reporting restriction are excluded from the report results unless you select the Show Reporting Restricted Patients option in the Report Options window. This window appears when you click Run Report from the Preview Report tab.

Record Sharing Restriction

This type of privacy restriction provides greater flexibility when working with different types of reports.

In Report Builder — Record sharing restriction works with the "Show Patients with Restricted Records" filter (found under Patient on the Choose & Set Filters tab). Select Yes to include only records that have a record sharing restriction in the report results, select No to include only records without a record sharing restriction, or select Pending to include only records that have a pending request for a record sharing restriction.

If you select the "Show Patients with Restricted Records" column (found under Patient on the Choose Display Columns tab), the restricted column appears in the report results and displays Y or N to indicate if a record is restricted or not, but this option does not filter results for privacy restriction.

In Activity Wizard (Advanced View), A/R Aging Wizard (Advanced View), and Collections AR Report — Record sharing restriction works with the Show Patients with Restricted Records field. This field provides four options:

• Hide All — The column does not appear in the report results; no filtering based on record restriction.
• Show All — The column appears in the report results; Y and N indicate which records have a record restriction and which do not; no filtering based on record restriction.
• Yes — The report results are filtered to include only records with an approved record restriction.
• No — The report results are filtered to include only records without a record restriction.

If a patient does not want to receive emails for athenaCommunicator features, your practice staff should first ensure that the patient fully understands the limitations involved in not receiving email notifications. Your staff can then deselect the Email option in athenaOne on the patient's behalf.

Note: The patient cannot use the Patient Portal to opt out of email. Your practice must complete this request from the Privacy Information page.

To disable specific automated email types for a patient, locate the Communicator Automated Messaging Preferences section on the Privacy Information page and then deselect the Email option, as follows:

• To disable ResultsCall emails, disable the "Health Notifications" Email option.
• To disable ReminderCall emails, disable the "Appointments" Email option.
• To disable GroupCall emails, disable the "Announcements" Email option.
• To disable Self-Pay and guest payment emails, disable the "Billing" Email option.