COMPLIANCE PROGRAM. Our commitment to ethical conduct and compliance depends on all employees having a clear understanding of Corporate expectations.

Transcription

1 COMPLIANCE PROGRAM Our commitment to ethical conduct and compliance depends on all employees having a clear understanding of Corporate expectations. SpecialCare Hospital Management Corporation s Commitment to Excellence If you find yourself in an ethical dilemma or suspect inappropriate or illegal conduct, discuss it with your supervisor or use the reporting process outlined in this manual, including the Compliance Hotline at: 1 (866)

2 William A. Billings Chief Executive Officer CEO Compliance Statement: SpecialCare Hospital Management Corporation operates in a position of trust and integrity within our client hospitals. We pledge this adherence to our clients in the very contracts that govern our relationship. We also take steps to monitor and ensure compliance. Our clients therefore, trust SpecialCare and its employees to always provide services with the highest regard to ethics, laws, rules and regulations. Our employees are vital in adhering to and having the highest regard of ethics, laws, rules and regulations in healthcare. Any employee or outside vendor who is performing outside of this approved Code of Conduct place the client hospitals and SpecialCare Hospital Management Corporation at risk. If you, an employee, have knowledge of potential inappropriate or illegal conduct and you don't report it, then you too become an accessory to the conduct. This is unacceptable and will not be tolerated at any level within our organization. SpecialCare Hospital Management Corporation is also committed to making certain that any reported potential wrongdoing is thoroughly investigated and properly reported. We are further committed to a policy of non-retaliation against any employee who reports suspected inappropriate, unethical or illegal conduct. You should feel free to discuss your concerns at any time with our Compliance Officer without fear of retaliation. Please review the attached material, including the Code of Conduct, and become familiar with the expectations the Company has of you. Every employee has a duty to be knowledgeable and involved. If you find yourself in an ethical dilemma, or suspect inappropriate or illegal conduct, use the reporting process outlined in this manual, including the Compliance Hotline at: Thomas P. Millea Chief Compliance Officer Robert C. McNutt Chairman of the Board Initially Adopted: Rev Page 1 Compliance Hotline:

3 DEFINITIONS The following definitions apply throughout these patient confidentiality policies: Client: An individual admitted to the New Vision Service for medical stabilization. The hospital in which the New Vision service is located. Disclosure: The release, transfer, providing access to, or divulging in any other manner, information to organizations or individuals outside of SpecialCare Designated Record Set: A group of records maintained by or for SpecialCare that is the medical, billing and payment records of an individual used, in whole or in part, by or for a Client or SpecialCare to make decisions about individuals. For purposes of this definition, the term record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a Client or SpecialCare. SpecialCare Staff: Any employee or independent contractor of SpecialCare. Patient Private Information: Protected Health Information or Electronic Protected Health Information as such term is defined in the Privacy Rule and generally, information created, Used or Disclosed by a Client or SpecialCare that relates to the past, present or future physical or mental health, or medical condition, the provision of health care to an individual or the past, present or future payment for provision of health care to an individual that identifies an individual or with respect to which there is a reasonable basis to believe that it can be used to identify an individual. Use: The sharing, employment, application, utilization, examination or analysis of individually identifiable health information within SpecialCare by SpecialCare Staff. Initially Adopted: Rev Page 2 Compliance Hotline:

4 (Rev. 10/ 14) CORPORATE COMPLIANCE STATEMENT Part 1: Overview The Statement This Corporate Compliance Statement ( Statement ) sets forth standards of conduct that all personnel employed by or associated with SpecialCare Hospital Management Corporation (the "Corporation") are expected to follow. This statement is designed to be a guide and resource to help all personnel ensure that their behavior is in compliance with all laws and regulations that affect all of their clinical and business dealings. The Statement also describes the procedures that will be followed in enforcing these standards and ensuring that the corporation stays in compliance with all applicable laws. All personnel are expected to read, comprehend and apply the information contained within this Corporate Compliance Statement, and to review it as necessary in order to be alert to situations that could create a conflict of interest or otherwise be contrary to the established policies of the Corporation. All personnel must, upon receiving a copy of this Statement, sign and date the Acknowledgment of Receipt included in the Employee Handbook. The Importance of the Compliance Program The implementation of an effective compliance program is important for several reasons: First and foremost, it is essential that we ensure that we are operating pursuant to the highest ethical standards and in conformity with all applicable legal rules. This is not only the right thing to do, but it is also important for our continuing reputation for honesty and integrity in all of our business and clinical dealings with others. That reputation has been achieved and maintained through the integrity of our officers and employees, and it is one of our greatest assets. Our success depends in large measure on the trust that the patients, affiliated client hospitals, referring agencies, government regulators, and the public place in us. A compliance program will help ensure that we are living up to this reputation and continue to deserve that trust. Moreover, compliance with state and federal rules and regulations is essential because of our potential civil or even criminal liability if we were found to have violated the applicable legal standards. A governmental inquiry can result in very high financial exposure and damage to our reputation for honesty and integrity. Prevention is certainly the wiser business plan, and that is what our Compliance Program is designed to accomplish. Initially Adopted: Rev Page 3 Compliance Hotline:

5 (Rev. 10/14) To be effective, this Compliance Program must be a real part of SpecialCare's culture, mission, and values. As a result, the Corporation must demonstrate that it is both committed to, and actually exercises, due diligence in seeking to prevent and detect violations of law. To be considered effective, federal guidelines require a number of components: 1. A Compliance Program must establish clear standards. 2. The Compliance Program must be administered by a designated Compliance Officer. 3. All positions involving significant discretionary decision making must be filled by honest employees. 4. There must be periodic employee training. 5. There must be continuous monitoring (i.e., audits) of the Company s billing and billing systems. 6. The Compliance Program must provide for an enforcement mechanism to deal with violations of the established standards. 7. The Compliance Program must respond effectively to such violations. 8. Our Compliance Program is designed to satisfy all of these requirements. Questions and Concerns Even the most carefully constructed Compliance Program, however, cannot cover every situation that SpecialCare personnel might face. As a result, if you are unsure of what a proper course of action might be in a specific situation, or believe that the Code of Conduct set forth in this statement may have been violated; please immediately contact the Corporation's Compliance Action Line at (866) This is a dedicated number specific only to compliance issues and messages will only be taken off this line by the Compliance Officer. You may leave messages anonymously, or you may leave your name and contact information if you consent to be contacted in case we need further information or if you wish to hear back from us. You can also contact the Compliance Officer directly. Initially Adopted: Rev Page 4 Compliance Hotline:

6 (Rev. 5/20/15) Part II: Code of Conduct As a central part of the Compliance Program, this Code of Conduct sets forth the standards of conduct that all personnel are expected to follow. Everyone should adhere to both the spirit and the language of the Code, maintain a high level of integrity in their business conduct and avoid any conduct that could reasonably be expected to reflect adversely upon the integrity or reputation of the Corporation. Mission and Values SpecialCare is committed not only to providing patients with quality and caring health care, but also to providing those services pursuant to the highest professional, ethical, business, and legal standards. Most important is our commitment to full compliance with all Federal and State health care program requirements. These high standards must apply to our interactions with everyone with whom we deal. This includes our patients, our affiliated client hospitals, other health care providers, companies with whom we do business (i.e. referral agencies), government entities to whom we report, and the public and private entities from whom reimbursement for service is sought and received. In this regard, all personnel must not only act in compliance with all applicable legal rules and regulations, but also strive to avoid even the appearance of impropriety. While the legal rules are very important, we must hold ourselves up to even higher ethical standards. In short, we do not and will not tolerate any form of unlawful or unethical behavior by anyone associated with SpecialCare Hospital Management Corporation. We expect and require all personnel to be law-abiding, honest, trustworthy, and fair in all of their clinical and business dealings. To ensure that these expectations are met, the compliance program has become an integral part of our corporate mission and business operations. Cooperation with the Compliance Program Because of the importance of the compliance program, we require that each of you cooperate fully with this effort. The compliance program will work effectively only if everyone works together to ensure its success, understands what is required under the law and our own Code of Conduct, and works to ensure that those standards are being followed. SpecialCare has established a Disclosure Program for the reporting of any possible wrongdoings, the contact number is 866) All employees are expected to report to the Compliance Officer, suspected violations of any Federal health care program requirement in addition to SpecialCare's own Policies and Procedures. Such reports are investigated by the Compliance Officer or his designate, with a commitment to nonretaliation and maintaining as appropriate confidentiality and anonymity with respect to such disclosures. In particular, all personnel must cooperate with all inquiries concerning possible improper business dealings, documentation, coding or billing practices, respond to any reviews or inquiries, and actively work to correct any improper practices that are identified. In addition, it is required that every employee familiarize themselves with the Code of Conduct outlined in the Employee Handbook (section 6, 6-14) Initially Adopted: Rev Page 5 Compliance Hotline:

7 (Rev. 10/14) Part III: Standards Related to Outreach Activities It is important to understand that our outreach activities focus on informing potential referral sources of the scope and intent of our service. New Vision's objective is to medically stabilize an individual in acute withdrawal, whereby they can be directed into a CD rehabilitation or counseling service that will address their dependency. Our goal in outreach, as well as patient care, is to facilitate a continuum of care that will best serve the needs of our patients. Illegal Referrals It is illegal to refer a patient to a particular facility or healthcare provider in exchange for certain benefits. Reciprocal Relationships In an effort to provide a continuity of care for our patients, we will enter into mutual relationships with providers of appropriate services that will enable the individual to continue their recovery. A referral to these services, upon written approval signed by the patient is considered upon discharge. A consent for release of information will be completed separately for each treatment facility contacted in the planning of the patient's discharge. It is important to note, that it is illegal to either accept or refer patients to other providers or outside individuals in exchange for certain benefits and is strictly forbidden. Business Courtesies SpecialCare employees may not receive business courtesies from potential referral sources or referral recipients, or their immediate family members. It is against SpecialCare's policy to permit any business courtesy or other benefit that is understood by either party to be offered or provided as an inducement to refer patients or business or as a reward for such referrals. Nor may a business courtesy be extended to a potential referral source who solicits it. Definition of a Business Courtesy is any item of value provided as an inducement for continued business. They include items of value given to another free of cost, as well as social events sponsored or hosted by the Company such as meals, sporting events, theatrical events and receptions. Please contact the Compliance Officer directly should there be any questions or clarification required, as to what constitutes a potential violation. Consequences of any failure to comply with the above will result in disciplinary action, and possible termination from the Company. Initially Adopted: Rev Page 6 Compliance Hotline:

8 (Rev. 10/14) Part IV: Standards Relating to Confidentiality Confidential Patient Information SpecialCare is committed to ensuring that its practice regarding the privacy and security of Patient Private Information comply with HIPAA in addition to industry norms, contractual obligations and as applicable, all Federal and State laws and regulations. Consequently, SpecialCare is committed to maintaining patient confidentiality policies relating to the Use and Disclosure of Patient Private Information. All personnel will keep patient information in the strictest confidence. Such information will not be disclosed to anyone unless authorized by the patient or otherwise permitted by law. Corporate personnel are bound by and must observe all applicable state and federal rules, regulations, and laws governing the confidentiality of patient records and information. Corporate personnel must ensure that protected patient information is held in confidence. The usage of patient names on forms faxed to Corporate shall be avoided and shall be replaced by using account numbers or medical records numbers as identifiers whenever possible. Do not any patient information that could identify any specific patient. This prohibition includes names, addresses, telephone numbers, social security numbers, medical record numbers, or admit/discharge information. Forms, including patient inquiries, financial audits, clinical chart audits, census sheets, and other records that have information such as patient names, diagnoses, incident reports, and other identifying data, are never faxed to the Corporate office. If such information must be sent to the Corporate office, as a matter of policy, it will be sent by first class mail with a receipt or by overnight delivery. If Corporate personnel have any question s about the confidentiality of patient information, such questions should be referred directly to the Director of Clinical Services, who serves as liaison to the Corporate Compliance Officer. Retention of Patient Data New Vision paperwork relevant to patient care is kept in a locked file on every patient admitted to the service. Originals are provided to the hospital for inclusion in their Medical Records, while copies are retained for a minimum of 7 years or for the full term of the contract, whichever is longer. Then upon expiration of the contract they are officially turned over to the hospital with a signed acknowledgement of receipt, for their further consideration. Initially Adopted: Rev Page 7 Compliance Hotline:

9 Policy 001: Administrative Overview Policy PURPOSE: SpecialCare's health care provider clients ("Clients") are required to comply with The Health Insurance Portability and Accountability Act ("HIPAA"), the relevant regulations, 45 CFR Parts 160 and 164, ("the Privacy Rules"), and, in many cases, the federal requirements for Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2. Each of these legal requirements addresses the privacy and security of Patient Private Information. Additional information relating to HIPAA Compliance may also be obtained from the U.S. Department of Health and Human Services or by visiting SpecialCare's business relationships with its Clients involve the Use and Disclosure of Patient Private Information. As a result, SpecialCare has entered into Business Associate/Qualified Service Organization relationships with its Clients that require SpecialCare to abide by certain contractual arrangements to ensure the confidentiality and security of the Patient Private Information that SpecialCare Uses and Discloses in the course of its relationship with our Clients. SpecialCare is committed to ensuring that its practices regarding the privacy and security of Patient Private Information comply with industry norms, contractual obligations and, as applicable, all federal and state laws and regulations. Consequently, SpecialCare is committed to maintaining patient confidentiality policies relating to the Use and Disclosure of Patient Private Information. The purpose of those policies is to set forth the ways in which SpecialCare and its employees will comply with our contractual obligations to our Clients regarding the privacy and security of Patient Private Information. POLICY: 1. It is SpecialCare's policy to protect the privacy and safeguard the security of Patient Private Information in accordance with the patient confidentiality policies and federal and state law. Special Care will only Use or Disclose Patient Private Information in accordance with our contractual obligations or as required by law. 2. SpecialCare's Corporate Compliance Officer will be responsible for: furthering SpecialCare's compliance with its patient confidentiality policies and federal and state laws regarding the privacy of Patient Private Information by maintaining the accuracy of SpecialCare's policies and procedures; ensuring compliance with SpecialCare's contractual obligations pursuant to Business Associate/Qualified Service Organization Agreements; and, answering employee questions and concerns. 3. SpecialCare employees are responsible and accountable for compliance with SpecialCare's patient confidentiality policies, and for reporting suspected violations of those policies of which they become aware. Initially Adopted: Rev Page 8 Compliance Hotline:

10 4. SpecialCare employees who violate SpecialCare's patient confidentiality policies or other federal or state privacy law will be sanctioned in accordance with SpecialCare's Sanctioning of Employees, Agents and Contractors Policy (Policy 005). 5. SpecialCare will have in place appropriate administrative, technical and physical safeguards to protect the privacy of Patient Private Information, and to reasonably attempt to prevent any intentional or unintentional Use or Disclosure of Patient Private Information in violation of SpecialCare's patient confidentiality policies or other applicable state or federal law. See Administrative, Technical and Physical Safeguards (Policy 006). 6. SpecialCare will comply with its contractual obligations to make Patient Private Information available to our Clients so that they may comply with their legal obligations relating to access, amendment and accounting of Disclosures of Patient Private Information. See Access to Patient Private Information (Policy 008); Patient Right to Amendment of Patient Private Information (Policy 009); Patient Right to Accounting of Disclosures (Policy 010); and, Patient Right to Request Restrictions on Uses and Disclosures of Patient Private Information (Policy 011). 7. SpecialCare will ensure that any and all subcontractors are obligated to comply with the same contractual obligations as SpecialCare has agreed to with its Clients. 8. SpecialCare will act to mitigate the harmful effects of any Use or Disclosure of Patient Private Information that is in violation of SpecialCare's patient confidentiality policies or other applicable state or federal law. See Mitigating Effects of Unauthorized Disclosures (Policy 004). 9. SpecialCare will provide access to its internal practices, books, and records relating to the Use and Disclosure of Patient Private Information received from, or created or received by, SpecialCare on behalf of a Client, available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining a Client's compliance with the HIPAA Privacy Rule. 10. SpecialCare employees will be provided with education regarding its patient confidentiality policies that specifically acknowledges the unique level of confidentiality provided to Patient Private Information concerning behavioral or mental health treatment, or treatment of alcohol or substance abuse. See Employee Training on Patient Confidentiality (Policy 002). Initially Adopted: Rev Page 9 Compliance Hotline:

11 Policy 002: Employee Training on Patient Confidentiality PURPOSE: To set forth SpecialCare's policy regarding employee training on patient confidentiality. POLICY: 1. SpecialCare recognizes that training and education are instrumental to meeting effectively our contractual obligations relating to confidentiality and privacy of Patient Private Information. SpecialCare is committed to ensuring that every SpecialCare Staff member is properly trained and educated as to SpecialCare's administrative procedures related to Patient Private Information. 2. Participation in and attendance at training sessions is mandatory for SpecialCare Staff. 3. SpecialCare Staff shall acknowledge participation in training programs and their understanding of the Patient Confidentiality Policies in writing. 4. If SpecialCare Staff are assigned to perform employment duties on a Client's premises, or are involved in a Client's administration or management of the provision of its services that involves the Use and Disclosure of Patient Private Information, such SpecialCare Staff member shall be fully familiar with and shall comply with any and all Client policies and procedures relating to Patient Private Information. 5. It is mandatory that every employee become familiar with the HCCA HIPAA Training Handbook, which provides specific guidelines and direction relating to protected health information. (PHI) Initially Adopted: Rev Page 10 Compliance Hotline:

12 Policy 003: SpecialCare Staff Reporting of Privacy Violations PURPOSE: To set forth SpecialCare's policy regarding reporting of privacy violations. POLICY: 1. Each SpecialCare Staff member is responsible and accountable for compliance with the policies on which the staff member has been trained. Compliance with these policies includes the reporting of possible violations of any of the policies. SpecialCare Staff members will be trained on their responsibility to report suspected privacy noncompliance and other policy or procedure violations. 2. Any SpecialCare Staff member who suspects or identifies a potential or actual violation of a SpecialCare patient confidentiality policy is required to report that violation promptly to the Corporate Compliance Officer. All reports must contain sufficient information for the Corporate Compliance Officer to investigate the concerns raised. 3. The Corporate Compliance Officer shall initiate a record of the suspected violation on a form developed by SpecialCare and endeavor to gather all relevant data. The record shall include the reporting SpecialCare Staff member's name and contact information, the date of the report, and pertinent facts pertaining to the nature of the potential noncompliance or violation. 4. Upon receipt of credible complaints of suspected violations or irregularities, the Corporate Compliance Officer shall conduct an investigation into the facts and circumstances surrounding the alleged violation, and, as appropriate, promptly notify the Client in writing of the alleged violation within five (5) calendar days of the substantiation of any suspected violation. 5. The Human Resources Manager shall follow the provisions of the Sanctioning Employees, Agents and Contractors Policy (Policy 005) in determining appropriate sanctions for any violations determined to have occurred. 6. The Corporate Compliance Officer also shall attempt to mitigate any harm caused by a violation of SpecialCare policies and procedures or of law, in accordance with the Mitigating Effects of Unauthorized Disclosure Policy (Policy 004). 7. Anonymous reports can be made to the Compliance Hotline at or send a letter to: Thomas Millea, Chief Compliance Officer, 1551 Wall Street, Suite 210, St. Charles, MO Initially Adopted: Rev Page 11 Compliance Hotline:

13 Policy 004: Mitigating Effects of Unauthorized Disclosure PURPOSE: To set forth SpecialCare's mitigation policy concerning the impermissible Use or Disclosure of Patient Private Information in violation of SpecialCare's policies or in violation of state or federal law. POLICY: 1. If, through any means, SpecialCare becomes aware of an impermissible Use or Disclosure of Patient Private Information, the Corporate Compliance Officer shall design and implement a timely and appropriate response to the impermissible Use or Disclosure of Patient Private Information by SpecialCare or SpecialCare Staff that is designed to mitigate the effects of any such impermissible Use or Disclosure. 2. Mitigation of such impermissible Uses or Disclosures may include: Corrective action to modify policies and procedures to reduce the risk of future violations, such as: (i) enhancing SpecialCare's policies to modify access or to create additional precautions for the transmission of Patient Private Information; and (ii) adopting risk management policies and procedures to detect and prevent similar violations from recurring; Corrective action to educate personnel. For example, re-training the individual(s) who violated SpecialCare's policies or applicable state/federal laws. Depending on the nature of the violation, the corrective action may be re-assignment, sanctions or termination. Corrective action designed to restore privacy of impermissibly Used or Disclosed Patient Private Information. Specia1Care may seek to secure the return of the Patient Private Information that has been impermissibly Used or Disclosed. For instance, retrieving a facsimile that contains Patient Private Information, or obtaining written assurance from the recipient of the Patient Private Information that the facsimile or record containing the Patient Private Information has been destroyed. Corrective action to stop impermissible Uses or Disclosures of Patient Private Information. SpecialCare may make effective adjustments to its practices or cease sharing Patient Private Information on a temporary or permanent basis. Initially Adopted: Rev Page 12 Compliance Hotline:

14 Policy 005: Sanctioning of Employees, Agents and Contractors PURPOSE: To set forth SpecialCare's policy regarding the application of sanctions against SpecialCare Staff members who fail to comply with SpecialCare's patient confidentiality policies, or other state or federal law regarding the privacy and security of Patient Private Information. POLICY: 1. Members of SpecialCare's workforce who violate SpecialCare's patient confidentiality policies will be subject to discipline ranging from additional training, warnings and reprimand to discharge, as the facts and circumstances of each incident warrants; as well as, where appropriate, the filing of a civil or criminal complaint. 2. SpecialCare agents and contractors who violate SpecialCare's patient confidentiality policies, or their contractual obligations, will be subject to sanctions ranging from warnings to contract termination and, where appropriate, the filing of a civil or criminal complaint or reporting of the violation to the Secretary of the U.S. Department Health and Human Services. Initially Adopted: Rev Page 13 Compliance Hotline:

15 Policy 006: Administrative, Technical and Physical Safeguards PURPOSE: To set forth SpecialCare's policy regarding administrative, technical and physical safeguards for Patient Private Information. POLICY: SpecialCare will develop and implement appropriate administrative, technical, and physical safeguards to protect the confidentiality of Patient Private Information, and to attempt reasonably to prevent any intentional or unintentional Use or Disclosure of Patient Private Information that is in violation of SpecialCare's policies and procedures. Information to be safeguarded may be in any medium, including paper, electronic, or oral and visual representations of confidential information. Current administrative, technical and physical safeguards for Patient Private Information, include, but are not limited to: Each workplace and workstation shall store files and documents in locked rooms or storage systems. In workplaces and workstations where lockable storage is not available, SpecialCare Staff must take reasonable efforts to ensure the safeguarding of Patient Private Information. SpecialCare's workstations will ensure that files and documents awaiting disposal or destruction in desk-site containers, storage rooms, or centralized waste or shred bins, are appropriately labeled, are disposed of on a regular basis, and that all reasonable measures are taken to minimize access. Each SpecialCare workplace and workstation will ensure that shredding of files and documents is performed on a timely basis, consistent with record retention requirements and policies. SpecialCare Staff must take reasonable steps to protect the privacy of all verbal exchanges or discussions of Patient Private Information, regardless of where the discussion occurs. SpecialCare's workplace and workstations shall make enclosed office or interview rooms available for the verbal exchange of Patient Private Information. In work environments structured with few offices or closed rooms, such as open office environments, Uses or Disclosures that are incidental to an otherwise permitted Use or Disclosure may occur. Such incidental Uses or Disclosures are not considered a violation provided that SpecialCare has met the reasonable safeguards and minimum necessary requirements. Each SpecialCare workplaces and workstation must foster employee awareness of the potential for inadvertent verbal Disclosure of Patient Private Information. Initially Adopted: Rev Page 14 Compliance Hotline:

16 SpecialCare Staff must ensure that observable Patient Private Information is adequately shielded from unauthorized Disclosure on computer screens and paper documents. SpecialCare workstations must make every effort to ensure that Patient Private Information on computer screens is not visible to unauthorized persons. SpecialCare's Staff must be aware of the risks involved in the Use and handling of paper documents, and must take all necessary precautions to safeguard confidential information. Initially Adopted: Rev Page 15 Compliance Hotline:

17 Policy 007: Use and Disclosure of Patient Private Information PURPOSE: To set forth SpecialCare's policy regarding the Use or Disclosure Patient Private Information. POLICY: A. Use and Disclosure 1. SpecialCare and SpecialCare Staff will only Use and/or disclose Patient Private Information in accordance with our contractual obligations or as required by law. 2. Uses of Patient Private Information. Acknowledging the unique, personal and confidential nature of Patient Private Information concerning behavioral/mental health treatment and/or treatment for alcohol or substance abuse, SpecialCare Staff with a need to know and use Patient Private Information may only use the specific Patient Private Information necessary to perform their legitimate and appropriate employment functions in furtherance of SpecialCare's business purposes and our obligations to our Clients. 3. Disclosure to a Client. In the course of performing their legitimate and appropriate employment functions, SpecialCare Staff may disclose Patient Private Information to Clients in furtherance of SpecialCare's business purposes and our obligations to our Clients. 4. Disclosures to individuals or entities that are NOT Clients. Except for Clients and the individual who is the subject of the information, SpecialCare Staff may NOT disclose Patient Private Information to any individual or entity without first obtaining the express permission of the Corporate Compliance Officer acknowledging that such Disclosure is appropriate and legally authorized. In general, any authorized Disclosure should be undertaken by the Client. However, in instances where SpecialCare makes a Disclosure, the Corporate Compliance Officer shall be responsible for ensuring that SpecialCare is provided with appropriate and legally valid documentation, including written consents, prior to approving any such Disclosure. NOTE: SpecialCare Staff are prohibited from acknowledging the presence of a Patient at a Client's alcohol or substance abuse treatment facility or program without first obtaining the express permission of the Corporate Compliance Officer acknowledging that such Disclosure is appropriate and legally authorized. Initially Adopted: Rev Page 16 Compliance Hotline:

18 5. Subpoenas, Court Orders and Other Governmental Requests. Any request for a Disclosure of Patient Private Information pursuant to a subpoena, court order, and/or verbal or written request of a government agency or governmental employee ("Government Request ") must be immediately reported to the Corporate Compliance Officer. No SpecialCare Staff are permitted to disclose Patient Private Information in response to a Governmental Request without the express approval of the Corporate Compliance Officer. Note: Unless otherwise authorized under 42 CFR Part 2, SpecialCare is obligated to resist in judicial proceedings any efforts to obtain access to Patient Private Information. 6. If legally authorized to make a Disclosure of Patient Private Information and the information concerns a Patient in an Alcohol or Substance Abuse Program, SpecialCare shall ensure that any such Disclosure carries the following legend: This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient. B. Minimum Necessary Use and Disclosure of Patient Private Information 1. When Using or Disclosing Patient Private Information, SpecialCare Staff will make reasonable efforts to limit the Patient Private Information Used or Disclosed to the minimum necessary to accomplish the intended purpose of the Use, Disclosure, or request. 2. SpecialCare will develop an internal Use policy identifying those Staff members that need access to Patient Private Information to carry out their duties. SpecialCare will identify the category or categories of Patient Private Information to which access is needed, along with any appropriate conditions or limitations of access. Initially Adopted: Rev Page 17 Compliance Hotline:

19 Policy 008: Access to Patient Private Information PURPOSE: To set forth SpecialCare's policy regarding access to Patient Private Information maintained by SpecialCare or a Client. POLICY: Request for Access 1. Each SpecialCare Client has an obligation to address an individual's request for access to Patient Private Information. SpecialCare Staff shall assist any individual verbally requesting access to Patient Private Information by referring them to the appropriate Client contact. 2. If a SpecialCare Staff member personally receives a written request for access to Patient Private Information, such request shall immediately be communicated to the Corporate Compliance Officer. The Corporate Compliance Officer shall promptly, but no later than five (5) calendar days, forward such request to the appropriate Client for a response. 3. The Corporate Compliance Officer shall be responsible for ensuring that the Client responds directly to any request for access to Patient Private Information. In the event SpecialCare provides access directly, it shall not do so unless the Corporate Compliance Officer has secured, as necessary, the appropriate and legally valid documentation, including written consents, prior to providing such access. Denials of Requests for Access 1. Any and all denials of access to Patient Private Information shall be adjudicated by the appropriate Client. SpecialCare Staff shall not advise individuals requesting access that they may not have such access. SpecialCare Staff are responsible for referring all individuals requesting access to the appropriate Client for a response. Initially Adopted: Rev Page 18 Compliance Hotline:

20 Policy 009: Patient Right to Amendment of Patient Private Information PURPOSE: To set forth SpecialCare's policy regarding a Patient's (including, for purposes of this Policy, a former Patient's) right to request an amendment, correction, or deletion (collectively referred to herein as "amendment") of his or her Patient Private Information maintained by SpecialCare or a Client. POLICY: Request for Amendment 1. It is SpecialCare's policy to maintain accurate information about Client Patients. Each SpecialCare Client has an obligation to address a Patient's request for an amendment, correction, or deletion (collectively referred to herein as "amendment") of his or her Patient Private Information. 2. If an Amendment request involves a minor clerical change, such as a misspelling of a name, typographical error in an insurance policy number or other identifying number, or miscommunication of other identifying information, SpecialCare Staff shall make the appropriate Amendment and refer the correct information to the Client immediately. In all other cases, SpecialCare Staff shall assist any individual verbally requesting an Amendment to Patient Private Information by referring them to the appropriate Client contact. 3. If a SpecialCare Staff member personally receives a written request for an Amendment to Patient Private Information, such request shall be communicated immediately to the Corporate Compliance Officer. The Corporate Compliance Officer shall promptly, but no later than five (5) calendar days, forward such request to the appropriate Client for a response. 4. If SpecialCare maintains the Patient Private Information that is the subject of the Amendment request, and the Client directs SpecialCare to amend the Patient Private Information; as appropriate, SpecialCare shall amend such information in accordance with the Client's instructions. Denials of Requests for Amendment Any and all denials of a request for an Amendment to Patient Private Information shall be adjudicated by the appropriate Client. SpecialCare Staff shall not advise individuals requesting an Amendment that such a request can or cannot be complied with. Unless the request is for a minor clerical change as discussed above, SpecialCare Staff are responsible for referring all individuals requesting Amendment to the appropriate Client for a response. Initially Adopted: Rev Page 19 Compliance Hotline:

21 Policy 010: Patient Right to Accounting of Disclosures PURPOSE: To set forth SpecialCare's policy with regard to accounting for Disclosures of Patient Private Information maintained by SpecialCare or a Client. POLICY: 1. Upon request, each SpecialCare Client has an obligation to provide a Patient with an accurate accounting of Disclosures in accordance with the Privacy Rule. It is SpecialCare's policy to maintain accurate information regarding its Disclosures of Patient Private Information. 2. All Disclosures of Patient Private Information MUST be undertaken in accordance with the Use and Disclosure of Patient Private Information Policy (Policy 007). 3. In the event that SpecialCare makes a Disclosure of Patient Private Information to anyone other than a Client or the individual that is the subject of the information, SpecialCare will report to the appropriate Client all necessary information to assist the Client in maintaining an accurate accounting of Disclosures. At a minimum, such information shall include: the date of the Disclosure, the name and address of the entity or individual who received the Patient Private Information, a copy of or brief description of the Patient Private Information disclosed, and a description of the purpose of the Disclosure or a copy of the request for Disclosure. 4. All reports to a Client concerning a Disclosure made by SpecialCare shall be made to the Client within five (5) calendar days of the Disclosure. Initially Adopted: Rev Page 20 Compliance Hotline:

22 Policy 011: Patient Right To Request Restrictions On Uses And Disclosures Of Patient Private Information PURPOSE: To set forth SpecialCare's policy regarding a Patient 's (including, for purposes of this Policy, a former Patient 's) right to request restrictions of Uses and Disclosures of his or her Patient Private Information maintained by SpecialCare or a Client. POLICY: 1. Upon request, each SpecialCare Client has an obligation to provide a Patient with an opportunity to request restrictions on Uses and Disclosures of Patient Private Information maintained about the Patient to carry out Treatment, Payment or Healthcare Operations. To the extent appropriate, it is SpecialCare's policy to adhere to any restrictions as agreed to by a Client. 2. SpecialCare shall permit each Patient to request restrictions on Uses and Disclosures of Patient Private Information. 3. If a SpecialCare Staff member personally receives a verbal request for restrictions on Uses and Disclosures of Patient Private Information, the Staff member shall refer the Patient to the appropriate Client procedure for making a written request for restrictions. 4. If a SpecialCare Staff member personally receives a written request for restrictions, such request shall be communicated immediately to the Corporate Compliance Officer. The Corporate Compliance Officer shall promptly, but not later than five (5) calendar days, forward such request to the appropriate Client for a response. 5. Any and all denials of a request for restrictions on Uses and Disclosures of Patient Private Information shall be adjudicated by the appropriate Client. SpecialCare Staff shall not advise individuals requesting a restriction that such a request can or cannot be complied with. SpecialCare Staff are responsible for referring all individuals requesting a restriction to the appropriate Client for a response. Initially Adopted: Rev Page 21 Compliance Hotline:

23 Standard 012 Compliance with Federal Healthcare Requirements PURPOSE: In order to adhere to Federal laws pertaining to the Anti-kickback Statute (42 U.S.C.; b) and the Stark Law (42 U.S.C.; 1395nn) the following procedures are in place. POLICY: The contract states in defining the Nature of Relationship between SpecialCare and the Hospital that they will not violate any Federal, State or local law, regulation, ordinance or ruling including the Federal Anti-Kickback Statutes and the prohibition against Fraud and Abuse. In addition each contract will have a Business Associate Agreement (BAA) that insures compliance with the Health Insurance Portability Act (HIPAA) final Omnibus rule. All SpecialCare staff will receive Annual In-service on compliance with Federal laws such as: The False Claims Act, Stark Prohibitions, Anti-Kickback Legislation, Qui Tam, EMTALA and HIPAA as a condition of their employment with SpecialCare. All Outreach activities will be monitored to insure compliance with the Anti-Kickback Statute. A Memorandum of Understanding (MOU) will be requested from entities who refer to and receive referrals from the New Vision service. Initially Adopted: Rev Page 22 Compliance Hotline:

24 Part V: Scope and Applications of Standards to Corporate Personnel and Others Personnel Covered The Corporate Compliance Program, including the standards set forth in this addendum to the Corporate policies and in the Corporate policies set forth in this manual, apply to all Corporate personnel and those affiliated with the corporation, including, but not limited to, students completing their internships or other practicum experiences related to an academic program or professional continuing education experience. Compliance with Corporate Polices In addition to this Code of Conduct and Compliance Procedures set forth in this addendum, all Corporate policies and procedures set forth in this manual and all other manuals of the corporation are integral aspects of this Compliance Program. Compliance with these policies and procedures are mandatory. Corporate Operational Manuals SHMC Policy & Procedure Manual Corporate Compliance Manual HIPAA Training Handbook New Vision Orientation Training Manuals (Service & Intake Coordinators) Community Educational Outreach Plan Manual Initially Adopted: Rev Page 23 Compliance Hotline:

25 (Rev. 10/ 14) Part VI: Compliance Procedures Compliance Officer The Corporate Compliance Officer serves as the "point person" for receiving and responding to all reports, complaints, and questions about compliance issues. The Compliance Officer is responsible for ensuring that all compliance issues are properly addressed as they arise and that appropriate compliance assurance reviews, audits and inquiries are conducted. The Compliance Officer will have the authority to review all documents and other information that are relevant to compliance activities including, but not limited to: patient records, financial information related to billing and payments received, marketing records, and reports generated by Corporate staff in affiliated client hospitals to hospital administration/management. Reporting Compliance Issues, Problems and Inquiries All Corporate personnel will raise any questions they have about potentially clinically negligent, unethical or illegal conduct with the Compliance Officer. Any questions by Corporate personnel about the propriety of actual or possible conduct, even in the absence of actions that might be considered clinically negligent, unethical or illegal, shall be directed to the Compliance Officer, utilizing the "Corporate Hotline" at (866) Investigation, Action and Discipline Upon receiving a report about potentially clinically negligent, unethical or illegal conduct, the Compliance Officer will initiate a preliminary investigation. The preliminary report will be presented to the Compliance Committee for further action, including, but not limited to: further investigation by the Compliance Officer; further investigation by Corporate counsel; or disciplinary or other corrective action based upon the preliminary report of the Compliance Officer. Disciplinary or other corrective actions taken with Corporate personnel as a result of a positive finding of clinically negligent, unethical or illegal conduct will be based on existing human resource policies. Initially Adopted: Rev Page 24 Compliance Hotline:

26 Revised Corporate Compliance Complaint Process POLICY: It is the policy of SpecialCare to facilitate open communication in reporting any unethical, illegal or unacceptable actions by any employee without fear of any retribution. The corporation has established a toll free phone number for such a purpose: PROCEDURE: 1. The Compliance Officer (or designee) shall maintain a disclosure log, which includes a record and summary of each disclosure received (whether anonymous or not). 2. Upon receiving a report about potentially clinically negligent, unethical or illegal conduct, the Compliance Officer will initiate a preliminary investigation. 3. If a complaint has been substantiated the Corporate Compliance Officer may seek involvement of certain members of the Compliance Committee. 4. The Compliance Hotline Report is filled out in its entirety including the status of the respective investigation and the initial action taken. The Report will then be presented to the Compliance Committee for further action and consideration. 5. Additional action may include but not be limited to: further investigation by the Compliance Officer, further investigation by Corporate counsel; or disciplinary or other corrective action based upon the preliminary report of the Compliance Officer. 6. Disciplinary or other corrective actions taken with SHMC staff as a result of a positive finding of clinically negligent, unethical or illegal conduct will be based upon existing human resource policies. 7. All findings are subject to the terms of the Corporate Integrity Agreement between the OIG of the Department of Health and Human Services and SpecialCare. Initially Adopted: Rev Page 25 Compliance Hotline:

27 QUARTERLY COMPLIANCE ACCOUNTABILITY REPORT QUARTER 2015 TOTAL CALLS RECEIVED DATE NO. CALLS COMPLAINT MADE (See Report) INITIALS Initially Adopted: Rev Page 26 Compliance Hotline:

28 Page 1 of 2 Compliance Hotline Report Report Date: Contract Site: Name: (optional) Phone: Message: Issue: Response: Assigned to: Title: Outcome: Follow up: Initially Adopted: Rev Page 27 Compliance Hotline: