Privacy and HIPAA Policies

1. Purpose

• The purpose of this Policy is to:

  • Ensure HIPAA compliance

  • Maintain confidentiality of PHI

  • Guide proper handling of PHI

  • Support client rights

  • Define breach response procedures

2. Scope

• This Policy applies to anyone employed by Sunrise Autism, including:

  • BCBAs

  • RBTs/behavior technicians

  • Administrative staff

  • Contractors & business associates

  • Interns/volunteers

  • Any entity handling PHI for Sunrise Autism, LLC

3. What is PHI?

• Protected Health Information (PHI) includes any information identifying an individual and relates to:

  • Health condition

  • Treatment

  • Payment for healthcare

• Examples include:

  • Name, date of birth, address

  • Medical / developmental history

  • Diagnosis

  • Treatment data & notes

  • Insurance information

• PHI may be:

  • Written

  • Electronic (ePHI)

  • Verbal

4. Allowed Use & Disclosure of PHI

• We may use or disclose PHI for:

  • Treatment

    • ABA service delivery

    • Care coordination with authorized providers

  • Payment

    • Billing

    • Insurance authorization and claims

  • Healthcare Operations

    • Quality improvement

    • Staff training

    • Compliance / auditing

• Outside of these purposes, PHI is only used or disclosed with written authorization unless legally required.

• We will only disclose the minimum necessary PHI for its purpose.

5. Nevada-Specific Privacy Compliance

We comply with relevant Nevada privacy laws, including:

• NRS 603A — Security of Personal Information

• Nevada State Breach Notification Requirements

               Data Breach Notification (NRS 603A.220)

• If PHI or personal information is acquired by an unauthorized person:

  • We will notify affected individuals as soon as reasonably possible, unless law enforcement determines notification would impede an investigation.

  • Notifications will describe:

    • The breach

    • What information was involved

    • Recommended steps for protection

    • Mitigation efforts

  • If required, we will notify relevant state authorities.

​

6. Client Rights

• Clients (or parents/guardians) have the right to:

  • Access PHI

  • Request corrections

  • Request limits on disclosures and disclosure history

  • Request confidential communication methods

  • Receive a copy of this policy

  • File complaints without retaliation

• Requests must be submitted in writing to our Privacy Officer.

7. Privacy Officer

• The Company maintains a designated Privacy Officer responsible for:

  • Managing HIPAA compliance

  • Staff training

  • Reviewing incidents

  • Responding to access/complaint requests

• Privacy Officer Contact:

  • Name: __________________________

  • Phone: __________________________

  • Email: __________________________

8. Workforce Responsibilities

• All personnel must:

  • Protect PHI

  • Use ePHI only via approved systems

  • Access PHI only when necessary for their role

  • Report privacy concerns or breaches immediately

• Non-compliance may result in disciplinary action.

9. Safeguards

• We protect PHI using:

  • Administrative Safeguards

    • HIPAA training

    • Business Associate Agreements

    • Access control policies

  • Physical Safeguards

    • Locked file storage

    • Controlled facility access

    • Secure disposal (shredding)

10. Telehealth PHI Protections

• Telehealth ABA services are delivered through HIPAA-compliant platforms.

• We ensure:

  • No recording unless explicitly authorized

  • Sessions occur in private settings

  • Encrypted communications

• Families are encouraged to participate from a private environment to ensure confidentiality.

11. Business Associates

• Business associates must sign a Business Associate Agreement (BAA) requiring:

  • Proper security practices

  • Restricted use of PHI

  • Breach reporting obligations

​

12. Record Retention

• We retain PHI as required by:

  • HIPAA

  • State regulations

  • Insurance requirements

• Once retention periods expire, PHI is securely destroyed.

13. Training

• All staff and associates receive HIPAA training:

  • Upon hire

  • Annually

  • When regulations change

14. Complaints & Non-Retaliation

• Clients may file privacy complaints to:

  • Our Privacy Officer

  • U.S. Department of Health & Human Services (HHS)

• We prohibit retaliation for filing complaints.

15. Updates to This Policy

• We may update this Policy periodically and revisions will be posted online with a new “Last Updated” date.

• Continued use of services signifies acceptance.