Client rights, privacy and HIPAA policies
By Scott McKenzie, founder of Home Care Agency Blueprint · Updated
Your state usually sets what a home care client rights notice and grievance process cover. Privacy is a policy every agency needs, whether or not HIPAA applies. HIPAA applies only to covered entities and their business associates, so decide with counsel whether your agency is one before you copy HIPAA language into your manual.
Client rights notice and grievances
Most manuals include a written notice of client rights and a grievance process: how a client or family raises a concern, who responds, how it is tracked, and a promise that raising a concern will not affect services. Your state may set what the notice says, when it is given and how grievances are handled. Check your state’s licensing rules.
Does HIPAA apply to your agency?
HHS says the HIPAA Rules apply to covered entities and business associates, and that an entity that does not meet either definition does not have to comply with them. A health care provider is a covered entity only if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as billing a health plan.
Many private-pay-only non-medical agencies may not be covered entities, but state privacy law and contracts still apply. Confirm with counsel.
Privacy Rule and Security Rule, in brief
| Rule | What HHS says it covers |
|---|---|
| Privacy Rule | National standards for how covered entities use and disclose protected health information, and individuals’ rights to understand and control how their health information is used. Covered entities make reasonable efforts to limit uses and disclosures to the minimum necessary, and, with certain exceptions, each provides a notice of its privacy practices. |
| Security Rule | National security standards for health information held or sent in electronic form, through administrative, physical and technical safeguards. |
High-level summary only. If HIPAA applies to you, read the HHS summaries and work with counsel on your policies.
A privacy policy either way
Whether or not HIPAA applies, write down who may see client information, how it is stored and shared, how you record a client’s or representative’s permission before sharing, and what staff may not discuss. Your state may have its own privacy rules.
Using client names, photos or stories in marketing raises separate questions; homecareagencymarketing.com, also published by Home Care Agency Blueprint, covers that caution.
Nondiscrimination and language access
HHS’s Office for Civil Rights enforces federal civil rights laws, including Section 1557 of the Affordable Care Act, for health programs and activities that receive federal financial assistance from HHS. HHS says these laws require covered programs to provide language assistance services free of charge to people with limited English proficiency. If you receive Medicaid or other federal funds, check with counsel what notices and language help you need, and write a policy for how you provide interpreters and translated materials.
Your state sets the details. Your state’s licensing rules decide which written policies a home care agency needs and what they cover. This site does not list state requirements. Check with your state licensing agency; homecarelicenseguide.com, also published by Home Care Agency Blueprint, collects each state’s licensing sources. Not legal advice. Check with counsel and your state licensing agency.
What to do next
Frequently asked questions
Does HIPAA apply to every home care agency?
No. HHS says it applies to covered entities and business associates. A provider is a covered entity only if it transmits health information electronically in connection with certain standard transactions. Decide with counsel whether your agency is covered.
Do I need a privacy policy if HIPAA does not apply?
Yes, as a matter of good practice, and your state may have its own privacy rules. Clients and families expect their information to stay confidential.
Want to talk through your options?
A free 15-minute clarity call with Home Care Agency Blueprint. It helps people start home care agencies, so expect that perspective. You do not need a finished manual first.
Book a free 15-minute clarity call