Our Policies

Confidentiality/HIPAA
It is the policy of Guardian to protect the privacy and confidentiality of protected health information for the people we serve and our employees. Guardian employees are entrusted with confidential information in a position of trust. Any and all medical or health-related information pertaining to the people we serve is considered to be confidential and protected by the Federal HIPAA (Health Insurance Portability Accountability Act) regulations. Information may only be released in accordance with treatment, health care operations, and billing purposes or with proper releases and/or authorizations.

​

Taking pictures of the people served without written consent is prohibited. This includes all formats for collecting and storing images, such as cell phones, video recorders, flash drives, hard drives, etc.

Failure to protect confidentiality is a serious offense and could result in separation from employment, federal fines of up to $25,000, and possible imprisonment. If an employee is unsure about disclosing information pertaining to the individuals we serve at any time, they should contact their supervisor. State of Michigan licensing rules require that the records of the
people we serve be kept confidential and properly safeguarded at all times. If an employee is aware of a HIPAA violation, they must report this information to their supervisor. HIPAA Security and Electronic Communications

Guardian reserves the right to monitor, access, retrieve, read, and disclose to law enforcement officials, contract agencies, or other third parties, all messages created, sent, received, or stored on the electronic communications systems without prior notice to the originators and recipients of such messages. Authorized employees may monitor the electronic communications of employees to determine whether there have been any violations of law, breaches of confidentiality or security, communications harmful to the business interests of Guardian, or any violations of this policy and any other company policy.

The following safeguards/security measures have been implemented to ensure HIPAA privacy protection:

1. Employees must take steps to ensure that individuals who do not have a need-to-know or permission to view information regarding the individuals we serve do not have access to any individual records, information, or other sensitive data.

2. When transporting confidential records, lock records in the trunk, when possible. If records must be left in the vehicle for a short period, ensure the vehicle is locked and the records are out of sight, not visible.

3. Any electronic devices containing confidential information must be kept secure at all times and must be password-protected. This includes both Guardian owned equipment and employee owned equipment used to conduct agency business (e.g. personal cell phones.)

4. Employees must ask for identification, such as the last four digits of the client's Social Security number or birthdate, to verify the authority of anyone requesting information. Employees must make reasonable attempts during phone conversations to verify the caller.

5. Faxing:
   a) Employees should make reasonable attempts to verify fax numbers prior to faxing confidential and private information.
   b) Employees need to periodically call to verify that the intended recipient receives the faxes.
   c) Management will keep fax machines in a reasonably secure location.
    

6. Computers, Electronic Communications, and Storage Systems:
   a) The electronic communications systems, which include, but are not limited to, telephone, electronic mail, voice mail, facsimiles, databases, and computers, are the property of Guardian. All information and messages that are created, sent, received, accessed, or stored on these systems constitute company records and are the property of Guardian. Employees should have no expectation of privacy regarding any information created, stored, sent, or received on the company's computer system.
   b) Guardian electronic communications may not contain content that a reasonable person would consider to be defamatory, offensive, harassing, disruptive, or derogatory, including but not limited to comments or images that would offend someone on the basis of race, gender, national origin, political beliefs, disability, sexual orientation, pornography, religious or political beliefs, national origin or disability. Employees who receive emails with this content via company computers or from other employees must report the matter to their supervisor immediately.
   c) Guardian electronic communications systems are to be used primarily to conduct company business. Employees may not use the electronic communications systems for political causes, gambling, illegal activities, list serves for non-work purposes, or solicitations or advertisements for unrelated work purposes.
   d) All transmissions of confidential information by internet, diskette or any other data storage device must be encrypted as specified by the HIPAA Security Rule.
   e) Management must maintain a log-on password and screensaver password on all computers. Passwords must contain a combination of upper and lower case letters, numbers and functions.
   f) All information accessed by employees either in electronic or written format will be done so on a need to know basis. Unauthorized access to information not needed to complete job responsibilities is prohibited.
   g) Guardian employees may be using electronic systems/databases in conjunction with contract agencies and, therefore, will be required to follow additional security standards (such as no printing of materials) set by those agencies.