Revision 24-2; Effective Sept. 16, 2024

Grantees must comply with the U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA)  established standards for protection of client privacy.

Grantees are required by HIPPA Privacy Rule to develop and distribute a notice that provides a clear explanation of privacy rights and practices. This Notice of Privacy Practices must be given to clients at the first appointment, upon request and at a minimum, every three years. The notice must also be posted in a clear and easy to find location for clients to review and must be posted on the organization’s website. Visit Notice of Privacy Practices for Protected Health Information | HHS.gov, Notice of Privacy Practices | HHS.gov for more information.

Grantees must ensure that all employees and volunteers receive training about client confidentiality during orientation and be made aware that violation of the law about confidentiality may result in civil damages and criminal penalties. A health care provider’s staff, both paid and unpaid, must be informed during orientation of the importance of keeping client information confidential. Grantees must provide a confidentiality policy that ensures that staff must be informed during orientation of the importance of keeping client information confidential. All employees, volunteers, subrecipients, board members and advisory board members must sign a confidentiality statement during orientation.

A grantee must document the person’s preferred method of communication, including cell phone, email, work phone or text, and preferred language in the client’s record. Each client must receive verbal assurance of confidentiality, an explanation of what confidentiality means which is kept private and not shared without permission, and any applicable exceptions such as abuse reporting.  Grantees are required to provide clients with a copy of their signed confidentiality policy or agreement the client signs and maintain a copy in client's record. A health care provider must not require consent for services from the spouse of a married client.

3310 Minors and Confidentiality

Revision 23-2; Effective Sept. 15, 2023

Except as permitted by law, a provider is legally required to maintain the confidentiality of care provided to a minor. Confidential care does not apply when the law requires parental notification or consent, or when the law requires the provider to report health information such as in the cases of contagious disease or abuse. The definition of privacy is the ability of the individual to maintain information in a protected way. Confidentiality in health care is the obligation of the health care provider not to disclose protected information. While confidentiality is implicit in maintaining a patient's privacy, confidentiality between provider and patient is not an absolute right.

The HIPAA privacy rule requires a covered entity to treat a “personal representative” the same as the individual with respect to use and disclosure of the individual’s protected health information. In most cases, parents are the personal representatives for their minor children, and they can exercise individual rights, such as access to medical records, on behalf of their minor children (45 Code of Federal Regulations Section 164.502(g)).

For more information, see Adolescent Health – A Guide for Providers.

3320 Civil Rights

Revision 24-2; Effective Sept. 16, 2024

HHSC grantees must comply with state and federal anti-discrimination laws outlined in the HHSC Uniform Terms and Conditions – Grant Version 2.16. This includes but is not limited to:

These laws provide that no people in the United States may, on the grounds of race, color, national origin, sex, age, disability, political beliefs or religion, be excluded from participation in or denied any aid, care, service, or other benefits provided by federal or state funding, or otherwise be subjected to discrimination.

State and federal civil rights laws require contractors provide alternative methods to ensure access to services for applicants and recipients who cannot express themselves fluently in English. Grantee agree to take reasonable steps to provide services and information, both verbally and in writing, in appropriate languages other than English, to ensure that people with limited English proficiency are effectively informed and can have meaningful access to programs, benefits and activities.

Find more information about nondiscrimination laws and regulations on the HHSC Civil Rights Office page.

3330 Required Signage

Revision 24-2; Effective Sept. 16, 2024

Grantees that provide direct services to clients must display certain HHS posters about civil rights.  Display the posters in areas where clients and the public can easily see them, such as lobbies, waiting rooms, front reception desks and locations where people apply for and receive HHS services. The following posters are required:

Grantees are encouraged to display signage about suicide prevention, including the 988 Suicide and Crisis Lifeline. If grantee elects to display such signage, it must be displayed in areas where clients and the public can easily view them, such as lobbies, waiting rooms, front reception desks, and locations where people apply for and receive services. 

Examples of a suitable flyers are available here:

Additional mental health and suicide prevention resources are available here: 

3340 Termination of Services

Revision 24-2; Effective Sept. 16, 2024

A grantee must never deny services to an eligible client due to an inability to pay.

Grantees have the right to terminate services to a client if:

  • the client is disruptive, unruly, threatening or uncooperative to the extent that the client seriously impairs the grantee’s ability to effectively and safely provide services; or
  • the client’s behavior jeopardizes their own safety, or the safety of clinic staff or others.  

A termination of services policy must be included in the grantee’s policy manual.

If a grantee denies, modifies, suspends, or terminates services to a client, an explanation must be documented in the client’s record. A client has the right to appeal the denial, modification, suspension or termination of services. Review Appeals, in the PHC rules Title 26, Part 1, Chapter 364.

3350 Resolution of Complaints

Revision 24-2; Effective Sept. 16, 2024

Grantees must ensure clients can express concerns about care received and further ensure those concerns are handled in a consistent manner. Grantees’ policy and procedure manuals must explain the process clients may follow if they are not satisfied with the care received.

1. Grantees must investigate and resolve a complaint or concern within 30 days, beginning on the day they are notified by the aggrieved client.

2. Clients may contact the grantee during and after the resolution of an investigation to receive more information on the grantee's decision or help to correct the issue.

3. Grantees must provide the client with contact information to the HHS Office of the Ombudsman. If a client has requested additional help from the Ombudsman, a grantee must not terminate services to that client until a final decision is rendered by HHSC, unless there is a viable risk to the safety of the aggrieved client, clinic staff or others.

4. All complaints and concerns must be documented in the client's record.

3360 Research (Human Subject Clearance)

Revision 24-2; Effective Sept. 16, 2024

Grantees considering clinical or sociological research using PHC Program funded clients as subjects must get prior approval from their own internal Institutional Review Board (IRB) and HHSC.

The grantee must have a policy in place that indicates that prior approval will be obtained from the HHSC PHC Program, as well as the IRB, before instituting any research activities. The grantee must also ensure that all staff are made aware of this policy through staff training. Documentation of training on this topic must be maintained.