Full Text
NOTICE OF PRIVACY PRACTICES This Notice describes how your health information may be used and disclosed and how you can get access to this information. Please review it carefully. ALPINE COUNTY BEHAVIORAL HEALTH SERVICES Alpine County Behavioral Health shall not require individuals to surrender any of their rights under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as a condition of the provision of treatment, payment, enrollment in a health plan, or eligibility of benefits. Our Duty to Safeguard Your Health Information Your Health Information is personal and private. Alpine County Behavioral Health Services (ACBHS) will not use or disclose your Protected Health Information (PHI) unless you have signed a written authorization, except in certain circumstances allowed by law and outlined in this Notice. ACBHS is required to by law to maintain the privacy of your PHI and to ensure certain protections regarding your PHI. We must also provide this Notice to you about our privacy practices to explain how, when, and why we may use or disclose your PHI. We are required to follow the privacy practices described in this Notice; however, we reserve the right to change our privacy practices and the terms of this Notice at any time, in accordance with the law. If we do make changes, you may request a copy of the new notice from any ACBHS clinic. It is also posted on our website at http://www.alpinecountyca.gov/. How We May Use and Disclose Your PHI We use and disclose PHI for a variety of reasons. We have a limited right to use and/or disclose your PHI for purposes of treatment, payment, and for health care operations. For uses beyond that, we must have your written authorization, unless the law allows or requires us to use or disclose PHI without your permission, or in other specific situations. We will make reasonable efforts to use or disclose the minimum amount of your PHI that we need, except in certain circumstances. This brochure describes the ways that we may use or disclose your PHI, as well as your rights regarding your PHI. Uses and Disclosures of PHI that Require Authorization We are required to have your written authorization for uses and disclosures of your PHI, unless the use or ---PAGE BREAK--- disclosure falls within one of the exceptions described in Section IV (below). Revoking authorizations: You may revoke your authorization at any time and stop future uses and disclosures; however, any release of information that we have already made cannot be reversed. Your request to revoke your authorization must be in writing. Uses and Disclosures of PHI That Do Not Require Authorization The law states that we may use or disclose your PHI without consent or authorization in certain circumstances, described below. Other uses and disclosures that are not described in this Notice will be made only with your written authorization. For treatment: We may disclose your PHI to clinicians, case managers, doctors, nurses, and other staff who are involved in providing your care. For example, your PHI will be shared among members of your treatment team. To ensure continuity of care, your PHI may also be shared with outside medical entities performing additional services relating to your treatment, such as lab work or consultation purposes with others involved in the provision or coordination of your care. For payment: We may use/disclose your PHI in order to bill and collect payment for your care. For example, we may contact your employer to verify employment status, or release portions of your PHI to Medi-Cal or a private insurer to get paid for services that we delivered to you. For health care operations: We may use/disclose your PHI in the course of operating our health program. For example, we may use your PHI in evaluating the quality of services provided, or disclose your PHI to a reviewer for audit purposes. Release of your PHI to state agencies may also be necessary to determine your eligibility for publicly- funded services. When required by law: We must disclose PHI when a law requires that we report information about suspected abuse, neglect, or domestic violence; relating to suspected criminal activity; or in response to a court order. We must also disclose PHI to authorities that monitor compliance with these privacy requirements. To Business Associates: We may disclose your PHI to our business associates that perform functions on our behalf or provide us with services, if your PHI is necessary for such functions or services (for example, we may use another company to perform billing services for us). All of our business associates are required to protect your PHI and are not allowed to use or disclose PHI other than as specified in our contract. For public health activities: We must disclose PHI when we are required to collect information about disease or injury, or to report vital statistics to a public health authority. For health oversight activities: We may disclose PHI to health oversight agencies for related activities, including audits, investigations, disciplinary actions, and other monitoring actions. To individuals involved in your care: In some cases, we may share your PHI with a person who is involved in your care or payment for your care, such as your family or a close friend. In some cases, we may also notify your family about your location or general condition, or disclose such PHI to an entity assisting in a disaster relief effort. For reporting death: To the extent that laws and regulations allow, we may disclose PHI related to your death to law enforcement, coroners, medical examiners, or funeral directors. If you are an organ donor, we may also disclose PHI to organ procurement organizations relating to organ, eye, or tissue donation, to facilitate transfer. In some cases, we may disclose your PHI to family members and others involved in your care or payment prior to death, unless you have specifically requested otherwise. For research purposes: In certain circumstances, and under supervision of a privacy board, we may disclose PHI to staff and their designees in order to assist research. To avert threat to health or safety: In order to avoid a serious threat to health or safety, we must disclose ---PAGE BREAK--- PHI as necessary to law enforcement or other persons who can reasonably prevent or lessen the threat of harm. For specific government functions: We may disclose PHI of military personnel and veterans in certain situations; to correctional facilities in certain situations; to government programs relating to eligibility and enrollment, and for national security reasons. Other Situations Involving Your PHI For proof of immunization: We may give immunization information to schools with your (or your guardian’s) oral permission (for example, over the phone). A written authorization is not required in this situation. Alcohol and Drug Abuse Treatment Records If you are a client of the ACBHS Substance Use Treatment Program, your PHI is protected in specific ways. We will not disclose any of your alcohol and drug abuse treatment record unless you have signed a written consent form, except in certain situations allowed by law and described below. Emergencies: We may release information about you to medical personnel who are treating you in an emergency situation. We may also release information about you to medical or personnel if we believe that you are at imminent risk of harming yourself or others. Criminal incidents: We may release contact information about you to law enforcement in relation to a criminal incident on ACBHS premises or against ACBHS staff. Child abuse and/or neglect: We must make an initial report to law enforcement regarding child abuse and/or neglect. (We are NOT allowed to follow up on the report or provide additional information without your written consent.) Research activities: We may use your PHI to conduct research activities, if the results of the research will be used only by ACBHS, and not publicized or given to outside individuals or agencies. Audits and evaluation: We may use your PHI to conduct management audits, financial audits, or program evaluation. We will not specifically identify you in an audit or evaluation report. Court orders: We must release your PHI in response to a court order, under specific circumstances. Your Rights Regarding Your PHI You have the following rights relating to your PHI: To request restrictions on uses and disclosures: You have the right to ask that we limit how we use or disclose your PHI. We will consider your request, but in most cases, we are not legally required to agree to the restrictions. If we do agree, we will comply with your request, unless your PHI is needed to provide emergency care. If you pay in full for a service out-of-pocket, and you request that we do not disclose PHI about that service to your health plan for the purposes of payment or operations, we must comply with your request. However, we cannot agree to limit uses or disclosures that are required by law. To choose how we contact you: You have the right to ask that we send confidential PHI to you at an alternative address or by an alternative means, such as e-mail. We must agree to your request as long as it is reasonable for us to do so. To inspect and request a copy of your PHI: Unless your access to your records is restricted by law or for documented reasons related to your treatment, you have a right to see your PHI upon written request. We will respond to your request within 30 days. If we deny your access, we will write to you and explain our reasons for denying your request, and explain any right to have the denial reviewed. If you want copies of your PHI, a charge for copying may be imposed, depending on your circumstances. You ---PAGE BREAK--- have a right to choose what portions of your information you want copied and to have prior information on the cost of copying. If your records are in electronic format, you may request a copy of your records electronically. To request amendment of your PHI: If you believe that there is a mistake or missing information in our record of your PHI, you may request, in writing, that we correct or add to the record. We will respond within 30 days of receiving your request. If we approve the request for amendment, we will change the PHI, inform you of our decision, and tell others who need to know. We may deny the request if we determine that your PHI is 1) accurate and complete; 2) not created by us and/or not part of our records; or 3) not permitted to be disclosed. If we deny your request, we will write to you, giving you the reasons for denial. We will explain your rights to have your original request, our denial, and any statement in response that you provide added to your record. We will also let you know how to file a complaint. To find out what disclosures have been made: You have a right to get a list of your PHI that has been disclosed and the details of the disclosures. This list will not include allowable disclosures, such as for treatment, payment, and operations; to you, your family, or per your written authorization; for national security or intelligence purposes; to law enforcement officials or correctional institutions; or those made before April 14, 2003. Your request can relate to disclosures going as far back as six years. There will be no charge for one request each year. We may charge you for more than one request per year. We will respond to your written request within 60 days of receiving it, unless we notify you of a delay that will not exceed 30 days. To be notified in case of a breach: We will notify you as required by federal law if your unsecured PHI is unlawfully accessed, acquired, used, or disclosed by ACBHS or one of our business associates. You Have the Right to Receive this Notice You have a right to receive a paper copy of this Notice and an electronic copy by email, upon request. To Complain About Our Privacy Practices If you think that we may have violated your privacy rights, or if you disagree with a decision that we made about your PHI, you may file a complaint with the Alpine County Privacy Officer at 75-C Diamond Valley Rd., Markleeville, CA 96120; Telephone: (530) 694-1816. You may also file a written complaint with the Office for Civil Rights, U.S. Department of Health and Human Services, 90 7th Street, Suite 4-100, San Francisco, CA 94103; 1-[PHONE REDACTED]. We will not penalize you if you make a complaint. Definitions Protected Health Information (PHI): Individually identifiable information relating to your condition; the type of services that you receive; or payment for care provided to you. Information is considered PHI when we believe that the information can be used to identify you. Use: The sharing, employment, application, utilization, examination, or analysis of your PHI within the ACBHS system. Disclosure: The release, transfer, provision of access to, or divulging in any other manner of your PHI outside of the ACBHS system.