Understanding HIPAA Compliance

Confidentiality

The confidentiality of patient records related to alcohol and drug abuse within this program is protected under the HIPAA Privacy Rule and Federal Regulation 42 CFR Part 2. Generally, the program may not inform anyone outside of it that a person is attending the program or disclose any information that identifies a patient as an alcohol or drug abuser, unless:

- The patient consents in writing.

- The disclosure is mandated by a court order or a subpoena.

- The disclosure is to medical personnel during a medical emergency or to qualified personnel for research, audit, or program evaluations.

HIPAA Notice of Privacy Practices

To remain compliant with HIPAA, we are required to provide you with essential information on the use of your Protected Health Information (PHI). In most situations, federal regulation 42 CFR Part 2 limits our ability to use your private health information without your written consent.

The privacy of your PHI is safeguarded under the HIPAA Privacy Rule. “Protected Health Information” includes information about you that may identify you and pertains to your past, present, or future physical or mental health and the related healthcare services.

We utilize and disclose your health information for treatment, payment, and healthcare operations. For example:

- Treatment: We might share your health information with a physician or other healthcare provider involved in your treatment.

- Payment: Your health information may be disclosed for obtaining payment for the services provided.

Healthcare Operations: We may also use and disclose your health information as part of our healthcare operations, which include quality assessment, improvement activities, and evaluating the performance of healthcare professionals. Other operations may involve conducting training programs or facilitating accreditation, certification, licensing, or credentialing activities.

Patient Contact: We may use your health information to send appointment reminders or for mandatory “call backs.”

Required by Law: We may disclose your health information when legally mandated to do so.

In addition to our use of your health information for treatment, payment, or healthcare operations, you have the option to give us written authorization to use and/or disclose your health information and patient records for other purposes. You may revoke this authorization in writing at any time, and any revocation will not affect prior uses or disclosures allowed by your authorization while it was in effect. Unless you provide written consent, we cannot use or disclose your health information for any reason outside of what is described in this notice.

Violations of these federal laws and regulations by a program are a crime, and potential violations may be reported to the relevant authorities per federal regulations. However, federal laws do not protect information regarding crimes committed by a patient at the program or against any individual working for the program, nor do they protect details of suspected child abuse or neglect from being reported to appropriate state or local authorities.

You also possess the right to obtain a copy of your medical record. You can request to view or receive an electronic or paper copy of your medical information we have on file. We will provide a copy or summary of your health information, typically within 30 days of your request, though a reasonable cost-based fee may apply. You can also request corrections to your medical record; we may deny your request but will provide a written explanation within 60 days. You can request that we communicate with you in a specific manner (e.g., at home or at an office phone) or mail to an alternative address. We will honor all reasonable requests. 

Additionally, you have the right to limit how we use or share certain health information for treatment, payment, or operations. Although we are not obligated to agree to your requests, we’ll consider them and may decline if it could impact your care. If you pay out-of-pocket for a service in full, you can request that we do not share that information with your health insurer for payment or operations; we will generally comply unless required by law to disclose.

You have the right to request a list (accounting) of occurrences in which we’ve shared your health information in the last six years, who we shared it with, and why. We will provide one free accounting per year, and a reasonable cost-based fee will apply for additional requests within 12 months. You can request a physical copy of this privacy notice at any time, even if you’ve opted for electronic delivery, and we will promptly comply.

If you have granted someone medical power of attorney or if someone is your legal guardian, that individual can exercise your rights concerning your health information. We will verify their authority before taking any actions. Should you feel that your rights have been violated, you can file a complaint by contacting us using the information on page 1 or submit a complaint to the U.S. Department of Health and Human Services Office for Civil Rights at 200 Independence Avenue, S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/. We assure you that no retaliation will occur for filing a complaint.