NOTICE OF PRIVACY PRACTICES
Effective: April 14, 2003
Updated for HIPAA Security April 20, 2005 and Final Rule September 2013
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY.
Following are the Privacy Practices of Jackson Hole Community Counseling Center (“the Center”) as required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and regulations promulgated there under (45 CFR Parts 160 and 164), and the Public Health Service Act (42 CFR Part 2) dealing with confidentiality of alcohol and drug abuse records.
Protected Health Information
The Center collects personal health information (“PHI”) about clients through treatment, payment, and related health care operations, including the application and enrollment process, insurance companies or other healthcare providers, or other means. PHI that is protected by law includes any information that is created or received by health care entities and health care providers like the Center.
Generally, the Center, including its workforce and business associates, may not say to a person outside the Center that a client attends the Center, or disclose any information identifying a client except under certain circumstances as outlined below. The law protects health information that contains specific data, such as name, address, social security number, and other personal information that could be used to identify the client associated with that health information. The Center is allowed at any time to give out information that has been “de-identified”, meaning that the information contains no data that could be used to identify the client associated with that information.
Uses or Disclosures of Personal Health Information
As a general rule, the Center will not use or disclose PHI without the affected client’s permission. The Center will make every effort to obtain the client’s permission if there is a need to use or disclose the client’s information. Once that permission has been obtained, the Center will ONLY use or disclose PHI in accordance with the specific terms of that permission. Additional protections are provided for the privacy of clients who are receiving treatment for substance abuse.
However, there ARE circumstances where the Center is required by law to disclose information. In these circumstances, the Center will make every effort to obtain a client’s permission before releasing the information. If that permission cannot be obtained, and if all legal requirements have been met by the person requesting the information, the Center will release the information according to the requirements of the law. Following are the circumstances under which the Center is permitted by law to use or disclose PHI.
With or Without Consent:
With or without a client’s consent, the Center may use or disclose PHI in order to provide services and treatment required or requested, to collect payment for those services, and to conduct related health care operations permitted or required by law. The Center is permitted to disclose PHI within and among its workforce to accomplish these purposes. The Center has developed policies and procedures that limit which members of the workforce may have access to PHI for treatment, payment activities, and health care operations, based on need to access information in order to do a job. The Center is required to limit such uses or disclosures to the minimal amount of information that is reasonably required for payment activities and health care operations, but this minimum necessary standard does not apply to treatment purposes.
The Center may use PHI to provide appointment reminders and information about treatment alternatives or other health-related benefits and services that may be of interest to the client.
“Treatment” generally means the provision, coordination, or management of health care and related services among health care providers, by a health care provider with a third party, or the referral of a client from one health care provider to another. For example, a counselor at the Center may use PHI about a client to provide health care to that client and may consult with another counselor or psychologist about treatment.
“Payment activities” encompass activities to obtain payment or to be reimbursed for services provided to a client. Payment activities include billing and collection, processing insurance claims, and disclosures to consumer reporting agencies. For example, the Center may disclose PHI about a client as part of a claim for payment from a health or insurance plan.
“Health care operations” are administrative, financial, legal, and quality improvement activities that are necessary to run the business of the Center and to support the core functions of treatment and payment activities. For example, the Center may use PHI to arrange for medical review, legal, and auditing services, to train health care and non-health care professionals, to create de-identified health information or limited data sets, or to conduct fundraising activities for the benefit of the Center.
Without Written Authorization:
The Center may use or disclose PHI without a client’s written authorization, or the opportunity for the client to agree or object, in the following situations:
Public Health Activities: The Center may use or disclose PHI to public health authorities who are authorized to receive such information for preventing, controlling, or reporting disease, injury, disability, or vital events such as birth or death, or for conducting public health surveillance, investigations, or interventions.
Child or Vulnerable Adult Abuse or Neglect: The Center, or any person, must, by state law, report child abuse or neglect, as well as abuse, neglect, exploitation, abandonment, or self-neglect of a vulnerable adult, to social services or law enforcement officials. A vulnerable adult is any person 18 years of age or older who is unable to manage and take care of himself or herself or his/her property without assistance as a result of advanced age or physical or mental disability.
Domestic Violence: The Center may disclose PHI about a client believed to be a victim of domestic violence to social services or a protective services agency if the client agrees to the disclosure or if the Center, in its professional judgment, believes disclosure is necessary to prevent serious harm to the client or others. The client will promptly be informed that such a report has been or will be made, except if the Center believes that informing the client would place him/her at risk of serious harm, or, if a personal representative of the client would be informed, the Center reasonably believes the personal representative is responsible for the domestic violence.
Health Oversight Activities: The Center may disclose PHI to a health oversight agency for such activities as audits; civil, administrative, or criminal investigations, proceedings, or actions; inspections; licensure or disciplinary actions; or other activities.
Judicial Proceedings: The Center must disclose PHI in response to an order of a court or administrative tribunal, but will disclose only the information expressly authorized by the order. The Center may disclose information in response to a subpoena, discovery request, or other lawful process that is not accompanied by an order of a court or administrative tribunal under certain specific circumstances, and if an effort to inform the client has been made.
Wounds: The Center must report untreated gunshot wounds, knife wounds, and other types of suspicious physical injuries to law enforcement officials.
Law Enforcement: The Center must disclose PHI in compliance with a court order, subpoena, or summons issued by a judicial officer, a grand jury, or an administrative request if the information sought is relevant and material to a legitimate law enforcement inquiry, and if it meets certain requirements. The Center may disclose information in response to a law enforcement official’s request regarding a client who is or is suspected to be a victim of a crime if the client consents to the disclosure or in certain situations including emergency circumstances. The Center may disclose PHI about a client who has died to a law enforcement official if the Center suspects that death may have resulted from criminal conduct. Information may be disclosed to a coroner or medical examiner to identify a deceased person or determine a cause of death, and to a funeral director as necessary. The Center may disclose PHI to law enforcement officials that the Center believes in good faith constitutes evidence of criminal conduct that occurred on the Center’s premises. In response to a medical emergency,the Center may disclose PHI to a law enforcement official if disclosure appears necessary to report the commission of a crime; the location or victim(s) of a crime; and the identity, description, and location of the perpetrator of a crime. Use or disclosure may be made to law enforcement authorities in order to identify or apprehend a client because of an admission by that client to participation in a violent crime that the Center believes may have caused serious physical harm to a victim, or where it appears that the client has escaped from a correctional institution or lawful custody, if the information was obtained under certain circumstances.
Correctional institutions: The Center may disclose PHI to a correctional institution or a law enforcement official having lawful custody of an inmate if such information is necessary for the provision of health care to the client; or for the health and safety of others. A client is no longer an inmate when released on parole, probation, supervised release, or otherwise is no longer in lawful custody.
Organ donations: The Center may use or disclose PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs, eyes, or tissue with a written consent from the client, his/her personal representative, or family.
Employers: The Center may disclose information to an employer about an employee who has received health care at the request of the employer in order to conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether the employee has a work-related illness or injury. The client will be provided with written notice at the time the health care is provided that PHI is being disclosed.
Workers’ compensation: The Center may disclose PHI as necessary to comply with laws relating to workers’ compensation or similar programs that provide benefits for work-related injuries or illness without regard to fault.
Research: The Center may use or disclose PHI for research under very specific circumstances. As a general rule, the Center rarely releases identifiable information for research purposes and then only with a client’s permission
Threats to Health or Safety: The Center may use or disclose PHI if it believes it is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and is to persons reasonably able to prevent or lessen the threat, including the target of the treat.
Military: The Center may use and disclose PHI of clients who are Armed Forces personnel or foreign military personnel for activities deemed necessary by appropriate military command authorities.
National Security Activities: The Center may use and disclose PHI to federal officials for lawful intelligence, counter-intelligence, and other national security activities such as protective services to the President, foreign heads of state, or others, as authorized by the National Security Act and any implementing authorities, such as executive orders.
Written Authorization Required:
Except as otherwise permitted or required, the Center may not use or disclose PHI without a valid written authorization from the affected client and may not condition the provision of treatment or payment on a written authorization, except for research-related treatment or treatment undertaken solely for creating information for disclosure to a third party. The Center is required to use or disclose information consistent with the terms of a valid written authorization. An authorization may be revoked in writing at any time, except to the extent that the Center has taken action in reliance on such authorization, or if the authorization was a condition of obtaining insurance coverage.
Psychotherapy Notes: Authorization is required for use or disclosure of psychotherapy notes, except for uses within the center for treatment purposes, training programs, or to defend itself in a legal action brought by the client. Psychotherapy notes may be used or disclosed without authorization to determine the Center’s compliance with HIPAA, as required by law, or for health oversight activities pertaining to the originator of the notes. Use and disclosure may be made without authorization to avert a serious threat to health or safety and to provide information about a decedent to a coroner or medical examiner.
Marketing: Authorization is required for any use or disclosure of PHI for marketing, except when it is a face-to-face conversation by the Center to a client or a promotional gift of nominal value provided by the Center. The Center will also inform the client if any direct or indirect payment is made by a third party.
Uses and Disclosures Requiring an Opportunity to Agree or Object:
The Center may use or disclose PHI in the following instances when the affected client is informed in advance, either orally or in writing, and has the opportunity to agree, prohibit, or restrict the use or disclosure.
Facility directories: The Center does not and will not maintain a directory of clients.
Activities involving a client’s care and notification: The Center may disclose to a family member, other relative, close personal friend, or any other person identified by the client, PHI directly relevant to that person’s involvement with the client’s care or payment activities. The Center may disclose information to notify a family member, personal representative, or other person responsible for the care of the client, of his/her location, general condition, or death. If the client is available and has capacity to make health care decisions, the Center may use or disclose information as described above if it obtains the client’s agreement and provides an opportunity to object, or reasonably infers from the circumstances that the client does not object to the disclosure. If the client is not present, or the opportunity to agree or object cannot be provided because of incapacity or an emergency, the Center may determine whether disclosure is in the client’s best interest and, if so, disclose only the information that is directly relevant to the person’s involvement with the client’s health care.
Disaster relief: The Center may use or disclose PHI to public or private entities authorized to assist in disaster relief efforts.
Client Rights With Respect to Personal Health Information
Affected clients have certain rights with respect to their PHI. The following is a brief overview of these rights:
Right To Request Restrictions on Uses or Disclosures:
Clients have the right to request restrictions on certain uses and disclosures of their PHI. Restrictions may be requested for uses and disclosures to (a) carry out treatment, payment, or healthcare operations; (b) family members, relatives, or close personal friends directly involved in care or payment activities; (c) permit other persons to pick up filled prescriptions, medical supplies, X-rays, or similar forms of PHI; or (d) a public or private entity authorized to assist in disaster relief efforts. While the Center is not required to agree to a restriction, if a restriction is agreed upon, the Center is bound by it, except in certain emergency situations. The Center may terminate its agreement to a restriction if the client agrees or requests the termination or the Center informs the client of the termination. Termination is effective only with respect to information created or received after the client has been informed. The Center will not accept a restriction for uses or disclosures required to determine compliance with the Privacy Rule or for which an authorization or an opportunity to agree or object is not required.
Right to Receive Confidential Communications:
An affected client has the right to receive confidential communications regarding their PHI. Requests must be in writing, and reasonable requests to receive the information by alternate means or at alternate locations will be accommodated. The Center may condition the provision of information on how payment, if any, will be handled, and specification of an alternative address or other method of contact. An explanation of the basis for the request will not be required.
Right to Inspect and Copy PHI: A designated record set is any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for the Center, including medical and billing records. A client has a right to inspect and copy information contained in his/her designated record set, except for (a) psychotherapy notes; (b) information compiled in anticipation of a civil, criminal, or administrative action; and (c) information where access by the client is prohibited by law. These exceptions are unreviewable. Access to PHI created or obtained by the Center for research that includes treatment may be suspended for as long as the research is in progress, if the client has agreed when consenting to participate in the research and has been informed that right of access will be reinstated upon completion of the research. A client’s access may be unreviewably denied, if the PHI was obtained from someone other than a health care provider under a promise of confidentiality and access would likely reveal the source of the information.
Reviewable grounds for denial of access occur when a licensed health care professional has determined that access would likely (a) endanger the life or physical safety of the affected client or another person; (b) cause substantial harm to another person if the information makes reference to that person; or, (c) if the request is made by a personal representative, access is likely to cause substantial harm to the affected client or another person. If access is denied on any of the above grounds, the client has the right to for a review by a licensed health care professional designated to act as a reviewing official and who did not participate in the original decision to deny.
The Center will, if possible, give the client access to any other PHI requested after excluding the information to which access is denied. Denials will be written and contain the basis for the denial, a statement of the client’s review rights, how the client may exercise such rights, and how a complaint may be filed. If the Center does not maintain the PHI that is requested and knows where it is maintained, the client will be so informed.
The Center requires written requests for access to PHI. A request for access will be acted on no later than 30 days after receipt. If the information is not accessible on-site, action will take place no later than 60 days from receipt. Extensions will not exceed thirty 30 days, and the Center will provide a written statement of the reasons for the delay and the date action will be completed. Only one extension is allowed. The Center will provide a client with access to his/her PHI in the form requested if it is readily producible or in a readable hard copy or other format as agreed by the Center and client. The Center may provide a summary of the information requested in lieu of providing access, or may provide an explanation if the client agrees in advance to a summary or explanation and to the fees imposed. The Center will provide access as requested and will arrange a convenient time and place to inspect or obtain copies, or will mail a copy of the information. If the client requests a copy or agrees to a summary or explanation, the Center may charge a reasonable, cost-based fee for copying, postage, and the costs of preparing an explanation or summary, as agreed upon in advance.
Right to Amend PHI:
Clients have the right to request that the Center amend his/her PHI. The Center has the right to deny a request for amendment, if the information (a) was not created by the Center, (b) is not part of the client’s designated record set, (c) is prohibited from access, or (d) is accurate and complete. Written requests from the client must provide a reason for the requested amendment. The Center will act on a request for an amendment within 60 days. This time may be extended once by 30 days if the client is given a written statement of the reasons for the delay and the date by which action will be complete.
If a request is denied, the Center will provide a timely written denial, stating the basis of the denial and explaining the rights of the client to take further action.
If the Center accepts a request for amendment, the amendment will be made. The Center will inform the client that the amendment is accepted and obtain the client’s agreement to have notification of the amendment sent to relevant persons.
Copies of all requests, denials, statements of disagreement, and rebuttals will be included in the client’s designated record set. All requests for amendment, statements of disagreement, and complaints shall be sent to Deidre Ashley, Executive Director, Jackson Hole Community Counseling Center., and PO Box 1868, Jackson, Wyoming 83001.
Right to Receive an Accounting of Disclosures of PHI:
Clients have the right to receive a written accounting of all disclosures of PHI that the Center has made within a 6-year period immediately preceding the date on which the accounting is requested. Accountings will include the date of each disclosure, the name and address of the entity who received the information, a brief description of the information disclosed, and a statement of the purpose of the disclosure or, in lieu of such statement, a copy of the authorization or request for disclosure. The Center is not required to provide accountings of disclosures for the following purposes: (a) treatment, payment, and healthcare operations, (b) pursuant to the client’s authorization, (c) to the client, (d) to persons involved in a client’s care, (e) for national security or intelligence purposes, (f) to correctional institutions or for some law enforcement purposes, (g) disclosures occurring prior to 4/14/03, (h) information sent as part of a limited data set, or (i) relating to investigations of the Center. The Center must temporarily suspend the right to receive an accounting of disclosures to health oversight agencies or law enforcement officials as required by law. Accountings will be provided in any 12 month period without charge, but a reasonable, cost-based fee will be imposed for responding to subsequent requests for accounting within that same 12 month period. All requests for an accounting shall be sent to Deidre Ashley, Executive Director, Jackson Hole Community Counseling Center., PO Box 1868, Jackson, Wyoming 83001. The Center will act on a request for an accounting of disclosures within 60 days after receipt. This time may be extended once by no more than 30 days if a written statement of the reasons for the delay and the date by which the requested action will be completed is given.
Legal Duties of the Jackson Hole Community Counseling Center
The Center is required by law to maintain the privacy of PHI and to provide clients with notice of its legal duties and privacy practices. The Center is required to abide by the terms of this Privacy Notice.
Revisions or Amendments:
The Center reserves the right to revise or amend this Notice of Privacy Practices at any time. Revisions or amendments will reflect changes in State and Federal law protecting privacy and confidentiality and any changes in the Policies and Procedures of the Center. Revisions or amendments may be effective for all PHI the Center maintains even if created or received prior to the effective date of the revision or amendment. Notice will be provided of any revisions or amendments to this Notice of Privacy Practices, or changes in the law affecting this Notice, by mail or electronically within 60 days of the effective date of such revision, amendment, or change.
Complaints may be filed with the Center and with the Secretary of the Department of Health and Human Services (DHHS) if a client believes that any privacy rights have been violated. Complaints must be in writing, may be on the form provided by the Center, and may be filed by mail or electronically to the Center’s privacy officer Deidre Ashley, Executive Director, Jackson Hole Community Counseling Center., PO Box 1868, Jackson, Wyoming 83001. Phone 307-733-2046. E-mail: firstname.lastname@example.org. A complaint must name the entity or person that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable requirements of the law or this Notice. A complaint must be received by the Center or filed with the Secretary of DHHS within 180 days of when the client knew or should have known that the act or omission occurred. Clients will not be retaliated against for filing any complaint. Complaints sent to the Secretary of DHHS should be sent to:
The US Dept. of Health & Human Services
Office of the Secretary
200 Independence Ave., SW
Washington, DC 20201
Violation of Federal law and regulations regarding the confidentiality of client records is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations. The Center will provide the necessary information for such reporting upon request.
On-going Access to the Notice of Privacy Practices
The Center will provide a copy of the most recent version of this Privacy Notice at any time upon written request sent to Deidre Ashley, Executive Director, Jackson Hole Community Counseling Center., PO Box 1868, Jackson, Wyoming 83001. Clients may obtain a paper copy of this Notice upon request, even if he/she has agreed to receive the Notice electronically. For any other requests or for further information regarding the privacy of PHI, and for information regarding the filing of a complaint, please contact our privacy officer, Deidre Ashley, Executive Director, at the address, telephone number, or e-mail address listed above.