Effective Date: 04/14/03
THIS NOTICE DESCRIBES HOW MEDICAL AND DRUG AND ALCOHOL RELATED INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GETACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
If you have any questions about this notice, please contact:
Privacy Officer, DADS
976 Lenzen Avenue
San Jose, CA 95126
OUR PLEDGE REGARDING MEDICAL AND ALCOHOL AND DRUG RELATED INFORMATION
We understand that medical and alcohol and drug related information about you and your health is personal. We are committed to protecting this information about you. When you become a client in one of our programs, we create a record of the care and services you receive at that program. We need this record to provide you with quality care and to comply with certain legal requirements. This notice will tell you about the ways in which we may use and disclose your confidential or protected health information (“PHI”). It also describes your rights and certain obligations we have regarding the use and disclosure of your information according to two federal laws, Federal Confidentiality Law (42 C.F.R., Part 2) and the Health Insurance Portability and Accountability Act (HIPAA, 45 C.F.R., Parts 160 and 164).
- We are required by law to:make sure that PHI that identifies you is kept private and confidential with certain exceptions;
- give you this notice about our legal duties and privacy practices with respect to your PHI; and follow the terms of the notice that is currently in effect.
These laws prohibit our program from disclosing to a person outside the program your attendance at our program, or to disclose any information which identifies you as a participant in an alcohol or drug program, or to disclose any protected information except as permitted by federal law. Except as outlined below, we will not use or disclose any PHI unless you have signed a form to authorize its use and disclosure, or unless a Court issues an order telling DADS to disclose your PHI. You have the right to revoke any authorization you have given. However, the revocation will only prohibit us from further disclosing your PHI. If DADS has already made an authorized disclosure before your revocation, the program has acted on your authorization and is not required to try to retrieve the information it has already disclosed. All revocations must be in writing. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required by law to retain our records of the services or treatment we provided to you.
HOW WE MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION
The following sections describe different ways that we may use and disclose your PHI without obtaining an authorization. We will describe each category of uses and disclosures, and give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the following categories.
1. For Treatment
We may disclose your PHI within a program to provide you with treatment or services. We may disclose it to doctors and medical staff, counselors and treatment staff, clerks and support staff, and other healthcare personnel who are involved in your care and who have a need to know that information provide you with alcohol or drug services. For example, we may disclose your PHI to a doctor evaluating your need for medications, or to any counselor participating in your treatment services. We may also disclose your PHI to a case manager who is attempting to place you in another treatment program or find you other needed services.
2. For Business Reasons to a Business Associate
We may disclose your PHI to a business associate who has signed an agreement with us certifying their understanding of the limits on how they can use your PHI and what steps they must take to prevent redisclosure of your PHI. For instance, we may disclose your PHI to a drug testing facility, or to a firm archiving records, or to a medical lab if there is a business associate agreement in place.
3. For Payment
We may use and disclose your PHI to bill for services we provide you and to collect payments for these services. However, we will not disclose this information to insurance companies or health plans without your written consent.
4. For Audits and Performance Reviews
Administration may access your PHI in the course of performing an audit or performance review of the program you are attending. Outside governmental agencies may audit client records to verify that funds were used properly or records maintained according to regulations. However, in both these cases, we would obtain assurances that the PHI reviewed would not be redisclosed or made public.
Researchers who are interested in learning from clients' experiences in treatment programs (e.g. why some clients stay longer or have better outcomes) may also obtain access to your PHI. However, to do so, they must comply with applicable federal regulations and obtain the consent of our Institutional Review Board which considers, when deciding whether to approve research proposals, whether client rights to privacy will be protected.
6.Crimes on Program Premises
We may disclose your PHI to law enforcement to report a crime committed on our premises or against our personnel. For instance, if one of our clients or staff were attacked, we would report this to the appropriate law enforcement agency.
7. Reports of Child Abuse and Neglect.
We may disclose your PHI to appropriate authorities to report suspected child abuse or neglect. If DADS learns information indicating that a child was harmed or was put at risk of serious injury, we are required by State law to report this behavior to the Department of Family and Children Services.
8.To Avert a Serious Threat to Health or Safety
We may use and disclose your PHI when necessary to prevent or lessen a serious or imminent threat to the health and safety of a person. If possible, we will disclose your PHI in such a way that does not disclose that you are a client at a drug or alcohol treatment program. We will also only disclose that information to a responsible person who is able to help prevent the threat. For example, if a client threatened to harm a family member, and had a plan and the means to do so, we might notify the individual of the threat without disclosing who we were or how we knew about the threat.
We may disclose your PHI in a medical emergency to medical personnel who have the need to know this information to deal with the emergency. For instance, if you were a client in our methadone program and had a seizure, it would be important for us to disclose to emergency personnel that you were on methadone and what dose you were receiving.
10. Law Enforcement and Legal proceedings
We will not disclose your confidential information (PHI) in response to a search warrant, subpoena, or other investigative demand, or to identify or locate a suspect, fugitive, material witness, or missing person, unless, you have signed a consent authorizing such disclosure, a Court has issued an order for the disclosure, or if we can disclose this information in a way that does not reveal your participation in an alcohol/drug treatment program.
YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION
You have the following rights regarding your PHI that we maintain in our facilities.
Right to Inspect and Copy
Except for psychotherapy notes and information compiled by us for use in a civil, criminal or administrative action or proceeding, you have the right to request access to inspect and copy your PHI. To inspect and copy your PHI, you must send a specific, detailed request in writing to the manager of the program where you are receiving services or to the Privacy Officer, DADS, 976 Lenzen Avenue, San Jose, CA 95126. We may charge you a fee for the costs of copying, mailing or other supplies associated with your request.
You may request a review if we deny access to inspect and copy except 1) in the circumstances noted in the first paragraph of this section; 2) you are an inmate and the copies would jeopardize your health safety, security, custody or rehabilitation or that of others; 3) the PHI is obtained in the course of research and the right to access is suspended during the progress of the research; 4) the PHI is subject to the Privacy Act and is not permitted by law; or 5) if the PHI was obtained from someone other than a healthcare provider under a promise of confidentiality and the information would reveal the source. A licensed health care provider other than the person who originally participated in the denial will review the denial and we will provide or deny access in accordance with the decision of the reviewing provider.
Right to Amend
If you feel that your PHI in our custody is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as we keep the information. To ask for an amendment, you must send a written request with a reason that supports your request to the manager of the program where you are receiving services.
We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:
- was not created by us;
- is not part of the information kept by or for us;
- is not part of the information which you are permitted by law to inspect and copy; or
- is accurate and complete.
If we deny your request for an amendment, you have the right to submit a written addendum about any item or statement in your medical record you believe is incomplete or incorrect. The addendum cannot exceed one page per alleged incomplete or incorrect item in your record.
Right to an Accounting of Disclosures
You have the right to request a list of the use and disclosures we made of your PHI other than disclosures made 1) to you or authorized by you, 2) as part of a limited data set as permitted by law, or 5) for treatment, payment and healthcare operations (as described above). To request this accounting of disclosures, you must send your request in writing to the manager of the program where you are receiving services.
Your request must state a time period which cannot be longer than a six-year period and cannot include dates before April 14, 2003. Your request should describe the type of list you would like (for example, on paper or electronically). The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to Request Restrictions
You have the right to request a restriction or limitation on your PHI we use or disclose for treatment, payment or healthcare operations. For example, you can ask that we not use or disclose information about medications that you received at our clinic. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide emergency treatment to you. To request restrictions, you must send a request in writing to the manager of the program where you are receiving services. In your request, you must tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply.
Right to Request Confidential Communications
You have the right to request that we communicate with you about personal health matters in a certain way or at a certain location. For example, you can ask that we contact you only at work or by US mail. To request confidential communications, you must send a written request to the manager of the program where you are receiving services. We will not ask you the reason for your request, and we will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to a Paper Copy of This Notice
You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time in person or in writing by sending a written request to Privacy Officer, DADS, 976 Lenzen Avenue, San Jose, CA 95126.
Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain an electronic copy of this notice by visiting the Santa Clara County Portal at: www.sccgov.org and going to the "Health and Human Care" channel and clicking on "HIPAA Privacy Practices".
EXERCISE OF RIGHTS.
If you wish to exercise any of the rights listed above, you should contact the manager of the program where you are receiving services.
CHANGES TO THIS NOTICE
We reserve the right to change our Privacy practices and this Notice. We reserve the right to make the revised or changed Notice effective for the PHI we already have about you, as well as any other information we create in the future. We will post a copy of the current Notice in our facilities. The effective date of the Notice will be displayed on the first page. If you ask, each time you register at, or are admitted to one of our facilities for treatment or healthcare services as an inpatient or outpatient, we will offer you a copy of the current Notice in effect.
We welcome the opportunity to respond to your questions and concerns and to resolve any complaints you may have about the use or disclosure of your PHI. If you believe your privacy rights have been violated, you may file a complaint with us, or with the Secretary of the Department of Health and Human Services. To file a complaint with us, you may send a written notice to the manager of the program where you are receiving services; or to the DADS Patient Rights Advocate, 976 Lenzen Avenue, San Jose, CA 95126.
You will not be penalized in any way (such as having services denied or delayed) for filing a complaint.