HIPPA Privacy Policy
Hephzibah Children’s Association (“HCA”) has always highly valued and respected the privacy of the consumers that receive our services. HCA complies with the Health Insurance Portability And Accountability Act of 1996 (“HIPPA”) and its rules, as well as the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) and the HITECH Act Final Rule of 2013 which amended HIPAA.
Due to changes in Federal Regulations and our desire to continue our commitment to your privacy, we are providing you with this Notice of Privacy Practices (“Notice”) regarding your privacy of health information. HCA is required by law to maintain the privacy of your protected health information (“PHI”) and to provide you with a notice of its legal duties and privacy practices. State and federal laws require HCA to: maintain the privacy of your health information; provide you with this Notice about our legal duties and privacy practices and your legal rights pertaining to health information we collect and maintain about you; to notify you following a breach of unsecured protected health information; follow the privacy practices described in this Notice while it is in effect; notify you if we are unable to agree to a requested restriction pertaining to your health information; and accommodate reasonable requests you may have to communicate health information by alternative means or at alternative locations.
Who Will Follow This Notice
This notice describes HCA practices and that of:
- All HCA employees, staff, interns, and other professionals
- All departments and programs of HCA
- Any member of volunteer services who works with you while you are a client of HCA
- Business Associates and Consultants
Our Pledge Regarding Protected Health Information
We understand that PHI about you is personal. We are committed to protecting information about you. We create a record of the services that you receive at HCA. We need this record to provide you with quality care and to comply with certain legal requirements. This Notice will tell you about the ways in which we may use and disclose information about you. We also describe your rights and certain obligations we have regarding the use and disclosure of information.
HCA will, to the best of its ability, work to mitigate the negative effects of any disclosure it makes. HCA will abide by the terms of the Notice currently in effect. HCA reserves the right to change he terms of its Notice and to make the new Notice provisions effective for all PHI we maintain. If we change this notice, the revised Notice will be posted in our facilities, offices, and on our website (www.hephzibahhome.org), or a copy of revised Notice will be sent to you.
How We May Use and Disclose Protected Health Information About You
The following categories describe different ways that we use and disclose information. For each category of uses or disclosures we will explain what we mean and try to give some examples. We use and disclose health information about you for treatment, to obtain payment, for healthcare operations, and for other purposes. For example:
For Treatment:
We may use PHI about you to provide you with mental health treatment or services. Additionally, we may use information about you to develop an effective treatment plan, for purposes of assessment and to enhance all services rendered. We may disclose this information to the persons involved in providing service at HCA, which may include consultants, respite workers, clinicians, childcare workers, interns, supervisors, administrators, foster parents, volunteers, nurses or other HCA personnel who are involved in providing services to you during your involvement with HCA.
We may ask you for authorization to disclose information about you to people outside of HCA who are involved in your treatment, such as, clergy, medical professionals, family members, educators, or others. However, information would be disclosed only with your authorization and only for the purposes that you authorize. For example, a clinician treating a client for depression may need to know if the client is in need or currently taking medication. Therefore, the clinician will need to share information with the client’s doctor (psychiatrist) to coordinate treatment.
For Payment:
We may use and disclose PHI about you so that the treatment and services that you receive at HCA may be billed and collected from you, an insurance company, or a third party. For example, we may need to disclose your PHI about treatment that you received at HCA to your health plan so they can pay us or reimburse you for the treatment.
For Quality Assurance and Utilization Review:
We may use and disclose PHI about you for our health care operations. These uses and disclosures are necessary to run HCA and ensure that all our clients receive quality care. For example, we may use PHI to review our treatment and services and to evaluate the performance of our staff in treating you. We may also combine PHI about many HCA clients to determine what additional services HCA should offer, what services are not needed, and weather new services are affective. Information used in this way is de-identified in order to protect your privacy. We may also disclose information to clinicians, interns, and other HCA personnel for review and learning purposes.
Treatment Options:
We may use and disclose PHI to tell you about or recommend possible treatment options or alternatives that may be of interest to you.
Fundraising Activities:
We may use your demographic information to contact you in an effort to raise funds for the organization. You have a right to opt out of receiving fundraising communications. If you choose not to receive these fundraising communications, we must provide you with a clear and conspicuous opportunity to elect not to receive any further fundraising communications and we may not condition treatment or payment on your choice with respect to the receipt of fundraising communications. We may not make fundraising communications to you if you have elected to opt out of receiving these communications, but we may provide you with a method to opt back in to receive these communications. We would release information about you and services you received at HCA only with your permission. We may use and disclose your PHI to the media only with your authorization.
As Required by Law:
We will disclose PHI about you when required to do so by federal, state, or local law.
To Avert a Serious Threat to Health or Safety:
We may use and disclose PHI about you when necessary to prevent a serious threat to you or another person. Any disclosure would only be to someone able to help prevent the threat.
Workers’ Compensation:
In situations when workers’ compensation pays for services of treatment, we may release PHI about you or workers’ compensation or similar programs. These programs provide benefits for work-related injuries illness.
Public Health Risk:
We may disclose PHI about you for public health activities. These activities generally include the following:
- To prevent or control disease, injury, or disability
- To report child abuse or neglect
- To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition
- To notify the appropriate government authority if we believe a client has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree or when required by law.
Health Oversight Activities:
We may disclose PHI to a health oversight organization for activities required to maintain HCA licensure and certification. These activities include, but are not limited to audits, site visits, and inspections. These activities are necessary to monitor HCA performance and compliance with civil rights and child welfare requirements.
Lawsuits and Disputes:
If you are involved in a lawsuit or a dispute, we may disclose PHI about you in a response to a valid subpoena, or a court or administrative order. We may also disclose PHI about you in response to an order by a court, but only if good faith efforts have been made to notify you of the request and you do not object.
Law Enforcement:
We may release PHI if required to do so by law:
- In response to a court order
- In response to laws that may require that we disclose information, for example, in a
- case where child abuse is indicated
- In response to a governmental agency request, for example, if you make a complaint against us.
Medical Examiners and Funeral Directors:
We may release PHI to a medical examiner or funeral director. This may be necessary to allow a medical examiner or funeral director to identify a deceased person or determine the cause of death, as necessary, to expedite necessary arrangements.
National Security and Intelligence Activities:
We may release PHI about you to authorized federal officials for intelligence, counterintelligence, and other national security activities that are required by law.
To Individuals Involved in Your Care or Payment for Your Care:
During times of treatment, we disclose your PHI only to you, a family member, personal representative, or another person responsible for your care. We may use or disclose your PHI to notify or assist in notifying a family member, personal representative, or another person responsible for your care, regarding your location and general condition.
To Provide You Notice of Breaches of Unsecured PHI:
We may contact you to provide you with any notice of any breach of your unsecured PHI.
Other Uses of Protected Information
Other uses and disclosures of PHI not covered by this Notice or the laws that apply to HCA will be made with only your written permission. For example, a specific authorization will be required for use or disclosure of your PHI. 1) if it involves certain psychotherapy notes, 2) for marketing (except if the communication is face-to-face, or is for a promotional gift of nominal value) or for any marketing that involves financial remuneration; or 3) for any sale of your PHI. In these situations, you may withdraw your authorization at any time and must do so in writing to HCA. Your withdrawal may not be effective in certain situations where we have already taken action in reliance on your authorization.
If you provide HCA with permission to use or disclose PHI about you, you may revoke that permission, in writing, at any time. If you revoke your permission; HCA will no longer use or disclose PHI about you for the reasons covered by your written authorization. You understand that HCA is unable to take back any disclosures that have already been made with your permission, and that HCA is required o retain records of the treatment that has been provided to you.
Your Rights Regarding Your Protected Health Information
Right to Inspect and Copy:
You have the right to inspect and copy PHI that may be used to make decisions about your treatment. This includes billing and case records but does not include clinicians’ personal notes. To inspect and copy PHI, you must submit your request in writing to your primary clinician. If you request a copy of the information, we may charge a fee for costs incurred for copying, mailing, or other work associated with your request. You also have a right to receive an electronic copy of your records, if available. We may deny your request to inspect the copy and PHI in certain very limited circumstances. If you are denied access to PHI, you may request that the denial be reviewed. Another professional chosen by HCA will review your request and the denial. The person conducting the review will not be the person who denied your request and we will comply with the outcome of the review.
Right to Amend:
If you feel that PHI we have about you is incorrect or incomplete, you may ask for the information to be amended. You have the right to request an amendment for as long as the information is kept by you or for HCA. To request an amendment, your request must be made in writing and submitted to the program supervisor. In addition, you must provide a reason that supports your request.
HCA may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, HCA may deny request if you ask for information to be amended that:
- Was not created by HCA
- Is not part of the case record information kept by HCA
- Is not part of the information that you would be permitted to inspect or copy
- Is already accurate and complete
Right to an Accounting of Disclosures:
You have the right to request an “accounting of disclosures.” This is a list of the disclosures HCA made of PHI about you. To request this list or accounting of disclosures, you must submit your request in writing to The Program Supervisor. The time period of your request may not be longer than six years. Your request should indicate in what form you want the list (electronically or paper copy). The first list requested within a 12-month period will be free. For additional lists, HCA may charge you for the costs of providing the list. HCA will notify you of the cost involved and you may choose to withdraw or modify your request at the time before any costs are incurred.
Right to Request Restrictions:
You have the right to request a restriction or limitation on the PHI HCA uses or discloses about you for treatment, payment, or healthcare operations. HCA is not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you with emergency services. If you request, we must agree to restrict disclosures to health plans if you pay out of pocket in full for any service we provide.
If you request, we must agree to restrict disclosures to health plans if you pay out of pocket in full for any service we provide.
To request restrictions, you must make your request in writing to your program supervisor. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit HCA’s use, disclosure or both; (3) to whom you want the limits to apply.
Right to Request Confidential Communications:
You have the right to request that HCA communicates with you about treatment matters in a certain way or at a certain location. For example, you can ask that we can contact you at work or by mail.
To request confidential communications, you must take your request in writing to your program supervisor. HCA will not ask you the reason for your request. HCA will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to a Paper Copy of This Notice:
You have the right to a paper copy of this notice. You may ask HCA to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. To obtain a paper copy of this notice, you may contact The Privacy Officer below or the program supervisor.
Changes to This Notice
HCA reserves the right to change this Notice. HCA reserves the right to make the revised or changed Notice effective for PHI that HCA already has about you, as well as any information HCA receives in the future. HCA will post a copy of the current Notice in all HCA sites with the effective date noted in the top right-hand corner. In addition, at your first intake appointment, HCA will offer you a copy of the current Notice in effect.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with HCA or with the Secretary of the U.S. Department of Health and Human Services (“DHHS”). All complaints must be submitted in writing. To file a complaint with HCA, contact the Privacy Officer at:
Hephzibah Children’s Association
1144 Lake Street Fifth Floor
Oak Park, IL 60301
708.649.7140 ext. 7081
You may also file a compliant with DHHS, Office for Civil Rights by sending a letter to:
200 Independence Avenue, S.W.
Washington, D.C. 20201
We support your right to protect the privacy of your medical information. You will not face any retaliation if you file a complaint.