Our Commitment and Legal Duties

At CHILD & FAMILY SERVICES, INC., we are committed to protecting your privacy. This Notice explains how we safeguard your health information, how we may use or share it, and what rights you have under the HIPAA Privacy Rule and the federal confidentiality rules for substance use disorder (SUD) patient records at 42 CFR Part 2.

We are required by law to maintain the privacy of your health information, provide you with this Notice of our legal duties and privacy practices, and follow the terms of the Notice currently in effect. We must notify affected individuals following a breach of unsecured records.

We reserve the right to change the terms of this Notice and to make the revised Notice effective for records we maintain. If we revise this Notice, we will make the revised Notice available upon request and by the following methods: [e.g., posted on our website; available at reception; provided at the next visit; available electronically upon request].

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION (HIPAA)

We may use or disclose your protected health information (PHI) for the following purposes without your written authorization, as permitted by HIPAA.

1) Treatment

We may use or disclose your PHI to provide, coordinate, or manage your health care and related services. Example: We may share information with doctors, nurses, therapists, hospitals, pharmacies, or other providers involved in your care.

2) Payment

We may use or disclose your PHI to bill for services and receive payment. Example: We may provide information to your health plan to determine eligibility, coverage, or to process claims.

3) Health Care Operations

We may use or disclose your PHI for health care operations, such as quality assessment and improvement, training, credentialing, licensing, auditing, accreditation, and compliance. Example: We may use information to review the quality of services we provide or to train staff. 

OTHER USES AND DISCLOSURES PERMITTED OR REQUIRED BY LAW (HIPAA)

We may use or disclose PHI as permitted or required by law, including:

• Public Health Activities (e.g., reporting communicable diseases; reporting births and deaths; reporting adverse reactions to medications/devices; product recalls; exposure notification).
• Health Oversight Activities (e.g., audits, investigations, inspections, and licensure activities).
• Legal Requirements (e.g., as required by law; court orders and certain subpoenas; mandatory reporting of abuse, neglect, or domestic violence; workers’ compensation; medical examiners/coroners; certain law enforcement purposes; to avert a serious threat).
• To Prevent or Reduce a Serious Threat to health or safety, consistent with applicable law.
• To Family, Friends, or Caregivers involved in your care or payment for your care, if you agree, do not object when given the opportunity, or as otherwise permitted by law.
• Appointment Reminders and Health-Related Services (e.g., reminders, follow-up care, treatment alternatives, or other health-related benefits/services).

SPECIAL PROTECTIONS FOR SUD RECORDS — 42 CFR PART 2 (Part 2 Program Notice)

SUD patient records maintained by a Part 2 Program are protected by federal law. In general, we will not use or disclose your Part 2 SUD records unless you provide written consent or an exception under Part 2 applies.

Uses and Disclosures of Part 2 Records Without Your Written Consent

Part 2 permits or requires certain uses or disclosures without your written consent, including (as applicable):

• Medical Emergencies
• Scientific Research (with required safeguards)
• Audits and Program Evaluation
• Court Orders (as permitted by Part 2)
• Reporting Child Abuse and Neglect, as permitted by federal law

If a use or disclosure described in this Notice is prohibited or materially limited by other applicable law (including more protective state law), we will follow the more stringent law.

Uses and Disclosures of Part 2 Records With Your Written Consent (Including “Single Consent” for TPO)

You may provide a single written consent for all future uses and disclosures of your Part 2 records for Treatment, Payment, and Health Care Operations (TPO).

If you sign a valid Part 2 consent for TPO, we may use and disclose your Part 2 records for TPO activities as described in this Notice. 

Examples of Disclosures That Generally Require Your Written Consent

Examples include: sharing your Part 2 records with a provider or organization not otherwise permitted under an exception; sharing with an employer, school, housing provider, or attorney at your request; or sharing with a family member who is not involved in your care or payment (or when you object).

Uses/Disclosures Not Described in This Notice

We will make uses and disclosures of your Part 2 records not described in this Notice only with your written consent, unless otherwise permitted by Part 2.

Revoking Your Part 2 Consent

You may revoke your written Part 2 consent as provided by 42 CFR §§ 2.31 and 2.35 by submitting a written revocation, except to the extent that we have already acted in reliance on your consent.

Redisclosure / Further Disclosure of Part 2 Records

Records disclosed with your Part 2 written consent remain protected by federal confidentiality rules. Further use or disclosure is permitted only as allowed by 42 CFR Part 2 and, when applicable, HIPAA.

Records disclosed to a Part 2 program, HIPAA covered entity, or business associate pursuant to your written consent for TPO may be further disclosed by that recipient, without your written consent, to the extent permitted by HIPAA.

Prohibition on Use in Proceedings Against You (Part 2 Protection)

In no event will we use or disclose your Part 2 records, or testimony relaying the content of such records, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against you, unless authorized by your specific written consent or the order of a court after it provides notice (and an opportunity to be heard where required). A court order authorizing such use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the record is used or disclosed.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

Your HIPAA Rights

You have the following rights regarding your PHI (subject to certain exceptions):

1. Right to Access: You may request a paper or electronic copy of your PHI. We will generally provide access within 30 days and may charge a reasonable, cost-based fee as permitted by law.
2. Right to Request Confidential Communications: You may ask us to contact you in a specific way (e.g., at a different address or phone number).
3. Right to Request Restrictions: You may request limits on how we use or share your PHI. We are not required to agree to most restrictions, but we must comply with a request not to disclose information to a health plan about a service you paid for in full out-of-pocket when required by law.
4. Right to Request an Amendment: If you believe your PHI is incorrect or incomplete, you may request an amendment. We may deny the request under certain circumstances and will provide a written explanation consistent with applicable law.
5. Right to an Accounting of Disclosures: You may request an accounting of certain disclosures of your PHI as permitted by law.
6. Right to Choose a Personal Representative: If someone has legal authority to act for you (e.g., guardian or health care power of attorney), we will treat that person as your personal representative as permitted by law.
7. Right to Receive a Copy of This Notice: You have the right to receive a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Additional Rights for Part 2 Records

In addition to the rights above, Part 2 provides specific rights regarding Part 2 records:

• Right to Request Restrictions on Disclosures Based on Prior Consent (TPO): You may request restrictions on disclosures that would otherwise be made based on your prior consent for TPO, as permitted by Part 2.
• Right to Request and Obtain Restrictions to Your Health Plan When Paid in Full: You have the right to request restrictions on disclosures to your health plan for services for which you paid in full, consistent with applicable law.
• Right to an Accounting of Disclosures of Part 2 Electronic Records (Past 3 Years): You may request an accounting of disclosures of Part 2 electronic records for the past 3 years, as provided by Part 2.
• Right to a List of Disclosures by an Intermediary (Past 3 Years): You may request a list of disclosures made by an intermediary for the past 3 years, as provided by Part 2.
• Right to Discuss This Notice: You have the right to discuss this Notice with our designated contact listed below.
• Right to Elect Not to Receive Fundraising Communications: You have the right to opt out of receiving fundraising communications (see “Fundraising” below).

Uses and Disclosures Requiring Written Authorization (HIPAA/Part 2)

Certain uses and disclosures of your PHI require your written authorization. If we seek your authorization, you may revoke it in writing at any time, except to the extent we have already acted based on it.

OUR RESPONSIBILITIES

We are required to:

• Maintain the privacy and security of your health information;
• Provide you with this Notice of our legal duties and privacy practices;
• Notify you following a breach of unsecured records as required by law;
• Follow the terms of this Notice currently in effect.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with:

CHILD & FAMILY SERVICES, INC.

Privacy Officer
Phone: 508-742-3882

You may also file a complaint with the U.S. Department of Health and Human Services (the Secretary).
We will not retaliate against you for filing a complaint.

CONTACT INFORMATION

YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT FURTHER

If you have questions about this Notice or your rights, contact:

CHILD & FAMILY SERVICES, INC.

Privacy Officer
Phone: (508) 742-3882