HIPAA Privacy Notice

NOTICE OF PRIVACY PRACTICES

GRAND LAKE MENTAL HEALTH CENTER, INC.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

Grand Lake Mental Health Center, Inc. (“GLMHC”), its professional and health care support personnel, and its network of community mental health clinics are part of a clinically integrated care setting that functions as an organized health care arrangement under HIPAA. This arrangement involves the participation of legally separate entities, including independent contractors, in providing health care to GLMHC clients, but it does not make any one entity responsible for the professional judgment or patient care provided by another participating entity. All of these participating entities, along with all GLMHC employees and contract personnel, have agreed to abide by this Notice of Privacy Practices (“NPP”) while working in GLMHC facilities.

GLMHC creates a record of the care and services you receive in GLMHC facilities. Your medical records and billing information are created and retained on a computer system that includes Electronic Health Records. That system is accessible to authorized GLMHC employees and contract personnel, and these persons are able to access and use your Protected Health Information to carry out treatment, payment, and administrative operations. GLMHC uses administrative and technical safeguards, such as personnel training, written policies, password protection, and document encryption, to prevent improper access or use of information maintained on our computer system. We are required by law to protect your privacy and the confidentiality of your Protected Health Information, to provide you with notice of our legal duties and privacy practices, and to notify you in the event of any breach of unsecured Protected Health Information about you. This NPP describes your rights and our legal duties regarding your Protected Health Information.

Definitions: From time to time, you may see or hear certain terms that relate to this NPP. Some of the terms you are likely to see or hear are defined below:

  • Protected Health Information or PHI. PHI is individually identifiable information that relates to your medical condition(s), your treatment, and/or payments for your care, and is sent, received, or maintained electronically or in another format, such as a paper record. GLMHC uses your PHI to provide your treatment, to bill for the services we provide, and to carry out healthcare operations, such as quality assurance reviews.
  • Privacy Officer. The GLMHC Privacy Officer is the person responsible for developing and implementing all GLMHC policies concerning client privacy and PHI. The Privacy Officer is also responsible for receiving and investigating any concerns or complaints you may have about the use or disclosure of your PHI. Any GLMHC staff member can help you contact the Privacy Officer from any GLMHC facility, or you can call the main GLMHC telephone number and ask to be connected to the Privacy Officer. Your treatment will not be negatively affected, and you will not be retaliated against for expressing a concern or making a complaint to the Privacy Officer.
  • Business Associate. This an individual or business that is separate from GLMHC, but that works with GLMHC to carry out certain duties related to health care services, payment activities, and hospital operations. For example, if GLMHC used an outside company to file patients’ insurance claims, that company would be a Business Associate. Business Associates who have access to your PHI have a legal obligation to protect it from improper use or disclosure.
  • Authorization. We will obtain your authorization any time it is required to give GLMHC permission to use or disclose your PHI for purposes other than your treatment, payment of your bills, and/or conducting operations of GLMHC and its organized health care arrangement.
  • Health Information Exchange. GLMHC may participate in the exchange of electronic health information with other health care providers and health plans in the State of Oklahoma through an approved health information exchange organization. If GLMHC does participate, your electronic health records will be accessible through the exchange to properly authorized users, who will use the information for treatment, payment, and health care operations purposes, unless you direct otherwise.

TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS

GLMHC may use and disclose your PHI, without your authorization, for the following treatment, payment, and health care operations purposes:

  • Treatment. GLMHC and its professional staff may use your PHI to provide you with medical treatment or services. We may disclose your PHI to doctors, nurses, clinicians, or other GLMHC personnel who are involved in your care. For example, a doctor prescribing medicine for you would need to know other medications that you are taking and the reason for taking these medicines to help prevent any medication interaction problems. Different areas of GLMHC also may share medical information about you in order to coordinate the different things you need, such as lab work, prescriptions and other testing. This would also include the sharing of information among students of a professional training program that GLMHC may sponsor. Information may also be shared for purposes of treatment and follow-up with the Department of Mental Health and Substance Abuse and their contractors if your services are being paid for by DMHSAS.
  • Payment. We may use and disclose your PHI so that the treatment and services you receive at GLMHC may be billed to and payment may be collected from you, an insurance company, or a third party. For example, we may need to give your health plan information services you received at GLMHC so that your health plan will pay us or reimburse you those services. We may also tell your health plan about services you are going to receive to obtain prior authorization or to determine whether your plan will cover those services.
  • Health Care Operations. We may use and disclose your PHI for GLMHCs health care operations. These uses and disclosures are necessary to manage GLMHC and to make sure that all of our clients receive quality care. For example, we may use your PHI to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also combine the PHI of many GLMHC clients to decide what additional services GLMHC should offer, what services are not needed, and whether certain new treatments are effective. We may also combine the PHI of our patients with the PHI of patients from other similar facilities to compare our services with those at other facilities and to see what improvements we can make in the services we offer. For example, may combine the PHI of GLMHC clients participating in group therapy to compare it with the PHI of other facilities’ clients in group therapy, so that we can compare our performance with other facilities and make improvements in the care and services that we provide to our clients. Your identifying information will be removed from any PHI data set before it is combined or compared with PHI from other facilities, so that it may be used to study health care and health care delivery without identifying any specific client.
  • Business Associates. We may disclose your PHI to Business Associates with whom we contract to provide certain services or business operations on our behalf. However, we will only make these disclosures if we have received written assurance that the Business Associate and any subcontractors it may use will properly safeguard your privacy and the confidentiality of your PHI. For example, we may contract with a company outside of GLMHC to provide medical billing services for GLMHC.

PHI DISCLOSURES NEEDING YOUR CONSENT OR PERMITTING YOUR OBJECTION

  • Appointment Reminders. We may use and disclose your PHI to contact you as a reminder that you have an appointment for services at GLMHC. This may be done by an automated system or by one of our staff members. If you are not at home, we may leave this information on your answering machine or in a message left with the person answering the telephone. You have the right to stop appointment reminders by notifying us of your decision in writing.
  • Health Related Benefits and Services. We may use and disclose your PHI to tell you about health-related benefits or services or to recommend possible treatment options or alternatives that may be of interest to you. You may notify us in writing if you wish to restrict the manner in which we tell you about such benefits or services, for example, if you do not want to be contacted at home, or if you prefer to be contacted by mail.
  • Fundraising Activities of GLMHC. We may use or disclose your PHI to contact you in an effort to raise money for GLMHC and its operations. This type of use or disclosure would be limited to your contact information, such as your name, address, and phone number. If you do not want GLMHC to contact you for fundraising efforts, please notify the Privacy Officer.
  • Individuals Involved in Your Care or Payment for Your Care. We may disclose to a family member, close friend, or other individual you identify, the PHI that is directly relevant to that person’s involvement in your health care and/or payment for your health care. For example, we may go over your appointment schedule with the person(s) who will be driving you to appointments at GLMHC. You may object to these disclosures by notifying GLMHC personnel or the GLMHC Privacy Officer. We may also give PHI to someone who helps pay for your care.
  • Disaster Relief; Disclosure after Death. We may use or disclose your PHI to an entity that is authorized to assist in a disaster relief effort, so that your family, or another individual you identify, can be notified about your condition, status and location. We may also disclose relevant PHI to persons who were involved in your care or payment for your care, following your death. You may object to these disclosures by notifying a GLMHC staff member or contacting the Privacy Officer.

DISCLOSURES THAT MAY OR MAY NOT REQUIRE YOUR CONSENT

  • Research. Under certain circumstances, GLMHC may use and disclose your PHI for research purposes. For example, a research project may involve comparing the long-term health of all patients who received one medication to those who received another, for the same condition. All research projects, however, are subject to a special approval process. This process evaluates a proposed research project and its use of PHI, trying to balance the researchers’ needs with clients’ need for privacy of their PHI. Before we use or disclose medical information for research, the project will have been approved through this approval process. We may disclose, however, PHI about you to people preparing to conduct a research project, for example, to help identify clients with specific health care needs or conditions, so long as the PHI they review does not leave GLMHC’s facilities. We will generally ask for your specific permission if the researcher will have access to your name, address, or other information that reveals who you are, or will be involved in your care at GLMHC. If we participate in a research project, you may contact the Privacy Officer to obtain additional information about our research approval policy and process.
  • As Required by Law. We will disclose PHI about you when required to do so by federal, state, or local law. For example, Oklahoma law requires GLMHC to disclose records and information containing PHI to individuals and agencies that have contracts with the Oklahoma Department of Mental Health and Substance Abuse Services. These types of disclosures are made only when necessary and appropriate, and the disclosed PHI is limited to the minimum amount necessary.
  • To Avert a Serious Threat to Health or Safety. GLMHC and its staff may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure would only be made to persons or entities who would be reasonably able to prevent or lessen the threat, such as a police officer or an outside health care professional.
  • Organ and Tissue Donations. If you are an organ donor, we may release your PHI to organizations that handle procurement or organ, eye, or tissue transplantation, or to an organ donation bank, in order to facilitate organ or tissue donation and transplantation; however, any PHI released will not state whether you have or had a history of alcohol or substance abuse.
  • Military. If you are a member of the armed forces, GLMHC and its staff may release your PHI as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority.
  • Workers Compensation. We may release PHI about you for workers’ compensation or similar programs as authorized by state laws. These programs provide benefits for work-related injuries and illnesses.
  • Public Health Risks. We may disclose PHI about you for public health activities, such as:
    • preventing or controlling disease, injury, or disability;
    • Reporting births and deaths;
    • Reporting child abuse or neglect;
    • Reporting reactions to medications or problems with products;
    • Notifying people of recalls of products they may be using;
    • Notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition as ordered by public health authorities; and
    • Notifying the appropriate government authority if we believe a client has been the victim of abuse, neglect, or domestic violence, if you agree or as required by law.
  • Health Oversight Activities. GLMHC may disclose PHI to a health oversight agency for activities necessary for the government to monitor the health care system, government programs, and compliance with applicable laws. These oversight activities include, for example, audits, investigations, inspections, and licensure.
  • Accrediting Organizations. We may disclose PHI to an organization that GLMHC has contracted with for purposes of accreditation, such as CARF, the Joint Commission, the Department of Mental Health, and/or the Oklahoma Health Care Authority.
  • Lawsuits and Disputes. If you are involved in a lawsuit or dispute, we may disclose PHI about you in response to a valid court order, or upon receipt of a valid written authorization.
  • Law Enforcement. We may release your PHI if asked to do so by a law enforcement official:
    • In response to a court order, warrant, summons, or similar process;
    • To identify or locate a suspect, fugitive, material witness, or missing person;
    • About the victim of a crime if, under certain limited circumstances, we are unable to obtain the persons agreement;
    • About a death that we believe may have been the result of criminal conduct;
    • About criminal conduct at a GLMHC facility; or
    • In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description, or location of the person who committed the crime.
  • Coroners, Medical Examiners, and Funeral Directors. We may release PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release PHI about GLMHC clients to funeral directors as necessary to carry out their duties.
  • National Security and Intelligence Activities. We may release PHI about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
  • Protective Services for the President and Others. We may disclose PHI about you to authorized federal officials so they may provide protection to the President, other authorized persons, or foreign heads of state, or conduct special investigations.
  • Inmates. If you become an inmate of a correctional institution or come into the custody of a law enforcement official, we may release PHI about you to the correctional institution or law enforcement official, when necessary (a) for you to receive appropriate health care; (b) to protect your health and safety or the health and safety of others; or (c) for the safety and security of the correctional institution and law enforcement personnel.

YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

You have the following rights regarding the PHI we maintain about you:

  • Right to Inspect and Copy. You have the right to inspect and request a copy of your PHI maintained in the “designated record set,” except as prohibited by law. The “designated record set” is the PHI in your medical and billing records used to make decisions about your care and payment for your care, as determined by GLMHC. You also have the right to authorize third parties (such as a family member) to obtain your PHI.

To inspect and/or request a copy of your PHI in the designated record set, you must submit your request in writing on an approved Authorization form. You may obtain an Authorization form by contacting the Privacy Officer. If you request a copy of your PHI, we may charge a reasonable fee to offset the costs associated with your request, such as labor, postage, etc. This fee would be at the Oklahoma statutory rate, plus postage if applicable. You will be advised of any fees at the time you make your request.

We may deny your request to inspect and copy in certain circumstances. If you are denied access to certain PHI, you may request that the denial be reviewed. Your request and the denial will be reviewed by the Clinical Director or by another licensed health care professional chosen by GLMHC. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

  • Right to Amend. If you feel that PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for GLMHC. To request an amendment, your request must be made in a writing that states the reason for the request. Requests for amendments should be submitted to the Clinical Director for GLMHC, 114 West Delaware, Nowata, OK 74048.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

  • was not created by GLMHC, unless the person or entity that created the information is no longer available to make the amendment;
  • is not part of the PHI kept by or for GLMHC;
  • is not part of the information which you would be permitted to inspect and copy; or
  • is accurate and complete.
  • Right to an Accounting of Disclosures. You have the right to request an accounting, or list, of certain disclosures we have made of your PHI. You are entitled to one free accounting every 12 months. We may charge you a reasonable fee for providing an accounting of disclosures more often than every 12 months. We will notify you of any costs involved when we receive your request, and you may choose to modify or withdraw your request before any charges are incurred.

To request an accounting of disclosures, you must submit your request in writing to the Privacy Officer for GLMHC. Your request must state a time period of no more than six years that does not include dates before April 14, 2003.

An accounting, or list, of disclosures does not include disclosures made:

  • To carry out treatment, payment, or healthcare operations;
  • To you, of your own PHI;
  • Incident to a use or disclosure permitted by law;
  • Pursuant to your signed Authorization;
  • For national security or intelligence purposes;
  • To correctional institutions or law enforcement officials;
  • As part of a limited data set not including your individually identifiable information; or
  • That occurred more than 6 years prior to your request.
  • Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or in the payment for your care, such as a family member or friend. For example, you could ask that we not use or disclose information about a medication you are taking.

In certain circumstances, we are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment. To request restrictions, you must make your request in writing to the Privacy Officer for GLMHC. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the restriction to apply.

  • Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted. For example, if request that we only contact you at work, you must provide us with your work contact information.

  • Right to a Paper Copy of This NPP. You have the right to a paper copy of this NPP. You may ask us to give you a copy of this NPP at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice.

To obtain a paper copy of this notice, please contact the Administrative Office of any GLMHC facility.

CHANGES TO THIS NPP

We reserve the right to make changes to this NPP. We reserve the right to make the revised or changed NPP effective for PHI we already have about you as well as any PHI we create or receive in the future. We will post a copy of the current NPP in each GLMHC facility and on our website. The effective date of the NPP will be on the first page, near the top. In addition, each time you register at a GLMHC facility for treatment or health care services we will offer you a copy of the current NPP. We have a legal duty to abide by the NPP currently in effect.

AUTHORIZATION FOR OTHER USES OF YOUR PHI

Other uses and disclosures of PHI that are not covered by this NPP or by the laws that apply to GLMHC will be made only with your written Authorization. If you provide us Authorization to use or disclose your PHI, you may revoke that Authorization, in writing, at any time. If you revoke your Authorization, we will no longer use or disclose PHI about you for the reasons covered by your written Authorization. You understand that we are unable to take back any disclosures we have already made with your Authorization, and that we are required to retain our records of the care that we provided to you.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a written complaint with the GLMHC Privacy Officer or the Secretary of the Department of Health and Human Services and/or the Office of Civil Rights, DHHS.

To file a written complaint with GLMHC, write to, Privacy Officer for GLMHC, 114 West Delaware, Nowata, OK 74048.

You will not be penalized or retaliated against for filing a complaint with GLMHC or with the Office for Civil Rights/DHHS

SPECIAL NOTICE REGARDING CONFIDENTIALITY OF 
ALCOHOL AND DRUG ABUSE TREATMENT RECORDS

The confidentiality of any alcohol or drug abuse treatment records maintained by GLMHC is protected by federal laws and regulations. Generally, GLMHC may not disclose that a client is, or has been, in an alcohol or drug abuse treatment program, or disclose any information identifying a client as an alcohol or drug abuser, UNLESS:

  • The client consents in writing;
  • The disclosure is allowed by a court order; or
  • The disclosure is made to medical personnel in a medical emergency or to authorized persons for research, audit, or program evaluation purposes.

Violation of these federal laws and regulations by a program is a crime. Suspected violations may be reported to appropriate local authorities or to the U.S. Attorney’s Office.

Federal laws and regulations do not protect any information about a crime committed by a client either at the program or against any person who works for the program, or about any threat to commit such a crime.

Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities.

[See, 42 U.S.C. §290dd-3 and 42 U.S.C. §290ee-3 for federal laws and 42 C.F.R. Part 2 for federal regulations.]