Source: https://www.communitymissions.org/privacy-practices
Timestamp: 2017-05-28 02:53:49
Document Index: 83042025

Matched Legal Cases: ['§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 18', '§ 164', '§ 18', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164']

Community Missions' Privacy Practices Call for Help
To download these practices as a printable PDF, please click here. COMMUNITY MISSIONS OF NIAGARA FRONTIER
NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. We
are required by law to protect the privacy of health information that may
reveal your identity, and to provide you with a copy of this notice which
describes the health information privacy practices of our residential program
staff and affiliated health care providers that jointly provide health care
services with our residential program. We
are also required to notify you following a breach of unsecured health
information. A copy of our current Notice
of Privacy Practices will always be posted in our reception area. You or your personal representative may also
obtain a copy of this notice by accessing our website at www.communitymissions.org
or requesting a copy from our residential program staff.
or would like further information, please contact the Privacy Officer at (716)285-3403
ext. 2243. WHO WILL
FOLLOW THIS NOTICE?
Missions Residential programs provide health care to residents jointly with
physicians and other health care professionals and organizations. The privacy practices described in this
notice will be followed by:[1]
· Any health care professional or other treatment
provider who treats you at any of our locations;
· All employees, health care professionals,
trainees, students or volunteers at any of our locations;
trainees, students or volunteers at Community Missions, Inc.;
· Any business associates of our residential
program (which are described further below).
DESCRIBED IN THIS NOTICE
notice will explain the different types of permission we will obtain from you
before we use or disclose your health information for a variety of
purposes. The three types of permissions
referred to in this notice are:
· A "general written consent," which we must
obtain from you in order to use and disclose your health information in order
to treat or care for you, obtain payment for that treatment or care, and
conduct our business operations. We must
obtain this general written consent the first time we provide you with
treatment or care. This general written
consent is a broad permission that does not have to be repeated each time we
provide treatment or care to you.
· An "opportunity to object," which we must
provide to you before we may use or disclose your health information for
certain purposes. In these situations,
you will have an opportunity to object to the use or disclosure of your health
information in person, over the phone, or in writing.
· A "written authorization," which will provide
you with detailed information about the persons who may receive your health
information and the specific purposes for which your health information may be
used or disclosed. We are only permitted
to use and disclose your health information described on the written
authorization in ways that are explained on the written authorization form you
have signed. A written authorization
will have an expiration date.
Requirement For Written Authorization. We will generally obtain your written
authorization before using your health information or sharing it with others
outside the residential program, including any use or disclosure, with certain
exceptions, of psychotherapy notes, for marketing purposes or involving the
sale of your protected health information. Except as described in this Notice, uses and disclosures will be made
with your written authorization. You may
also initiate the transfer of your records to another person by completing a
written authorization form. If you
provide us with written authorization, you may revoke that written
authorization at any time, except to the extent that we have already relied
upon it. To revoke an authorization,
please write to [insert name of responsible person or department]. Exceptions To Written Authorization
Requirement. There are some
situations when we do not need your written authorization before using your
health information or sharing it with others. They are:
Exception For Treatment, Payment, And Business Operations. We will only obtain your general written
consent one time to use and disclose your health information to
treat or care for your condition, collect payment for that treatment or
care, or run our business operations.[2] In some cases, we also may disclose your
health information to another health care provider or payor for its
payment activities and certain of its business operations. For more information, see pages 5-6 of
Exception For Directory Information And Disclosure To Family And
Friends Involved In Your Care. We will ask you whether you have any objection to including
information about you in our Facility Directory or sharing information
about your health with your friends and family involved in your care. For more information, see page 6-7 of
Exception In Emergencies Or Public Need. We may use or disclose your health
information in an emergency or for important public needs. For example, we may share your
information with public health officials at the New York state or city health
departments who are authorized to investigate and control the spread of
diseases. For more examples, see
pages 7-9 of this notice.
Exception If Information Is Completely Or Partially De-Identified. We may use or disclose your health
information if we have removed any information that might identify you so
that the health information is "completely de-identified." We may also use and disclose "partially
de-identified" information if the person who will receive the information
agrees in writing to protect the privacy of the information. For more information, please see pages
9-10 of this notice.
How To Access Your Health Information. You generally have the right to inspect and
copy your health information. For more
information, please see page 10 of this notice.
How To Correct Your Health Information. You have the right to request that we amend
your health information if you believe it is inaccurate or incomplete. For more information, please see page 11 of
How To Identify Others Who Have Received
Your Health Information. You have
the right to receive an "accounting of disclosures" which identifies certain
persons or organizations to whom we have disclosed your health information in
accordance with the protections described in this Notice of Privacy
Practices. Many routine disclosures we
make will not be included in this accounting, but the accounting will identify
many non-routine disclosures of your information. For more information, please see
pages 11-12 of this notice.
How To Request Additional Privacy
Protections. You have the right to
request further restrictions on the way we use your health information or share
it with others. We are generally not
required to agree to the restriction you request, but if we do, we will be
bound by our agreement. For more
information, please see page 12 of this notice.
How To Request More Confidential
Communications. You have the right
to request that we contact you in a way that is more confidential for you. We will try to accommodate all reasonable
requests. For more information, please
see page 12 of this notice.
How Someone May Act On Your Behalf. You have the right to name a personal
representative who may act on your behalf to control the privacy of your health
information. Parents and guardians will
generally have the right to control the privacy of health information about
minors unless the minors are permitted by law to act on their own behalf.
How To Learn About Special Protections For
HIV, Alcohol and Substance Abuse, Mental Health And Genetic Information. Special privacy protections apply to
HIV-related information, alcohol and substance abuse treatment information,
mental health information, and genetic information. Some parts of this general Notice of Privacy
Practices may not apply to these types of information. If your treatment involves this information,
you will be provided with separate notices explaining how the information will
be protected. To request copies of these
other notices now, please contact Joseph Sbarbati, Associate Director/Privacy
Officer at 716-285-3403 ext. 2243.
How To Obtain A Copy Of This Notice. You have the right to a paper copy of this
notice. You may request a paper copy at
any time, even if you have previously agreed to receive this notice electronically. To do so, please call Cassandra Brandon,
Quality Assurance/Human Resources Analyst at 716-285-3403 ext. 2270. You or your personal representative may also
obtain a copy of this notice from our website at www.communitymissions.org, or
by requesting a copy from our residential program staff.
How To Obtain A Copy Of Revised Notice. We may change our privacy practices from time
to time. If we do, we will revise this
notice so you will have an accurate summary of our practices. The revised notice will apply to all of your
health information. We will post any
revised notice in our residential program reception area. You or your personal representative will also
be able to obtain your own copy of the revised notice by accessing our website
at www.communitymissions.org or requesting a copy from our residential program
staff.[3] The effective date of the notice will always
be noted in the top right corner of the first page. We are required to abide by the terms of the
notice that is currently in effect.
How To File A Complaint. If
you believe your privacy rights have been violated, you may file a complaint
with us or with the Secretary of the Department of Health and Human Services
(HHS). To file a complaint with HHS, you
may contact them at 200 Independence
Avenue, SW, Washington, D.C. 20201,
or at 1-877-696-6775. In addition, the
Federal Relay Service can be contacted at 1-800-877-8339. To file a complaint with
us, please contact Joseph Sbarbati, Associate Director/Privacy Officer at
716-285-3403 ext. 2243. No one will retaliate or take action against
you for filing a complaint.
are committed to protecting the privacy of information we gather about you
while providing health-related services. Some examples of protected health information are: · information indicating that you are a resident
at the residential program or receiving treatment or other health-related
services from our residential program;
· information about your health condition (such as
a psychiatric diagnosis you may have received);
· information about health care products or
services you have received or may receive in the future; · information about rehabilitation or other
counseling that you may be receiving; · information about benefits you may receive under
· information about your health care benefits
under an insurance plan (such as whether a prescription is covered);
· demographic information (such as your name,
address, or insurance status); · unique numbers that may identify you (such as
your social security number, your phone number, or your driver's license
number); and · other types of information that may identify who
HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION 1. Treatment, Payment And Business
With your general written consent,[5]
we may use your health information or share it with others in order to provide
you with treatment or care, obtain payment for that treatment or care, and run
our business operations. In some cases,
we may also disclose your health information for payment activities and certain
business operations of another health care provider or payor. Below are further examples of how your
information may be used and disclosed for these purposes.
Treatment.[6] We may share your health information with
counselors and other treatment providers at the residential program who are
involved in taking care of you, and they may in turn use that information to
diagnose or treat you. A treatment
provider at our residential program may share your health information with
another treatment provider inside our residential program, or with a treatment
provider at another health care facility, to determine how to diagnose or treat
you. Your treatment provider may also
share your health information with another treatment provider to whom you have
been referred for further health care.
Payment.[7] We may use your health information or share
it with others so that we may obtain payment for your health care
services. For example, we may share
information about you with Medicare, Medicaid, or your health insurance company
in order to obtain reimbursement for treatment or care we have provided to you,
or to determine whether it will cover your future treatment or care. Finally, we may share your information with
other providers and payors for their payment activities.
Business Operations.[8] We may use your health information or share
it with others in order to conduct our business operations. For example, we may use your health information
to evaluate the performance of our staff in caring for you, or to educate our
staff on how to improve the care they provide for you. Finally, we may share your health information
with other health care providers and payors for certain of their business
operations if the information is related to a relationship the provider or
payor currently has or previously had with you, and if the provider or payor is
required by federal law to protect the privacy of your health information.
Treatment Alternatives, Benefits And
Services.[9] In the course of providing treatment to you,
we may use your health information to contact you in order to recommend
possible treatment alternatives or health-related benefits and services that
may be of interest to you.[10]
Fundraising.[11] To support our business operations, we may
use demographic information about you, including information about your age and
gender, when deciding whether to contact you or your personal representative to
raise money to help us operate. We may
also share this information with a charitable foundation that will contact you
or your personal representative to raise money on our behalf. You have a right to opt out of receiving such
Business Associates.[12] We may disclose your health information to
contractors, agents and other business associates who need the information in
order to assist us with obtaining payment or carrying out our business
operations. For example, we may share
your health information with a billing company that helps us to obtain payment
from Medicaid or your insurance company. Another example is that we may share your health information with an
accounting firm or law firm that provides professional advice to us about how
to improve our health care services and comply with the law. If we do disclose your health information to
a business associate, we will have a written contract to ensure that our
business associate also protects the privacy of your health information.
We can do all of these things if you have
signed a general written consent form. Once you sign this general written consent form, it will be in effect
indefinitely until you revoke your general written consent. You may revoke your general written consent
at any time, except to the extent that we have already relied upon it. For example, if we provide you with treatment
or care before you revoke your general written consent, we may still share your
health information with your insurance company in order to obtain payment for
that treatment or care. To revoke your
general written consent, please write to Cassandra Brandon, Quality
Assurance/Human Resources Analyst at 1570 Buffalo Avenue, Niagara Falls, NY
2. Facility Directory/Family And Friends[13]
We may use your health information in, and
disclose it from, our Facility Directory, or share it with family and friends
involved in your care, without your written authorization. We will always give you an opportunity to
object unless you are incapacitated when you first arrive at the residential
program (in which case we will discuss your preferences with you as soon as you
regain capacity).[14] We will follow your wishes unless we are
required by law to do otherwise.
Facility Directory.[15] If you do not object, we will include [your
name, your location in our facility and your religious affiliation][16]
in our Facility Directory while you are a resident in the residential
program. This directory information,
except for your religious affiliation, may be released to people who ask for
you by name. Your religious affiliation
may be given to a member of the clergy, such as a priest or rabbi, even if he
or she doesn't ask for you by name.
Family And Friends Involved In Your Care.[17] If you do not object, we may share your
health information with a family member, relative, or close personal friend who
is involved in your care or payment for that care. We may also notify a family member, personal
representative or another person responsible for your care about your location
and general condition here at the residential program, or about the unfortunate
event of your death. In some cases, we
may need to share your information with a disaster relief organization that
will help us notify these persons.
3. Emergencies Or Public Need[18]
We may use your health information, and
share it with others, in order to treat you in an emergency or to meet
important public needs.[19] We will not be required to obtain your
general written consent before using or disclosing your information for these
reasons. We will, however, obtain your
written authorization for, or provide you with an opportunity to object to, the
use and disclosure of your health information in these situations when state law
specifically requires that we do so.[20]
Emergencies.[21] We may use or disclose your health
information if you need emergency treatment or if we are required by law to
treat you but are unable to obtain your general written consent. If this happens, we will try to obtain your
consent as soon as we reasonably can after we treat you.[22]
Communication Barriers.[23] We may use and disclose your health
information if we are unable to obtain your consent because of substantial
communication barriers, and we believe you would want us to treat you if we
could communicate with you.[24]
As Required By Law.[25] We may use or disclose your health
information if we are required by law to do so. We also will notify you of these uses and disclosures if notice is
Public Health Activities.[26] We may disclose your health information to
authorized public health officials (or a foreign government agency
collaborating with such officials) so they may carry out their public health
activities. For example, we may share
your health information with government officials that are responsible for
controlling disease, injury or disability. We may also disclose your health information to a person who may have
been exposed to a communicable disease or be at risk for contracting or
spreading the disease if a law permits us to do so.
Violence.[27] We may release your health information to a
public health authority that is authorized to receive reports of abuse, neglect
or domestic violence. For example, we
may report your information to government officials if we reasonably believe
that you have been a victim of such abuse, neglect or domestic violence. We will make every effort to obtain your
permission before releasing this information, but in some cases we may be
required or authorized to act without your permission.
Health Oversight Activities.[28] We may release your health information to
government agencies authorized to conduct audits, investigations, and
inspections of our facility. These
government agencies monitor the operation of the health care system, government
benefit programs such as Medicare and Medicaid, and compliance with government
regulatory programs and civil rights laws.
Product Monitoring, Repair And Recall.[29] We may disclose your health information to a
person or company that is regulated by the Food and Drug Administration for the
purpose of: (1) reporting or tracking product defects or problems; (2)
repairing, replacing, or recalling defective or dangerous products; or (3)
monitoring the performance of a product after it has been approved for use by
Lawsuits And Disputes.[30] We may disclose your health information if we
are ordered to do so by a court or administrative tribunal that is handling a
lawsuit or other dispute.
Law Enforcement.[31] We may disclose your health information to
law enforcement officials for the following reasons:[32]
· To comply with court orders or laws that we are
required to follow;
· To assist law enforcement officers with
identifying or locating a suspect, fugitive, witness, or missing person; · If you have been the victim of a crime and we
determine that: (1) we have been unable to obtain your general written consent
because of an emergency or your incapacity; (2) law enforcement officials need
this information immediately to carry out their law enforcement duties; and (3)
in our professional judgment disclosure to these officers is in your best
· If we suspect that your death resulted from
criminal conduct; or
· If necessary to report a crime that occurred on
To Avert A Serious And Imminent Threat To
Health Or Safety.[33] We may use your health information or share
it with others when necessary to prevent a serious and imminent threat to your
health or safety, or the health or safety of another person or the public. In such cases, we will only share your information
with someone able to help prevent the threat. We may also disclose your health information to law enforcement officers
if you tell us that you participated in a violent crime that may have caused
serious physical harm to another person (unless you admitted that fact while in
counseling), or if we determine that you escaped from lawful custody (such as a
prison or mental health institution).
Activities Or Protective Services.[34] We may disclose your health information to
authorized federal officials who are conducting national security and
intelligence activities or providing protective services to the President or
other important officials.
Inmates And Correctional Institutions.[35] If you later become incarcerated at a
correctional institution or detained by a law enforcement officer, we may
disclose your health information to the prison officers or law enforcement
officers if necessary to provide you with health care, or to maintain safety,
security and good order at the place where you are confined. This includes sharing information that is
necessary to protect the health and safety of other inmates or persons involved
in supervising or transporting inmates.[36]
Workers' Compensation. We may disclose your health information for
workers' compensation or similar programs that provide benefits for
work-related injuries.[37]
Coroners, Medical Examiners And Funeral
Directors.[38] In the unfortunate event of your death, we
may disclose your health information to a coroner or medical examiner. This may be necessary, for example, to
determine the cause of death. We may
also release this information to funeral directors as necessary to carry out
Organ And Tissue Donation.[39] In the unfortunate event of your death, we
may disclose your health information to organizations that procure or store
organs, eyes or other tissues so that these organizations may investigate
whether donation or transplantation is possible under applicable laws.
Research.[40] In most cases, we will ask for your written
authorization before using your health information or sharing it with others in
order to conduct research. However,
under some circumstances, we may use and disclose your health information
without your written authorization if we obtain approval through a special
process to ensure that research without your written authorization poses
minimal risk to your privacy. Under no
circumstances, however, would we allow researchers to use your name or identity
publicly. We may also release your
health information without your written authorization to people who are
preparing a future research project, so long as any information identifying you
does not leave our facility. In the
unfortunate event of your death, we may share your health information with
people who are conducting research using the information of deceased persons,
as long as they agree not to remove from our facility any information that
De-identified Or Partially De-identified Information.[41]
may use and disclose your health information if we have removed any information
that has the potential to identify you so that the health information is
"completely de-identified." We may also
use and disclose "partially de-identified" health information about you if the
person who will receive the information signs an agreement to protect the
privacy of the information as required by federal and state law. Partially de-identified health information
will not contain any information that
would directly identify you (such as your name, street address, social security
number, phone number, fax number, electronic mail address, website address, or
license number).
5. Incidental Disclosures[42]
we will take reasonable steps to safeguard the privacy of your health
information, certain disclosures of your health information may occur during or
as an unavoidable result of our otherwise permissible uses or disclosures of
your health information. For example,
during the course of a treatment session, other residents in the treatment area
may see, or overhear discussion of, your health information.
We want you to know that you have the
following rights to access and control your health information. These rights are important because they will
help you make sure that the health information we have about you is
accurate. They may also help you control
the way we use your information and share it with others, or the way we
communicate with you about your medical matters.
1. Right To Inspect And Copy Records[43]
have the right to inspect and obtain a copy of any of your health information
that may be used to make decisions about you and your treatment for as long as
we maintain this information in our records. This includes medical and billing records. To inspect or obtain a copy of your health
information, please submit your request to Cassandra Brandon, Quality
Assurance/Human Resources Analyst, 1570 Buffalo Avenue, Niagara Falls, NY
14303. If you request a copy of the
information, we may charge a fee for the costs of retrieving, copying, mailing
or supplies we use to fulfill your request. The standard fee for copying is $0.75 per page and must generally be
paid before or at the time we give the copies to you.[44] The standard fee for retrieving and emailing
records is $15.00 per patient and must generally be paid before the records are
emailed to you. We will respond to your
request for inspection of records within 10 days. We ordinarily will respond to requests for
copies within 30 days. If we need
additional time to respond to a request for copies, we will notify you in
writing within the time frame above to explain the reason for the delay and when
you can expect to have a final answer to your request.[45]
certain very limited circumstances, we may deny your request to inspect or
obtain a copy of your information. If we
do, we will provide you with a summary of the information instead.[46] We will also provide a written notice that explains
our reasons for providing only a summary, and a complete description of your
rights to have that decision reviewed and how you can exercise those
rights. The notice will also include
information on how to file a complaint about these issues with us or with the
Secretary of the Department of Health and Human Services. If we have reason to deny only part of your
request, we will provide complete access to the remaining parts after excluding
the information we cannot let you inspect or copy.
2. Right To Amend Records[47]
you believe that the health information we have about you is incorrect or
for as long as the information is kept in our records. To request an amendment, please write to Cassandra
Brandon, Quality Assurance/Human Resources Analyst, 1570 Buffalo Avenue,
Niagara Falls, NY 14303. Your request
should include the reasons why you think we should make the amendment. Ordinarily we will respond to your request
within 60 days. If we need additional
time to respond, we will notify you in writing within 60 days to explain the
reason for the delay and when you can expect to have a final answer to your
deny part or all of your request, we will provide a written notice that
explains our reasons for doing so. You
will have the right to have certain information related to your requested
amendment included in your records. For
example, if you disagree with our decision, you will have an opportunity to
submit a statement explaining your disagreement which we will include in your
records. We will also include
information on how to file a complaint with us or with the Secretary of the
Department of Health and Human Services. These procedures will be explained in more detail in any written denial
notice we send you.
3. Right To An Accounting Of Disclosures[48]
have a right to request an "accounting of disclosures" which identifies certain
other persons or organizations to whom we have disclosed your health
information in accordance with applicable law and the protections afforded in
this Notice of Privacy Practices. An
accounting of disclosures does not describe the ways that your health
information has been shared within and between the residential program and the
facilities listed at the beginning of this notice, as long as all other
protections described in this Notice of Privacy Practices have been followed.[49]
accounting of disclosures also does not include information about the following
Disclosures we made to you or
your personal representative;
Disclosures we made pursuant
to your written authorization;
Disclosures we made for
treatment, payment or business operations;
Disclosures made from our
facility directory; Disclosures made to your
friends and family involved in your care or payment for your care;
Disclosures that were
incidental to permissible uses and disclosures of your health information
(for example, when information is overheard by another resident passing
Disclosures for purposes of
research, public health or our business operations of limited portions of
your health information that do not directly identify you;
Disclosures made to federal
officials for national security and intelligence activities; or
Disclosures about inmates to
correctional institutions or law enforcement officers.
request an accounting of disclosures, please write to Cassandra Brandon,
Quality Assurance/Human Resources Analyst, 1570 Buffalo Avenue, Niagara Falls,
NY 14303. Your request must state a time
period within the past six years for the disclosures you want us to
include. For example, you may request a
list of the disclosures that we made between January 1, 2010 and January 1,
2011. You have a right to receive one accounting
within every 12 month period for free. However, we may charge you for the cost of providing any additional
accounting in that same 12 month period. We will always notify you of any cost involved so that you may choose to
withdraw or modify your request before any costs are incurred.
we will respond to your request for an accounting within 60 days. If we need additional time to prepare the
accounting you have requested, we will notify you in writing about the reason
for the delay and the date when you can expect to receive the accounting. In rare cases, we may have to delay providing
you with the accounting without notifying you because a law enforcement
official or government agency has asked us to do so.
4. Right To Request Additional Privacy
Protections[50]
have the right to request that we further restrict the way we use and disclose
your health information to provide you with treatment or care, collect payment
for that treatment or care, or run our business operations. You may also request that we limit how we
disclose information about you to family or friends involved in your care. For example, you could request that we not
disclose information about a surgery you had. To request restrictions, please write to Cassandra Brandon, Quality
Assurance/Human Resources Analyst, 1570 Buffalo Avenue, Niagara Falls, NY 14303. Your request should include (1) what
information you want to limit; (2) whether you want to limit how we use the
information, how we share it with others, or both; and (3) to whom you want the
limits to apply. We
are generally not required to agree to your request for a restriction, except
we must agree to your request to restrict the information we provide to your
health plan if the disclosure is not required by law and the information
relates to health care being paid in full by someone other than the health
plan, and in some cases the restriction you request may not be permitted under
law. However, if we do agree (either voluntarily or as required by law), we
will be bound by our agreement unless the information is needed to provide you
with emergency treatment or comply with the law. Once we have agreed to a restriction, you
have the right to revoke the restriction at any time. Under some circumstances, we will also have
the right to revoke the restriction as long as we notify you before doing so;
in other cases, we will need your permission before we can revoke the
5. Right To Request Confidential
Communications[51]
representative about your medical matters in a more confidential way by
requesting that we communicate with you by alternative means or at alternative
locations. To request more confidential
communications, please write to Cassandra Brandon, Quality Assurance/Human
Resources Analyst, 1570 Buffalo Avenue, Niagara Falls, NY 14303. We will
not ask you the reason for your request, and we will try to accommodate all
reasonable requests. Please specify
in your request how you or your personal representative wish to be contacted,
and how payment for your health care will be handled if we communicate with
your personal representative through this alternative method or location.[52]
signing below, I acknowledge that I have been provided a copy of this Notice of
Privacy Practices and have therefore been advised of how health information
about me may be used and disclosed by the residential program and the
facilities listed at the beginning of this notice, and how I may obtain access
to and control this information. I also
acknowledge and understand that I may request copies of separate notices
explaining special privacy protections that apply to HIV-related information,
alcohol and substance abuse treatment information, mental health information,
and genetic information.[53]
Signature of Resident or Personal
Print Name of Resident or Personal Representative
Description of Personal Representative's
signing below, I consent to the use and disclosure of my health information to
treat me and arrange for my medical care, to seek and receive payment for
services given to me, and for the business operations of the residential
program, its staff, and the facilities listed at the beginning of this notice.[54]
Print Name of Resident or Personal
This Notice of Privacy Practices has been written as a joint notice that will
cover uses and disclosures of protected health information by an organized
health care arrangement. An organized
health care arrangement includes independent health care professionals,
clinicians and contracted technicians who provide care within a clinically
integrated residential program setting even though these persons are not
technically employees of the residential program. It also includes persons or organizations
outside the residential program who jointly engage in risk-sharing, quality
assurance, or peer review activities with the residential program. We recommend that, when appropriate, a
residential program use a joint Notice of Privacy Practices so that the residential
program and its non-employed health care provider staff each will not be
required to provide the resident with, and make a good faith effort to obtain
the resident's written acknowledgement of receipt of a Notice of Privacy
Practices. A residential program should
be aware, however, that providing residents with a joint notice of privacy
practices may create some expectation by residents that the persons and
facilities covered by the joint notice will coordinate their responses to
resident requests made pursuant to the residents' rights provisions (e.g.,
access, amendment, accounting, and requests for restrictions or for
confidential communications). Although
the Privacy Rule does not itself require a joint response by members of an
organized health care arrangement, participants in the joint notice should be
prepared, because of resident expectations, to notify each other of such
resident requests or, alternatively, make clear in this joint notice that the
resident will need to independently exercise these privacy rights with each of
the members of the organized health care arrangement. A residential program
should assess and consult with legal counsel regarding whether it is part of an
organized health care arrangement and modify this Notice of Privacy Practices
Although the August 2002 modifications to the Privacy Rule removed the written
consent requirement as a matter of federal law, Ropes & Gray has learned
through communication with contacts at the New York State Department of Health
("NYSDOH") that New York laws granting individuals a general right to privacy
and confidentiality with respect to their health information are interpreted by
NYSDOH as placing an obligation on health care providers, such as residential
programs, to obtain a resident's written consent before using or disclosing
protected health information for treatment, payment and health care
operations. Our understanding is that
NYSDOH does not take the position that this written consent must be obtained
before an appointment can be scheduled or a prescription can be filled, and
that NYSDOH will permit health care providers to combine the written consent
required by state law with a written acknowledgment of receipt of the Notice of
Privacy Practices required by the Privacy Rule. In light of this information, the sample policies and forms prepared by
Ropes & Gray have been drafted to include the New York state law written
consent requirement for treatment, payment and health care operations. Residential programs should continue to
follow current law and practice with respect to procedures that must be
followed when a resident refuses to sign a written consent to use and disclose
information for treatment, payment or health care operations, or when such
written consent cannot be obtained for other reasons (e.g., in emergency treatment situations or when a resident is
incapacitated). In the event that NYSDOH
changes its position or provides some guidance regarding this requirement,
residential programs should modify the policies and forms accordingly.
a covered entity intends to restrict its uses and disclosures beyond what is
required by the Privacy Rule and applicable state law, it may modify this
Notice of Privacy Practices to reflect those more restrictive practices. Doing so may be attractive to residents
seeking more protective arrangements with their health care providers. However, under the Privacy Rule, a covered
entity may not commit to any self-restrictive practice that prevents
disclosures required by law, or required to avert a serious threat to health or
safety. Moreover, if there is any change
in the covered entity's self-imposed restrictions, the covered entity will be
required to revise its policies and procedures, and its Notice of Privacy
Practices, in accordance with 45 C.F.R. §§ 164.530(i) and 164.520(b)(2).
[4] See 45 C.F.R. § 164.506.
[6] 45
C.F.R. § 164.506(c)(1)-(2).
[7] 45
C.F.R. § 164.506(c)(1)&(3).
[8] 45
C.F.R. § 164.506(c)(1)&(4).
[9] 45
C.F.R. § 164.520(b)(1)(iii)(A).
The Privacy Rule would also permit a covered entity to use an individual's
protected health information in order to contact the individual with
appointment reminders. See 45 C.F.R.
164.520(b)(1)(iii)(A). This option has
not been included because most residential programs will not need to contact
residents with appointment reminders.
45 C.F.R. § 164.520(b)(1)(iii)(B).
14 45 C.F.R. §§ 164.502(e), 164.504(e).
[13] See 45 C.F.R. § 164.510.
Under the Privacy Rule, covered entities are also permitted in emergency
treatment circumstances to use and disclose an individual's protected health
information for facility directory purposes without the individual's verbal
agreement. See 65 Fed. Reg. 82,522 (Dec. 28, 2000). As an example, the preamble to the Privacy
Rule explains that the individual's agreement is not required if the individual
is so seriously injured that asking permission to use his or her information in
the facility directory would delay treatment and jeopardize the individual's
health. See id. This exception has not been included in this Notice of Privacy Practices
because most residential program residents will not be admitted under such
duress or medical emergency. Although a
medical emergency may arise at some later point during a residential program
resident's presence in the residential program, a facility directory form
should already be on file through ordinary admittance procedures.
45 C.F.R. § 164.510(a).
If the residential program maintains a facility directory, this section will
need to be revised to reflect what information is contained in, and disclosed
from, that directory. The bracketed
information represents the protected health information that may be used or
disclosed for facility directory purposes without written authorization. See 45 C.F.R. § 164.510(a)(1). The Privacy Rule would also permit a covered
entity to include in the facility directory an individual's general condition
in terms that do not communicate specific medical information about the
individual (e.g., fair, stable, or
critical). See 65 Fed. Reg. at 82,521 (Dec. 28, 2000). This type of directory information would more
likely be applicable to general hospitals treating patients in emergency
situations than to residential programs providing long-term care to residents.
45 C.F.R. § 164.510(b).
We note that this section of the Notice of Privacy Practices should cover the
most important New York laws that survive preemption.
In addition to the disclosures listed in the text, a covered entity is permitted
under the Privacy Rule to make the following disclosures without written
authorization or verbal agreement. We
have not included these disclosures in the text of this Notice of Privacy
Practices because in most cases they will not be applicable to residential
programs. Each residential program
should evaluate its own practices, however, to determine whether any of these
disclosures may be applicable. See 45
C.F.R. §§ 164.512(k)(1), 164.512(k)(4), 164.512(k)(5).
Veterans. Covered entities may
disclose protected health information about individuals who are in the armed
forces to appropriate military command authorities, including a foreign
military command authority, for activities they deem necessary to carry out
their military mission. • Department of
Defense or Transportation. A health
care provider that is a component of the Department of Defense or
Transportation may disclose an individual's health information to the
Department of Veteran Affairs upon the individual's discharge from military
service so that the Department of Veteran Affairs may determine if the
individual is eligible for certain benefits.
Veteran Affairs. A health care
provider that is a component of the Department of Veterans Affairs may use or
disclose an individual's health information to determine whether he or she is
eligible for certain benefits. A
residential program that is a component of the Department of Veterans Affairs
should including the following language in this Notice of Privacy
Practices: "We may use your health
information to determine whether you are eligible for certain benefits or
disclose that information to the appropriate officials within the Department of
Veterans Affairs to determine your eligibility for these benefits."
State. A health care provider that
is a component of the Department of State should include the following: "We may use your health information to make
certain medical suitability determinations authorized by law, or disclose that
information to other appropriate officials within the Department of State to
make these determinations."
Ropes & Gray has learned through its contacts at the New York State
Department of Health (NYSDOH) that that New York laws granting individuals a
general right to privacy and confidentiality with respect to their health
information are interpreted by NYSDOH as placing an obligation on health care
providers such as residential programs to obtain a resident's written consent
before using or disclosing protected health information for treatment, payment
and health care operations. Regulators
at NYSDOH have indicated that where uses and disclosures other than for
treatment, payment and health care operations are involved, NYSDOH will defer
to the HIPAA requirements unless a state law specifically requires that the
resident's permission (whether verbal or written) be obtained under the
circumstances. Thus, where a disclosure
under HIPAA would be permitted without a resident's written authorization and
without providing the resident with an opportunity to object (such as a
disclosure to report a crime on the premises), regulators at NYSDOH have stated
that no other permission (either verbal or written) need be obtained unless
specifically required by a New York law addressing the situation. We note that HIPAA will not require written
authorization for, or an opportunity to object to, the uses and disclosures
described in Section 3 of this Notice of Privacy Practices, and the preemption
analysis prepared by Ropes & Gray has not identified any specific state
laws requiring either written or verbal permission for such disclosures. Nevertheless, as a precaution, the Notice of
Privacy Practices includes a statement that written or verbal permission will
be obtained from the resident when specifically required under state law.
[21] See 45 C.F.R. § 164.506(a).
[22] See endnote 3. Residential programs should follow current
law and practice regarding whether emergency treatment may be provided without
obtaining a resident's written consent to use and disclose protected health
information for treatment, payment and health care operations.
[23] See 45 C.F.R. § 164.506(a).
[24] See endnote 3. Residential programs should follow current
law and practice regarding whether treatment may be provided in these
circumstances without obtaining a resident's written consent to use and
disclose protected health information for treatment, payment and health care
[25] See 45 C.F.R. § 164.512(a).
[26] See 45 C.F.R. § 164.512(b).
[27] See 45 C.F.R. § 164.512(c).
[28] See 45 C.F.R. § 164.512(d).
[29] See 45 C.F.R. § 164.512(b)(1)(iii).
[30] See 45 C.F.R. § 164.512(e).
[31] See 45 C.F.R. § 164.512(f).
The Privacy Rule permits a covered entity to report a crime discovered during
an offsite medical emergency (for example, by emergency medical technicians at
the scene of a crime). 45 C.F.R.
164.512(f)(6). This provision would not
apply to most residential programs, which do not have off-site emergency
medical technicians who are likely to be the first responders at the scene of a
[33] See 45 C.F.R. § 164.512(j).
[34] See 45 C.F.R. §§ 164.512(k)(2)-(3).
[35] See 45 C.F.R. § 164.512(k)(5).
This provision would apply only in circumstances where a former resident of the
residential program is detained in a correctional facility, or by a law
enforcement officer, and the former resident's information is needed to ensure
his or her health or safety, or the health or safety of other persons at the
facility or during transport.
[37] See 45 C.F.R. § 164.512(l).
[38] See 45 C.F.R. § 164.512(g).
[39] See 45 C.F.R. § 164.512(h).
[40] See 45 C.F.R. § 164.512(i).
See 45 C.F.R. § 164.502(d) (regarding use and disclosure of de-identified
information); 45 C.F.R. § 164.514(e) (regarding use of a "limited data set"
pursuant to a "data use agreement").
[42] See 45 C.F.R. § 164.502(a)(1)(iii).
[43] See 45 C.F.R. § 164.524.
law, health care providers may charge a maximum of $0.75 per page when
providing residents with copies of their health information. N.Y. Pub. Health Law § 18(2)(e). Moreover, a resident may not be denied
access to copies of his or her health information solely because of an
inability to pay. Id.
Under the Privacy Rule, inspection must be granted within 30 days, and copies
must be provided within 60 days. 45
C.F.R. § 164.524(b)(2).
Under New York Public Health Law § 18(3)(d), providers must provide a summary
of the requested information is direct access to the information is denied.
[47] See 45 C.F.R. § 164.526.
[48] See 45 C.F.R. § 164.528.
For more information about why an accounting list does not need to include
information that is shared within and between the residential program and the
facilities listed at the beginning of this notice (which are members of an
organized health care arrangement), please see the policy we have prepared
entitled Accounting of Disclosures
and the annotations in the endnotes of that policy. We note that if a
residential program modifies the Accounting
of Disclosures policy, the Notice of Privacy Practices should be updated as
appropriate to reflect the practices as stated in that accounting policy.
[50] See 45 C.F.R. § 164.522(a).
[51] See 45 C.F.R. § 164.522(b).
Although not required under the
Privacy Rule, we recommend that covered entities take advantage of the option under that Rule to ask residents
or their personal representatives to specify an alternative means of contact
and an explanation for how payment will be handled if the request for
confidential communication is granted. See 45 C.F.R. § 164.522(b)(2).
The residential program must make a good faith effort to obtain written
acknowledgment of the resident's receipt of this Notice of Privacy Practices on
the first date the residential program provides treatment or care to the
resident, except in an emergency treatment circumstance. See 45 C.F.R. § 164.520(c)(2)(ii). If such acknowledgment cannot be
obtained, the residential program must document its good faith efforts to
obtain the acknowledgment and why it was not obtained. See id. The Privacy Rule does not specify the form that the written
acknowledgment must take, nor does it mandate any specific process that must be
followed in attempting to obtain the acknowledgment. However, to satisfy a
residential program's administrative obligations under the Privacy Rule, a
residential program will need to develop and implement a written policy and
procedure regarding how it will make good faith efforts to obtain this written
See endnote 4. A residential program has the flexibility to include this
language here in order to obtain the resident's general written consent in
accordance with New York law. Alternatively, a residential program may delete
this sentence and add it to a separate form or add it to another already
existing form the residential program is using to obtain other consents or
permissions from the resident. This consent may not be combined with a written
authorization required under HIPAA, however. See 45 C.F.R. § 164.508(b)(3).