|
Summit Pointe
Behavioral Health Resources
Summit Healthcare Group
Notice of Privacy Practices
|
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT
CAREFULLY.
This Notice is provided by the Community Mental Health Authority of Calhoun
County d/b/a Summit Pointe, Behavioral Health Resources and Summit Healthcare
Group.
|
Revised and Effective date of this notice: September 15, 2008.
I. PERMITTED USES AND DISCLOSURES BY SUMMIT POINTE
WITHOUT AUTHORIZATION
There are certain situations where Summit Pointe may use or disclose your
Personal Health Information (sometimes referred to as "PHI") without asking you
for written permission.
TREATMENT
Health care providers can share patient information as necessary to provide
treatment. We may use and/or disclose your PHI to health care professionals
and staff in order to provide treatment to you. However, as a mental health
care provider, we are limited in sharing confidential information or privileged
communications and may not share either confidential information or privileged
communications without your consent, except as permitted by the Michigan Mental
Health Code, MCL 330.1748 and MCL 330.1750.
Treatment includes:
- Sharing your PHI with other health care providers (including hospitals
and clinics) if you have requested health care from those providers;
- Referring you to other health care providers for treatment (including
linking with available providers in areas where you may have relocated);
- Coordinating patient care with others (such as emergency relief workers
or others that can help in finding patients appropriate health
services); and,
- If you are a participant in the Michigan Medicaid Program, under
Michigan law, the Department of Community Health has determined that
participating program health care providers may share your PHI in order
to provide you with appropriate health care services under the
Medicaid program.
We may also utilize your PHI in order to communicate with you. For example, we
may call you to remind you of your upcoming appointment. You will need to
inform us of the most acceptable means of contacting you (telephone, mailed
postcard, answering machine).
EMERGENCY SITUATIONS
Providers and health plans covered by the HIPAA Privacy Rule can share
patient information in all of the following ways in emergency situations:
NOTIFICATION: Health care providers can share patient information as necessary
to identify, locate, and notify family members, guardians, or anyone else
responsible for the individual's care of the individual's location, general
condition, or death.
The health care provider should get verbal permission from individuals, when
possible; but if the individual is incapacitated or not available, providers
may share information for these purposes if, in their professional judgement,
doing so is inthe patient's best interest.
- When necessary, we may notify the police, the press, or the public at
large to the extent necessary to help locate, identify, or otherwise
notify family members and others as to the location and general
condition of their loved ones.
- In addition, when a health care provider is sharing information with
disaster relief organizations that, like the American Red Cross, are
authorized by law or by their charters to assist in disaster relief
efforts, it is unnecessary to obtain a patient's permission to share the
information if doing so would interfere with the organization's ability
to respond to the emergency.
IMMINENT DANGER: Health care providers can share patient information with
anyone as necessary to prevent or lessen a serious and imminent threat to the
health and safety of a person or the public -- consistent with applicable law
and the provider's standards of ethical conduct. Under Michigan law, licensed
mental health care providers have a duty to warn an indentifiable third party
if he or she is in imminent threat of danger.
FACILITY DIRECTORY: Under HIPAA, Health care facilities maintaining a directory
of patients can tell people who call or ask about individuals whether the
individual is at the facility, their location in the facility, and general
condition. NOTE: Licensed mental health facilities or mental health care
providers, like Summit Pointe or Behavior Health Resources, are prohibited by
the Mental Health Code from disclosing to third parties that you are receiving
mental health services at that facility or from that provider (Summit Pointe),
unless you authorize us in writing to disclose that information.
Of course, the HIPAA Privacy Rule does not apply to disclosures if they are not
made by entities covered by the Privacy Rule. Thus, for instance, the HIPAA
Privacy Rule does not restrict the American Red Cross from sharing patient
information.
PAYMENT
Summit Pointe may use your PHI to seek payment from your health plan, Medicaid,
or Medicare or from other sources. For example, your health plan may request
and receive from Summit Pointe your name, address, date of birth, social
security number, dates of service, the services provided, and medical condition
being treated.
HEALTH CARE OPERATIONS
Your PHI may be used as necessary to support our day-to-day activities or
operations. For example, information on the services you received may be used
to support budgeting and financial reporting, and activities to evaluate
service quality and delivery. Daily operations includes, but, in not limited
to: State and Federal quality review audits, health insurance audits, financial
audits, case management peer reviews, and third party medical records audits
conducted for quality review purposes.
LAW ENFORCEMENT
Your PHI may be disclosed to law enforcement agencies under the following
circumstances:
- Court Order or Warrant, Subpoena, or Summons issued by a Judicial
Officer of a Grand Jury. To comply with a court order or
court-ordered warrant, a subpoena or summons issued by a judicial
officer, or a grand jury subpoena. The Federal Regulations recognize
that the legal process in obtaining a court order and the secrecy of
the grand jury process provides protections for the individual's
private information (45 CFR 164.512(f)(l)(ii)(A)-(B)).
- Administrative Subpoena.To respond to an administrative request,
such as an administrative subpoena or investigative demand or other
written request from a law enforcement official. Because an
administrative request may be made without judicial involvement, the
Federal Regulations require all administrative requests to include or
be accompanied by a written statement that the information requested is
relevant and material, specific and limited in scope, and
de-identified information cannot be used(45 CFR 164.512(f)(1)(ii)(C)).
- Identification of a Suspect, Fugitive, Material Witness or Missing Person
To respond to a request for PHI for purposes of identifying or locating
a suspect, fugitive, material witness or missing person; but we must
limit disclosures of PHI to name and address, date and place of birth,
social security number, ABO blood type and rh factor, type of injury,
date and time of treatment, date and time of death, and a description
of distinguishing physical characteristics. Other information related
to the individual’s DNA, dental records, body fluid or tissue typing,
samples, or analysis cannot be disclosed under this provision, but may
be disclosed in response to a court order, warrant, or written
administrative request (45 CFR 164.512(f)(2)).
This same limited identifying described above
may be reported to law enforcement:
- About a suspected perpetrator of a crime when the report is
made by the victim who is a member of the covered entity's
workforce (45 CFR 164.502(j)(2));
- To identify or apprehend an individual who has admitted
participation in a violent crime that the covered entity reasonably
believes may have caused serious physical harm to a victim,
provided that the admission was not made in the course of or based
on the individual’s request for therapy, counseling, or treatment
related to the propensity to commit this type of violent act
(45 CFR 164.512(j)(l)(ii)(A),(j)(2)-(3)).
- To respond to a request for PHI about a victim of a crime, and
the victim agrees. If, because of an emergency or the person’s
incapacity, the individual cannot agree, the covered entity may
disclose the PHI if law enforcement officials represent that the
PHI is not intended to be used against the victim, is needed to
determine whether another person broke the law, the investigation
would be materially and adversely affected by waiting until the
victim could agree, and the covered entity believes in its
professional judgment that doing so is in the best interests of
the individual whose information is requested (45 CFR
164.512(f)(3)).
Where child abuse victims or adult victims of abuse, neglect or
domestic violence are concerned, the Federal Regulations provide:
- Child abuse or neglect may be reported to any law enforcement
official authorized by law to receive such reports and the
agreement of the individual is not required (45 CFR 164.512(b)
(1)(ii)). Note: Michigan law mandates that a health
care provider report suspected child abuse or neglect to
Child Protective Services;
- Adult abuse, neglect, or domestic violence may be reported to a
law enforcement official authorized by law to receive such
reports (45 CFR 164.512(c)):
- If the individual agrees;
- If the report is required by law: or
- If expressly authorized by law, and based on the
exercise of professional judgment, the report is
necessary to prevent serious harm to the individual or
others, or in certain other emergency situations (see
45 CFR 164.512(c)(l)(iii)(B))
- Notice to the individual of the report may be required
(see 45 CFR 164.512(c)(2)).
- Reports to Law Enforcement Required by Law. To report PHI to
law enforcement when we are required by law to do so
(45 CFR 164.512(f)(1)(i)). For example, state laws commonly require
health care providers to report incidents of gunshot or stab
wounds, or other violent injuries; we are permitted under these
Federal Regulations to make disclosures of PHI as necessary to
comply with these laws.
- Death of an Individual. To alert law enforcement of the death of
of the individual, when there is a suspicion that death resulted
from criminal conduct (45 CFR 164.512(f)(4)).
- Information about a decedent may also be shared with
medical examiners or coroners to assist them in identifying the
decedent, determining the cause of death, or to carry out their
other authorized duties (45 CFR 164.512(g)(l)).
- To Report a Crime on the Premises. To report PHI that we, in
good faith, believes to be evidence of a crime that occurred on our
premises (45 CFR 164.512(f)(5)).
- Responding to an Off-Site Emergency. When responding to an
off-site medical emergency, as necessary to alert law enforcement about
criminal activity, specifically, the commission and nature of the
crime, the location of the crime or any victims, and the identity,
description, and location of the perpetrator of the crime
(45 CFR 164.512(f)(6)). This provision does not apply if we believe
that the individual in need of the emergency medical care is the victim
of abuse, neglect or domestic violence; see above Adult abuse, neglect,
or domestic violence for when reports to law enforcement are allowed
under 45 CFR 164.512(c).
- Duty to a Third Party to Prevent Serious Imminent Threat. When
consistent with applicable law and ethical standards, we may contact law
enforcement officials for the following reasons:
- To a law enforcement official reasonably able to prevent or
lessen a serious and imminent threat to the health or safety
of an individual or the public (45 CFR 164.512(j)(l)(i)); or
- To identify or apprehend an individual who appears to have
escaped from lawful custody (45 CFR 164.512(j)(l)(ii)(B)).
- National Security or Correctional Institute Uses. For certain
other specialized governmental law enforcement purposes, we may
provide PHI to the proper governmental officials, such as:
- To federal officials authorized to conduct intelligence,
counter-intelligence, and other national security activities
under the National Security Act (45 CFR 164.512(k)(2)) or to
provide protective services to the President and others and
conduct related investigations (45 CFR 164.512(k)(3));
- To respond to a request for PHI by a correctional institution
or a law enforcement official having lawful custody of an
inmate or others if they represent such PHI is needed to
provide health care to the individual; for the health and
safety of the individual, other inmates, officers or employees
of or others at a correctional institution or responsible for
the transporting or transferring inmates; or for the
administration and maintenance of the safety, security, and
good order of the correctional facility, including law
enforcement on the premises of the facility
(45 CFR 164.512(k)(5)).
Except when required by law, we are to make only the minimum use or disclosure
necessary to law enforcement to accomplish the intended purpose
(45 CFR 164.502(b), 164.514(d)). When reasonable to do so, we may rely upon the
representations of the law enforcement official (as a public officer) as to
what information is the minimum necessary for their lawful purpose (45 CFR
164.512(d)(3)(iii)(A)). Moreover, if the law enforcement official making the
request for information is not known to the covered entity, the covered entity
must verify the identity and authority of such person prior to disclosing the
information (45 CFR 164.512(h)).
PUBLIC HEALTH REPORTING
Your health information may also be disclosed to public health agencies as
required by law. For example, we are required to report certain contagious
diseases to the public health department.
OTHER USES AND DISCLOSURES REQUIRE YOUR AUTHORIZATION
Disclosure of your PHI without a court order, or its use for any purpose other
than those listed above, required your written authorization.
II. YOUR RIGHTS WITH REGARD TO YOUR USE OR
DISCLOSURE OF YOUR PHI
You have certain rights under State law and Federal Privacy Standards:
- Requests to Restrict Use or Disclosure of PHI. You may
request in writing that we restrict uses or disclosures of your PHI to
carry out treatment, payment, or health care operations and disclosures
to family or friends by Summit Pointe under circumstances that are
permitted under the Federal Regulations (45 CFR § 164.510(b)). If we
agree in writing to restricted use of your PHI then we may not use
"Restricted PHI" in violation of the agreed upon restriction, except
in the case where you need emergency medical treatment and the PHI is
needed to provide the emergency treatment.
- Requests for Alternative Methods of Communication to Preserve
Confidentiality. You may request in writing that we provide
confidential communications of PHI to you or to your insurance carrier
by alternative means or to alternative locations. For example, if you
do not want your family members to know about a certain treatment then
you may request that we communicate about that treatment at your place
of employment, by mail to a designated address, or by phone to a
designated phone number. Similarly, you may request that we send
communications in a closed envelope rather than a post card, as an
"alternative means." We are required to accommodate all reasonable
requests. Health plans must accommodate all reasonable requests, if the
individual clearly states that the disclosure of all or part of the
protected health information could endanger the individual. For
example, if an individual requests that a health plan send explanations
of benefits about particular services to the individual's work rather
than home address because the individual is concerned that a member of
the individual’s household (e.g., the named insured) might read the
explanation of benefits and become abusive towards the individual, the
health plan must accommodate the request.
- Requests for Restricted Use or Disclosure of PHI or for Alternate
Methods of Communication to Preserve Confidentiality May Be Denied.
We may deny your request for restricted use of PHI or for alternative
methods of communication to preserve confidentiality. With regard to
requests for alternative methods of communication to preserve
confidentiality, we are required to review the reasonableness of a
request solely on the basis of the administrative difficulty of
complying with the request. We cannot refuse to accomodate a request
for alternative methods of communication based on its perception of the
merits of your reason for making the request. We may not require you to
provide a reason for the request for alternative methods of
communication as a condition of accommodating the request.
- Right to Request Amendment or Correction of PHI. An individual
has the right to have a covered entity amend protected health
information or a record about the individual in a designated record set
for as long as the Protected Health Information is maintained in the
designated record set.
- Denial of Request to Amend PHI. We may deny an individual's
request for amendment, if we determine that the PHI or record that is
the subject of the request:
- Was not created by the Summit Pointe, unless the individual
provides a reasonable basis to believe that the originator of
protected health information is no longer available to act on
the requested amendment;
- Is not part of the designated record set;
- Would not be available for inspection to the requesting individual;
- Is accurate and complete.
- An Accounting of Disclosures of PHI. We are required to keep an
accounting ofcertain disclosures of PHI made by us in the six years
prior to the date on which the accounting is requested. You may request
a copy of this record. The following disclosures of PHI are not
required to be accounted for:
- To carry out treatment, payment and health care operations as
provided in § 164.502;
- To individuals of PHI about them as provided in § 164.502;
- For the facility’s directory or to persons involved in the
individual's care or other notification purposes as provided
in § 164.510;
- For national security or intelligence purposes as provided in
§ 164.512(k)(2);
- To correctional institutions or law enforcement officials as
provided in § 164.512(k)(5); or
- That occurred prior to the Federal Regulations compliance date
for Summit Pointe.
III. OUR RIGHT TO REVISE PRIVACY NOTICE
We have the right to change our privacy notice at any time. We will post the
revised notice on our web site and provide you with a revised notice on your
next office visit. The revised notice will apply to all PHI that we maintain.
IV. REQUESTS TO INSPECT HEALTH INFORMATION NEED TO
BE IN WRITING
We require that all requests to restrict use, disclosure, inspect or copy your
PHI be submitted in writing. You may obtain a form to request access to, and
a copy of, your records by contacting the Corporate Compliance Officer.
V. MICHIGAN MEDICAL RECORDS ACCESS ACT
If you are receiving primary care services from Summit Healthcare Group (and
not mental health services from Summit Pointe) from a physician then you have
certain rights under the Michigan Medical Records Access Act, MCL 333.26265, to
access that primary care physician record. You have the right to:
- Obtain from us a copy of your medical record;
- Upon receipt of the request, we have 30 days to respond to your
request, unless the record is maintained off-site, and in that case, we
have 60 days to respond;
- Within said time, we are required to make the record available for
inspection and copying, during regular business hours, at our offices
or we will inform you that either the file cannot be found or does not
exist, or that the health care provider is not the keeper of the
record. In that case, we will provide you with the name and address of
the custodian of the record.
- We may extend the time period by an additional thirty days.
The Medical Records Access Act does not apply to health care providers that
provide only mental health services.
VI. COMMENTS OR COMPLAINTS
If you would like to submit a comment or complaint to us or Health and Human
Services about our privacy practices, you can do so by calling the number
listed below, or by sending a letter outlining your concerns to:
Summit Pointe:
Corporate Compliance Officer
Attn: Laura Ferrara
140 W. Michigan
Battle Creek, MI, 49017
(269) 966-1460 Ext. 1262
Summit Pointe Customer Satisfaction Hotline (866) 721-0390
Health and Human Services
Complaints to the Office for Civil Rights must: (1) Be filed in writing, either
on paper or electronically; (2) name the entity that is the subject of the
complaint and describe the acts or omissions believed to be in violation of the
applicable requirements of the Privacy Rule; and (3) be filed within 180 days
of when you knew that the act or omission complained of occurred. OCR may
extend the 180-day period if you can show "good cause." Any alleged violation
must have occurred on or after April 14, 2003 (on or after April 14, 2004 for
small health plans), for OCR to have authority to investigate.
Anyone can file written complaints with OCR by mail, fax, or email. If you
need help filing a complaint or have a question about the complaint form,
please call this OCR toll free number: 1-800-368-1019. OCR has ten regional
offices, and each regional office covers certain states. You should send your
complaint to the appropriate OCR Regional Office, based on the region where the
alleged violation took place. Complaints should be sent to the attention of the
appropriate OCR Regional Manager.
VII. WEBSITE SECURITY
Our site has security measures in place to protect the loss, misuse, and
alteration of information under our control. We use security protections to
help safeguard your information, to help us tailor the website for you, and to
make it easier for you to get around on our website, and to offer you product
and services information.
COPIES OF THIS NOTICE
You have the right to obtain a paper copy of this Notice, even if you have
agreed to receive this Notice electronically in accordance with Federal
regulations.
|
|
|