HIPAA Notice of Privacy Practices

As Required by the Privacy Regulations Promulgated Pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA)

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully

Effective Date: March 1, 2014

We are committed to protecting the privacy of you and your family. We will share information about you only with those who need to know it and who are permitted by law to receive this information. [Guardians and personal representatives should be aware that the words “you “and “your” in this notice refer to the consumer not to the guardian.] We are required by both federal and state law to protect the privacy and confidentiality of protected health information that may reveal your identity, and to provide you with a copy of this notice which describes the privacy practices of our agency and staff. A copy of our current notice will always be posted in the office at each of our sites. You will also be able to obtain a copy by accessing our website at www.sus.org, calling our central office at 212-633-6900, or asking for one at the time of your next visit. If you have any questions about this notice or would like further information, please contact our Privacy Officer/Corporate Compliance Officer at 212-633-6900.

How we use and disclose your protected health information

1. Treatment, Payment and Health Care Operations

Protected health information about you may be used by our agency in connection with our duties to provide you with treatment, to obtain payment for that treatment, or to conduct our agency’s business operations.

“Treatment” means that we may use protected health information about you inside our agency, or share it with another agency, to plan for and provide services to you. For example, two of our clinicians who are both treating you may discuss your case to coordinate treatment. In addition, if you are receiving services from another health care provider we may share information about you to assist the other provider in treating you.
“Payment” means that we may use protected health information about you, or share it with others, so that we obtain payment for the services we provide to you. For example, our clinicians may provide protected health information to our billing department and our billing department may then share this information with Medicaid or other insurers.
“Business operations” means that we may use protected health information about you, or share it with others, in order to conduct our normal business operations. For example, we may use protected health information about you to evaluate the performance of our staff in providing services to you, or to educate our staff on how to improve the care they provide for you.

We will use protected health information about you within our agency for treatment, payment and health care operations without your written consent or authorization. We will also share your protected health information with outside persons for payment purposes without your written consent or authorization. We will share your protected health information with outside persons for treatment and business operations only with your consent. The consent we obtain is a broad consent that, in contrast to the written authorization described later in this Notice, does not specifically describe each particular use and disclosure of your protected health information and does not automatically expire on a particular date. We will not obtain your consent, however, to disclose your protected health information in a medical emergency or for the public interest purposes described below.

Without your consent or authorization, we will use your protected health information within our agency to remind you about health care appointments and to inform you about treatment alternatives or other health-related benefits and services that may be of interest to you. We will obtain your general consent before disclosing your protected health information to outside persons for these purposes.

2. Public Interest Purposes

We will use and disclose your protected health information for the following public interest purposes without your written consent or authorization:
To comply with a court order.
To appropriate persons who are able to avert a serious and imminent threat to the health or safety of you or another person.
To appropriate government authorities to locate a missing person or conduct a criminal investigation as permitted under Federal and State confidentiality laws.
To the mental hygiene legal service or an attorney representing you in an involuntary hospitalization or medication proceeding, provided certain safeguards are established.
To authorized government officials for the purpose of monitoring or evaluating the quality of care provided by the agency or its staff.
To qualified researchers when an Institutional Review Board or Privacy Board has determined that such research poses minimal risk to your privacy; to people who are preparing a future research project, so long as any information identifying you does not leave our facility; or in the unfortunate event of your death, with people who are conducting research using the information of deceased persons, as long as they agree not to remove from our facility any information that identifies you.
To coroners and medical examiners to determine cause of death.
If you are an inmate, to your correctional facility if the facility certifies that the information is necessary in order to provide you with health care, to conduct certain types of investigations or to protect the health or safety of you or any other persons at the correctional facility.
To public health officials who are authorized to investigate and control the spread of diseases and carry out other public health activities.
As required by state or federal law.

3. Family Members

We will ask you whether you have any objection to our sharing protected health information about you with your family involved in your care.

4. Confidentiality of Psychotherapy Notes

Psychotherapy notes are notes that are prepared by your treating psychiatrist, psychologist or clinical social worker, referencing your private counseling sessions, or your group, joint, or family counseling sessions, that are maintained separate from the rest of your clinical records. These notes can only be used and disclosed as described below.

Without your general written consent, psychotherapy notes about you may be used and disclosed in the following situations:

The mental hygiene professional who created the notes may use them to provide you with further treatment
The mental hygiene professional who created the notes may disclose them to students, trainees, or practitioners in mental hygiene who are learning under supervision to practice or improve their skills in group, joint, family, or individual counseling
The mental hygiene professional who created the notes may disclose them as necessary to defend his or herself, or the agency, in a legal proceeding initiated by you or your personal representative
The mental hygiene professional who created the notes may disclose them as required by law
The mental hygiene professional who created the notes may disclose the notes to appropriate government authorities when necessary to avert a serious and imminent threat to the health or safety of you or another person; and
The mental hygiene professional who created the notes may disclose them to the United States Department of Health and Human Services when that agency requests them in order to investigate the mental hygiene professional’s compliance, or the agency’s compliance, with Federal privacy and confidentiality laws and regulations.

Your special written authorization is required for all other uses and disclosures of psychotherapy notes.

5. Marketing and Sale of Protected Health Information

We will not use or disclose your protected health information for marketing purposes without your written authorization.

We will not sell your protected health information to another person or entity. A sale of your protected health information means that we receive something of value from another party in exchange for the information. However, we may receive something of value in exchange for disclosing protected health information for certain limited purposes, such as public health reporting, treatment and research (but in the case of research, payment may not exceed our cost of preparing or transmitting the information).

6. Your Written Authorization

We will not use or disclose your protected health information for any purpose not specified in this Notice without your written authorization. The written authorization we obtain will specifically identify the particular purpose of the use or disclosure, the information being used or disclosed, the person(s) receiving the information, and the time frame that the authorization is valid. If you give us your written authorization you may revoke it at any time, in which case we will no longer use or disclose your protected health information for this purpose, except to the extent we have already relied on your authorization. You are not required to sign an authorization form and we will not deny you treatment if you refuse to do so.

What information is protected

We are committed to protecting the privacy of protected health information we gather about you while providing services. Some examples of protected health information are:

the fact that you are a participant at, or receiving services from, our agency
information about your condition
information about health care products or services you have received or may receive in the future (such as a medication or equipment), or
information about your health care benefits under an insurance plan (such as whether a prescription is covered)

when combined with:

geographic information (such as where you live or work)
demographic information (such as your race, gender, or ethnicity)
unique numbers that may identify you (such as your social security number, your phone number, or your Medicaid number) and
other types of information that may identify who you are.

Incidental Disclosures. While we will take reasonable steps to safeguard the privacy of your information, certain disclosures of your information may occur during or as an unavoidable result of our otherwise permissible uses or disclosures of your protected health information.

Breach Notification. We will notify you if there is a breach of your unsecured protected health information. A breach is an improper use or disclosure of your information that compromises the security of the information. Information is considered unsecured if it is not encrypted in accordance with standards adopted by the federal government. If there is a breach, we will notify you as soon as reasonably possible after we discover the breach, but in no event more than 10 business days after discovery.

What rights do you have

How To Access Your Protected Health Information. You generally have the right to inspect and copy your protected health information. For more information, please see later in this notice. See (1) under the section below titled “Your Rights”.

How To Correct Your Protected Health Information. You have the right to request that we amend your protected health information if you believe it is inaccurate or incomplete. For more information, please see later in this notice. See (2) under the section below titled “Your Rights”.

How To Keep Track Of The Ways Your Protected Health Information Has Been Shared With Others. You have the right to receive a list from us, called an “accounting list,” which provides information about when and how we have disclosed protected health information about you to outside persons or organizations. Many routine disclosures we make will not be included on this accounting list, but the accounting list will identify non-routine disclosures of your information. For more information, please see later in this notice. See (3) under the section below titled “Your Rights”.

How To Request Additional Privacy Protections. You have the right to request further restrictions on the way we use protected health information about you or share it with others. Except in limited cases described below, we are not required to agree to the restriction you request, but if we do, we will be bound by our agreement. For more information, please see later in this notice. See (4) under the section below titled “Your Rights”.

How To Request More Confidential Communications. You have the right to request that we contact you in a way that is more confidential for you, such as at home instead of at work or at program. We will try to accommodate all reasonable requests. For more information, please see later in this notice. See (5) under the section below titled “Your Rights”.

How Someone May Act On Your Behalf. You have the right to name a personal representative who may act on your behalf to control the privacy of your protected health information. Parents and guardians will generally have the right to control the privacy of protected health information about minors unless the minors are permitted by law to act on their own behalf.

How To Learn About Special Protections For HIV, Alcohol and Substance Abuse, And Genetic Information. Special privacy protections apply to HIV-related information, alcohol and substance abuse treatment information, and genetic information. Some parts of this general Notice of Privacy Practices may not apply to these types of information. If your clinical records include this type of information, you will be provided with separate notices explaining how the information will be protected. To request copies of these other notices now, please contact our Privacy Officer/ Corporate Compliance Officer at 212-633-6900.

How To Obtain A Copy Of This Notice. You have the right to a paper copy of this notice. You may request a paper copy at any time, even if you have previously agreed to receive this notice electronically. To do so, please call our Privacy Officer/ Corporate Compliance Officer 212-633-6900. You may also obtain a copy of this notice from our website at www.sus.org, or by requesting a copy at your next visit.

How To Obtain A Copy Of Revised Notice. We may change our privacy practices from time to time. If we do, we will revise this notice so you will have an accurate summary of our practices. The revised notice will apply to all of your protected health information, and we will be required by law to abide by its terms. We will post any revised notice in the office at each of our sites. You will also be able to obtain your own copy of the revised notice by accessing our website at www.sus.org, calling our office at 212-633-6900, or asking for one at the time of your next visit. The effective date of the notice will always be noted in the top right corner of the first page.

How To File A Complaint. If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. To file a complaint with us, please contact the Privacy Officer/Corporate Compliance Officer, at S:US, 305 Seventh Avenue, 10th Floor, New York, NY 10001, 212-633-6900. No one will retaliate or take action against you for filing a complaint.

How you can exercise your rights to access and control your protected health information

We want you to know that you have the following rights to access and control your protected health information. These rights are important because they will help you make sure that the protected health information we have about you is accurate. They may also help you control the way we use your protected health information and share it with others, or the way we communicate with you about your medical matters.

1. Right To Inspect And Copy Records

You have the right to inspect and obtain a copy of any protected health information that may be used to make decisions about you and your treatment for as long as we maintain this information in our records. This includes medical and billing records. To inspect or obtain a copy of your protected health information, please submit your request in writing to our Privacy Officer. We may charge you for the costs of copying, mailing or other supplies we use to fulfill your request. However, we will notify you of any costs involved so that you may choose to withdraw or modify your request before any costs are incurred.

We will respond to your request for inspection of records within 10 days. We ordinarily will respond to requests for copies within 30 days. If we need additional time to respond to a request for copies, we will notify you in writing within the time frame above to explain the reason for the delay and when you can expect to have a final answer to your request.

Under certain very limited circumstances, we may deny your request to inspect or obtain a copy of your protected health information. If we do, we will provide you with a summary of the information instead. We will also provide a written notice that explains our reasons for providing only a summary, and a complete description of your rights to have that decision reviewed and how you can exercise those rights. The notice will also include information on how to file a complaint about these issues with us or with the Secretary of the Department of Health and Human Services. If we have reason to deny only part of your request, we will provide complete access to the remaining parts after excluding the information we cannot let you inspect or copy.

2. Right To Request Amendment of Records

If you believe that the protected health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept in our records. To request an amendment, please write to our Privacy Officer. Your request should include the reasons why you think we should make the amendment. Ordinarily we will respond to your request within 30 days. If we need additional time to respond, we will notify you in writing within 30 days to explain the reason for the delay and when you can expect to have a final answer to your request.

If we deny part or all of your request, we will provide a written notice that explains our reasons for doing so. You will have the right to have certain information related to your requested amendment included in your records. For example, if you disagree with our decision, you will have an opportunity to submit a statement explaining your disagreement which we will include in your records. We will also include information on how to file a complaint with us or with the Secretary of the Department of Health and Human Services. These procedures will be explained in more detail in any written denial notice we send you.

3. Right To An Accounting Of Disclosures

You have a right to request an “accounting of disclosures” which is a list that contains certain information about how we have shared your protected health information with others. An accounting list, however, will not include any information about:

Disclosures we made to you
Disclosures we made pursuant to your authorization
Disclosures we made for treatment, payment or health care operations
Disclosures made to your personal representative and/or family involved in your care or payment for your care
Disclosures made to federal officials for national security and intelligence activities
Disclosures that were incidental to permissible uses and disclosures of your personal health information
Disclosures for purposes of research, public health or our normal business operations of limited portions of your protected health information that do not directly identify you
Disclosures about inmates to correctional institutions or law enforcement officers.

To request this accounting list, please write to our Privacy Officer. Your request must state a time period within the past six years for the disclosures you want us to include. We will always notify you of any cost involved so that you may choose to withdraw or modify your request before any costs are incurred.

Ordinarily we will respond to your request for an accounting list within 60 days. If we need additional time to prepare the accounting list you have requested, we will notify you in writing about the reason for the delay and the date when you can expect to receive the accounting list. In rare cases, we may have to delay providing you with the accounting list without notifying you because a law enforcement official or government agency has asked us to do so.

4. Right To Request Additional Privacy Protections

You have the right to request that we further restrict the way we use and disclose your protected health information to treat your condition, collect payment for that treatment, or run our agency’s normal business operations. You may also request that we limit how we disclose information about you to family involved in your care. For example, you could request that we not disclose information about a surgery you had. To request restrictions, please write to our Privacy Officer. Your request should include (1) what information you want to limit; (2) whether you want to limit how we use the information, how we share it with others, or both; and (3) to whom you want the limits to apply.

Except as described below, we are not required to agree to your request for a restriction, and in some cases the restriction you request may not be permitted under law. However, if we do agree, we will be bound by our agreement unless the information is needed to provide you with emergency treatment or comply with the law. Once we have agreed to a restriction, you have the right to revoke the restriction at any time. Under some circumstances, we will also have the right to revoke the restriction as long as we notify you before doing so; in other cases, we will need your permission before we can revoke the restriction.

If you, or someone else on your behalf (other than a health plan) pays for the entire cost of a service that we provide you with, we will agree to your request that we not share protected health information relating to that service.

5. Right To Request Confidential Communications

You have the right to request that we communicate with you about your medical matters in a more confidential way by requesting that we communicate with you by alternative means or at alternative locations. For example, you may ask that we contact you by fax instead of by mail, or at work or program instead of at home. To request more confidential communications, please write to our Privacy Officer. We will not ask you the reason for your request, and we will try to accommodate all reasonable requests. Please specify in your request how or where you wish to be contacted, and how payment for your health care will be handled if we communicate with you through this alternative method or location.