Notice of Privacy Practices

Centerstone Affiliated Covered
Entity Notice of Privacy Practices

 This notice describes:

  • How health, mental health and substance use disorder information about you may be used and disclosed.
  • How you may get access to your health information.
  • Your rights with respect to your health information.
  • How to file a complaint concerning a violation of the privacy or security of your health information, or of your rights concerning your information.
  • You have a right to a copy of this notice (in paper or electronic form) and to discuss it with the compliance office listed at the end of this notice if you have any questions.

Please review it carefully.

 AFFILIATED ENTITIES COVERED BY THIS NOTICE

This Notice of Privacy Practices (“Notice”) covers an Affiliated Covered Entity (“ACE”). An ACE is a group of Covered Entities that designates itself as a single entity for purposes of compliance with the Health Insurance Portability and Accountability Act (HIPAA). Certain ACE members may also be considered a Substance Use Disorder (SUD) Treatment Program, which is governed by the Confidentiality of Substance Use Disorder Records regulations set forth in 42 CFR Part 2. These members have designated themselves as a single SUD Treatment Program for compliance with 42 CFR Part 2. When this Notice refers to “Centerstone ACE” and/or “Centerstone’: it is referring collectively to the Ccntcrstonc ACE. For a current list of Ccntcrstonc ACE members, please visit http://www.ccntcrstonc.org or contact the Compliance Office listed at the end of this notice.

Centerstone ACE is committed to protecting the privacy and security of your medical, mental heath and substance abuse information. We are required by law to maintain the privacy and security of your heath information, to provide you this notice and to comply with its terms. The privacy practices in this Notice apply to all staff, students, volunteers, contract staff and business associates and/or qualified service organizations.

Centerstone and certain affiliated organizations participate in one or more Organized Health Care Anangements (OHCA) as defined by the HIP AA Privacy Rule. An OHCA allows participating entities to share health information for joint quality improvement activities and other heath care operations. For a current list of OHCA participants please visit our website at http://www.centerstone.org or contact the Compliance Office listed at the end of this notice.

As part of these arrangements, your health information may be shared among OHCA participants or through a health information exchange only when necessary for treatment or health care operations. Health care operations may include activities such as quality assessment, clinical review, improving referral management, and enhancing care through technology (for example, geocoding your address to improve service delivery).

Your health information may include past, present, and future medical information, as permitted by law. All disclosures will comply with the HIPAA Privacy Rule and other applicable laws. You may revoke your consent in writing at any time; however, information already shared under your prior consent cannot be retracted. Upon request, you may receive a list of entities to which your information has been disclosed.

YOUR RIGHTS

When it comes to your health information, you have certain rights that apply to your records including substance use disorder (SUD) treatment records. This section explains your rights and some of our responsibilities to help you.

Review your record or get an electronic copy or paper copy of your medical records

  • You can ask to see or get an electronic or paper copy of your health information we maintain about you. You may send your written request to the Compliance Office listed at the end of this Notice. We will provide a copy or summary of your health information, usually within 30 days of your request. We may charge a reasonable cost-based fee.
  • You may also request to review your medical record. You will be given access to your records for review along with your treatment provider
  • We may provide a patient portal as one option for patients to electronically access their health information. If we have a patient portal, you may request access by contacting your health care provider. There is no fee for you to access health information through our patient portal.

Ask us to correct your medical record

  • You may ask us to correct health information about you that you think is incomplete or incorrect. You may do this by submitting your request in writing to the Compliance Office listed at the end of this Notice. You must include a reason for the request.
  • We may say “no” to your request, but we will tell you why in writing within 60 days, for example: The information was not created by us;
    • The information is not part of the information kept by or for Centerstone;
    • The information is not part of the information which you would be permitted to review and copy; or
    • The information in the record is accurate and complete.

Request confidential communications

  • You may ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
  • To request confidential communications, you must make your request in writing to the Compliance Office listed at the end of this Notice.
  • We will not ask you for the reason for your request.
  • Your request must specify how or where you wish to be contacted.
  • We will generally approve reasonable requests.

Ask us to limit what we use or share

  • You may ask us not to use or share certain health information for treatment, payment or our operations.
  • We are not required to agree with your request, and we may say “no” if it would affect your care.
  • If you pay for a service or health care item out-of-pocket in full and before the item or service is provided, you may ask us not to share that information with your insurer for the purpose of payment or our operations. We will say “yes” unless a law requires us to share that information.

Get a list of those with whom we have shared your health information

  • You may ask for a list (accounting) of the times we’ve shared your information for 6 years prior to the date you ask and why we share it.
  • We will include all disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make).
  • We will provide one (1) accounting a year free of charge but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Get a copy of the privacy notice

  • You may ask for, and we will promptly provide you with a paper copy of this notice at any time, even if you have agreed to receive the notice electronically.

Choose someone to act for you

  • If you have given someone medical power of attorney or if someone is your legal guardian, that person may exercise your rights and make choices about your health information.
  • We will make sure the person has this authority and can act for you before we take action.

File a complaint if you feel your rights are violated

  • You may file a complaint if you feel we have violated your rights by contacting us using the information on the last page of this Notice.
  • You can file a complaint with the U.S. Department of Health and Human Services, Office of Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington , D.C., calling 1-877-696-6775, or by visiting http://www.hhs.gov/ocr/privacy/hipaa/complaints/
  • We will not retaliate against you for filing a complaint.

YOUR CHOICES

For certain health information, you may tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us to:

  • Share information with your family, close friend, or others involved in your care.
  • Share information in a disaster relief situation.
  • If you are not able to tell us your preference, for example, if you are unconscious, we may go ahead and share your information if we believe it is in your best interest.
  • We may also share information when needed to lessen a serious or imminent threat to health or safety.
  • Centerstone does not create or maintain a facility directory.

In these cases, we never share your information unless you give us written permission:

  • Marketing purposes.
  • Sale of your health information.
  • Most sharing of psychotherapy notes, to the extent such exist.

In the case of fundraising:

  • We may contact you for fundraising efforts, but you may tell us not to contact you again by contacting the Compliance Office listed at the end of this Notice.
  • If you opt out of fundraising communications, it will not affect your care.

EXERCISING YOUR RIGHTS/ MAKING YOUR CHOICES

Any requests and/or exercise of your rights, as described in this Notice, may be made by providing written notice to the Compliance Office listed at the end of this Notice.

  • To Treat You: If permitted by applicable state and federal law, we may use your health information and share it with professionals who are treating you.
  • To Bill for Services: If permitted by applicable state and federal law, we will use and share your health information to bill and get payment from health plans or other entities. Example: We give information about you to your health insurance plan so it will pay for your services.
  • To Run Our Organization: If permitted by applicable state and federal law, we may use and share your health information to run Centerstone and improve the quality of your care; to respond to audits and investigation; for licensing purposes. Example: We use health information about you to manage your treatment and services; to evaluate our performance in providing services.

OTHER USES AND DISCLOSURES

We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We must meet any conditions in applicable law before we may share your information for these purposes. For more information, visit: http://www.hhs.gov /ocr/privacy/hipaa /understanding/consumers/index.html

Help with public health and safety issues

If permitted by applicable state and federal law, we may share health information about you for certain situations such as:

  • Preventing disease
  • Helping with product recalls.
  • Reporting adverse reactions to medications.
  • Reporting suspected abuse, neglect, or domestic violence.
    • Preventing or reducing a serious threat to someone’s health or safety as long as: The disclosure is made to someone able to help prevent the threat, and
    • Only under the conditions described by applicable state law.

Research

  • If permitted by applicable state and federal law, we may use or share your information for health research, provided certain conditions are met.

Comply with the law

  • We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.

Respond to organ and tissue donation requests

  • If permitted by applicable state and federal law, we may share health information about you with organ procurement organizations.

Work with a medical examiner or funeral director

  • If permitted by applicable state and federal law, we may share health information with a coroner, medical examiner, or funeral director when an individual dies.

Address workers’ compensation, law enforcement, and other government requests

If permitted by applicable state and federal law, we may use or share health information about you:

  • For workers’ compensation claims;
  • For law enforcement purposes with a law enforcement official;
  • With health oversight agencies for activities authorized bylaw;
  • For special government functions, such as military and veterans authority, national security, and presidential protective services.

Respond to lawsuits and legal actions

  • We may share health information about you in response to court or administrative orders as permitted by applicable federal and state law.

Communication regarding inmates in correctional facilities

If you are an inmate in a correctional facility or under the custody of a law enforcement official, we may release your health information to the correctional institution or law enforcement official if permitted by applicable federal and state law and the release of the information is necessary:

  • For the correctional facility or institution to provide you with health care; or
  • To protect your health or safety or the health or safety of others; or
  • For the safety and security of the correctional facility or institution.

Communications with family

  • If you receive services in an inpatient or residential setting, we may, as allowed by applicable federal and state law, disclose to a family member or other relative, close person friend or any other person you identify, health information relevant to that person’s involvement to your care or payments related to your care.

National Security Activities for Protection of the President or Other Officials

  • We may share your health information for national security activities for protection of the President or other officials if permitted by federal and state law.

Military Command Authorities

  • We may share your health information with appropriate military command authorities if you are a member of the armed forces and sharing your information is permitted by federal and state law.

Health Information Exchange (HIE)

  • We may use a Health information Exchange (HIE) to exchange electronic health information about you with other healthcare providers or entities that are not part of our healthcare system.
  • Health information exchanged between providers or entities may be stored in their own systems and can be used for the purposes described in this Notice, to coordinate your care and as permitted by law.
  • Unless prohibited by law, you are automatically opted in to such HIEs. If you wish to opt out, you must make a written request, which we will comply with unless disclosure is required by law. If you opt out of participating in these HIEs, your health information will no longer be provided to other health care entities through the HIE. However, your decision does not affect the health information that was exchanged prior to the time you opted out of participation.
  • Note that certain sensitive information requires your consent prior to disclosure for these purposes, such as Part 2 Records, and will not be shared though the HIE unless we have obtained your consent as required by applicable law.

Minors

  • A minor’s health information will be disclosed to their parents or legal guardians acting as personal representative, unless prohibited by law or in circumstances where the law permits us to withhold the information, such as to prevent harm to the minor or another person or in cases of suspected child abuse or neglect.

Breach Notification Purposes

  • If for any reason there is an unsecured breach of your protected health information, we will use the contact information you have provided us with to notify you of the breach, as required by law. In addition, your protected health information may be disclosed as a part of the breach notification and reporting process.

Business Associates

  • We may disclose your health information to Business Associates and/or Qualified Service Organizations contracted by us to perform services on our behalf, which may involve receipt, use or disclosure of your health information.
  • All of our Business Associates must agree to (i) protect the privacy of your health information; (ii) use and disclose the health information only for the purposed for which Business Associate was engaged; (iii) if receiving SUD information, be bound by 42 CFR Part 2 and, if necessary, resist in judicial proceedings any efforts to obtain access to patient records except as permitted by law.
  • We may also share your health information with a Business Associate who will remove information that identifies you so that the remaining information can be used or disclosed for purposed outside of this Notice.

SUBSTANCE USE DISORDER TREATMENT RECORDS

Centerstone offers substance use disorder (SUD) treatment programs and is required to comply with the federal Confidentiality of Substance Use Disorder Patient Records laws and regulations (42 CFR Part 2) that place strict limitations on how these records may be used or disclosed for individuals who are receiving any type of treatment related to substance use disorders.

Substance Use Disorder (SUD) is a condition where a person keeps using a drug or substance even though it’s causing serious problems in their life. These problems can include trouble controlling their use, issues at work or in relationships, using in dangerous situations, and physical effects like needing more of the substance to feel the same effect or having withdrawal symptoms when they stop. This definition does not include tobacco or caffeine use.

We will obtain your written consent to use and disclose your SUD records unless we are permitted to use and disclose SUD records without your written consent consistent with 42 CFR Part 2. The following categories describe the ways that we may use and disclose your SUD records without your written consent under 42 CFR Part 2.

Medical Emergencies

  • We may disclose your SUD records to medical personnel to the extent necessary to meet a bona fide medical emergency in which the your prior written consent cannot be obtained or in which we are closed and unable to provide services or obtain your prior written consent during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time as we resume operations.
  • We will obtain your authorization prior to disclosing your information for non-emergency treatment.

Food and Drug Administration (FDA)

  • We may disclose your SUD records to medical personnel of the Food and Drug Administration (FDA) who assert a reason to believe that your health may be threatened by an error in the manufacturer, labeling, or sale of a product under the FDA jurisdiction, and that your SUD records will be used for the exclusive purpose of notifying you or your physicians of potential danger.

Research

  • Under certain circumstances, we may use and disclose your SUD records without your consent for research purposes.
  • Generally, we would first obtain your written consent; however, in certain circumstances, we may be permitted to use or disclose your SUD records for research purposes without your consent to the extent permitted by HIPAA, FDA and HHS regulations related to human subject research where a waiver of consent has been granted.

Management and Financial Audits and Program Evaluation

  • Under certain circumstances we may use or disclose your SUD records for purposes of the performance of certain program financial and management audits and evaluations.
  • For example, we may disclose your identifying information to any federal, state, or local government agency that provides financial assistance to the Part 2 program or is authorized by law to regulate the activities of Part 2 program.
  • We may also use or disclose your identifying information to qualified personnel who are performing audit or evaluation functions on behalf of any person that provides financial assistance to the Part 2 program, which is a third-party payer or health plan covering you in your treatment, or which is a quality improvement organization (QIO), performing QIO review, the contractors, subcontractors, or legal representatives of such person or QIO, or an entity with direct administrative control over our program.

Fundraising

  • Consistent with provisions elsewhere in this Notice, we may also use or disclose your

Public Health

  • We may use or disclose to a public health authority your SUD records for public health purposes. However, the contents of the information from the SUD records disclosed will be de-identified in accordance with the requirements of the HIPAA regulations, such that there will be no reasonable basis to believe that the information can be used to identify you.

Marketing Purposes

  • Disclosures for marketing purposes which result in our receiving financial payment from a third party whose product or services is being marketed will require your written authorization. This does not include compensation that merely covers our cost of reminding you to take and refill your medication or otherwise communicate about a drug or biologic that is currently prescribed to you.
  • However, we may use or disclose your PHI without your authorization to send you information about alternative medical treatments, our own programs or about health-related products and services that may be of interest to you, provided that we do not receive financial remuneration for making such communications. For example, we may use your PHI to assess your eligibility and propose newly available treatments.
  • When we see you face-to-face, we may also use your PHI without your authorization to encourage you to maintain a healthy lifestyle and get recommended tests, suggest that you participate in a disease management program, provide you with promotional gifts of nominal value, or tell you about government sponsored health programs.

Sale of PHI

  • For example, we cannot share your PHI in exchange for direct or indirect remuneration constituting a sale of PHI under HIPAA without your prior authorization.

WE MAY USE AND DISCLOSE YOUR SUD RECORDS WHEN YOU GIVE YOUR WRITTEN CONSENT SATISFYING THE REQUIREMENTS OF PART 2.

Designated person or entities

  • We may use and disclose your SUD records in accordance with the consent to any person or category of persons identified or generally designated in the consent. For example, if you provide written consent naming your spouse or a healthcare provider, we will share your health information with them as outlined in your consent.

Single Consent for Treatment, Payment or Healthcare Operations

  • We may also use and disclose your SUD records when the consent provided is a single consent for all future uses and disclosures for treatment, payment, and healthcare operations, as permitted by the HIPAA regulations, until such time you revoke such consent in writing.

Central Registry or Withdrawal Management Program

  • We may disclose your SUD records to a central registry or to any withdrawal management or treatment program for the purposes of preventing multiple enrollments, with your written consent. For instance, if you consent to participating in a drug treatment program, we can disclose your information to the related program to coordinate care and avoid duplicate enrollment.

Criminal Justice System

  • We may disclose information from your SUD records to those persons within the criminal justice system who have made your participation in the Part 2 program a condition of the disposition of any criminal proceeding against you.
  • The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which consent was given.
  • For example, if you consent, we can inform a court-appointed officer about your treatment status as part of legal agreement or sentencing conditions.

PDMPs

  • We may report any medication prescribed or dispensed by us to the applicable state prescription drug monitoring program if required by applicable state law.
  • We will first obtain your consent to a disclosure of SUD records to a prescription drug monitoring program prior to reporting of such information.

Civil, administrative, criminal, or legislative proceedings, subpoenas, and court orders

  • Any Part 2 Record, or testimony relaying the content of such SUD records, shall not be used or disclosed in a civil, administrative, criminal, or legislative proceeding against you unless you provide specific written consent (separate from any other consent) or a court issues an appropriate order.
  • Your SUD records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you, the Centerstone ACE or other holder of the Part 2 Record in accordance with Part 2.
  • A court order authorizing use or disclosure of SUD records must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the SUD records may be used or disclosed.

Exceptions

  • 42 CFR Part 2 does not protect health information about a crime committed on our premises or against any of our personnel or about any threat to commit such crime.
  • 42 CFR Part 2 also does not prohibit the disclosure of health information by us to report suspected child abuse or neglect under state law to appropriate state or local authorities.
  • The restrictions on use and disclosure in 42 CFR Part 2 do not apply to communications of SUD records between or among personnel having a need for them in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of patients with substance use disorders if the communications are within the program (or with an entity that has direct administrative control over the program the communications between a part 2 program) and to communications of SUD records to a qualified service organization if needed by the qualified service organization to provide services to or on behalf of the Centerstone ACE (similar to provisions herein regarding Business Associates).

To the extent applicable state law is even more stringent than 42 CFR Part 2 on how we may use or disclose your health information, we will comply with the more stringent state law.

Psychotherapy/SUD Counseling Notes: Psychotherapy/SUD Counseling notes are defined as notes taken to analyze a conversation during a session that are maintained separate from your health record. We do not maintain these types of notes.

NOTICE OF REDISCLOSURE

PHI that is disclosed pursuant to this Notice may be subject to redisclosure by the recipient and no longer protected by HIPAA. Laws applicable to the recipient may limit their ability to use and disclose

the PHI received, such as if they are another covered entity subject to HIPAA or a program or entity subject to 42 CFR Part 2.

Please note that if SUD records are disclosed to us or our business associates pursuant to your written consent for treatment, payment, and healthcare operations, we or our business associates may further use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding PHI.

OUR RESPONSIBILITIES

Privacy and Security: We are required by law to maintain the privacy and security of your protected health information.

Breach Notification: We will let you know promptly if a breach occurs that may have compromised the privacy or security of your health information. In no event will notification be more than 60 days from the date of the breach.

Compliance: We must follow the duties and privacy practices described in this Notice and give you a copy of it.

Revoking your Authorization: We will not use or share your health information other than as described here unless you tell us, in writing, that we may do so. If you tell us that we may, you have the right to change your mind at any time by telling us in writing that you have changed your mind. This will not apply to disclosures that have already occurred with your authorization.

For more information regarding your rights and our responsibilities please contact the Compliance & Privacy Officer for your service location or visit: http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html

CHANGES TO THE TERMS OF THIS NOTICE

We may change the terms of this Notice, and the changes will apply to all information we have about you as well as any information we receive in the future. The new Notice will be available upon request, in our facilities, and on our web site: http://www.centerstone.org. Additionally, we will prominently display a copy of the current notice in common areas within Centerstone’s facilities. Each time you register at or are admitted to Centerstone for treatment or health care services as an inpatient or outpatient, we will offer you a copy of the current notice in effect.

HOW TO MAKE A COMPLAINT IF YOU FEEL YOUR PRIVACY RIGHTS HAVE BEEN VIOLATED

If you believe your privacy rights have been violated, you may file a complaint with Centerstone or with the Secretary of the Department of Health and Human Services. Centerstone will never ask you to waive your right to complain.

To file a complaint with Centerstone please contact the Compliance Office listed at the end of this Notice.

To file a complaint with the Secretary of the Department of Health and Human Services, by sending a letter to 200 Independence Avenue, S.W., Washington, D.

YOU WILL NOT BE PENALIZED FOR FILING A COMPLAINT!

CONTACT INFORMATION

For questions and concerns regarding client privacy, your rights under the federal privacy standards, and our privacy practices please email: NPP.Questions@centerstone.org or call toll-free (855) 450-5770.

Download the notice of privacy practices