HIPAA Policy
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
American Addiction Centers, its facilities and subsidiaries, and all associates are committed to providing you with quality behavioral healthcare services. An important part of that commitment is protecting your health information according to applicable law. This notice (“Notice of Privacy Practices”) describes your rights and our duties under Federal Law.
Definitions
- Payment: “Payment” means activities that we undertake as a provider to obtain reimbursement for the provision of treatment services to you which include, but are not limited to: determinations of eligibility or coverage such as coordination of benefits, and processing health benefit claims.
- Protected Health Information: “Protected health information (PHI)” is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition; the provision of healthcare services; or the past, present or future payment for the provision of healthcare services to you.
- Treatment: “Treatment” refers to the provision, coordination or management of healthcare and related services on your behalf, including the coordination or management of healthcare with a third party; consultation between American Addiction Centers, its facilities, and subsidiaries and other healthcare providers relating to your care; or the referral by American Addiction Centers, its facilities and subsidiaries of your care to another healthcare provider.
Patient/Client Rights
The following are the rights that you have regarding PHI that we maintain about you. Information regarding how to exercise those rights is also provided. Protecting your PHI is an important part of the services we provide you. We want to ensure that you have access to your PHI when you need it and that you clearly understand your rights as described below.
Right to Notice
You have the right to adequate notice of the uses and disclosures of your PHI, and our duties and responsibilities regarding same, as provided for herein. You have the right to request both a paper and electronic copy of this Notice. You may ask us to provide a copy of this notice at any time. You may obtain this notice on our website at www.treatmentsolutions.com or from facility staff or our Privacy Official.
Right of Access to Inspect and Copy
You have the right to access, inspect and obtain a copy of your PHI for as long as we maintain it as required by law. This right may be restricted only in certain limited circumstances as dictated by applicable law. All requests for access to your PHI must be made in writing. Under a limited set of circumstances, we may deny your request. Any denial of a request to access will be communicated to you in writing. If you are denied access to your protected health information, you may request that the denial be reviewed. Another licensed health care professional chosen by American Addiction Centers will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the decision made by the designated professional. If you are further denied, you have a right to have a denial reviewed by a licensed third party healthcare professional (i.e. one not affiliated with us). We will comply with the decision made by the designated professional.
We may charge a reasonable, cost-based fee for the copying and/or mailing process of your request. As to PHI which may be maintained in electronic form and format, you may request a copy to which you are otherwise entitled in that electronic form and format if it is readily producible, but if not, then in any readable form and format as we may agree (e.g. PDF). Your request may also include transmittal directions to another individual or entity.
Right to Amend
If you believe the PHI we have about you is incorrect or incomplete, you have the right to request that we amend your PHI for as long as it is maintained by us. The request must be made in writing and you must provide a reason to support the requested amendment. Under certain circumstances we may deny your request to amend, including but not limited to, when the PHI: 1. was not created by us; 2. is excluded from access and inspection under applicable law; or 3. is accurate and complete. If we deny amendment, we will provide the rationale for denial to you in writing. You may write a statement of disagreement if your request is denied. This statement will be maintained as part of your PHI and will be included with any disclosure. If we accept the amendment we will work with you to identify other healthcare stakeholders that require notification and provide the notification.
Right to Request an Accounting of Disclosures
We are required to create and maintain a prescribed accounting of certain disclosures we made of your PHI. You have the right to request a copy of such an accounting made by us during a time period specified by applicable law prior to the date on which the accounting is requested. You must make any request for an accounting in writing. Certain PHI is excluded from an accounting by law and therefore will not be provided. If you request this accounting more than once in a 12 month period, we may charge you a reasonable, cost-based fee for responding to these additional requests. We will notify you of the fee to be charged (if any) at the time of the request.
Right to Request Restrictions
You have the right to request restrictions or limitations on how we use and disclose your PHI for treatment, payment and operations. We are not required to agree to restrictions for treatment, payment and healthcare operations except in limited circumstances. This request must be in writing. If we do agree to the restriction, we will comply with restriction going forward, unless you take affirmative steps to revoke it or we believe, in our professional judgment, that an emergency warrants circumventing the restriction in order to provide the appropriate care or unless the use or disclosure is otherwise permitted by law. In rare circumstances, we reserve the right to terminate a restriction that we have previously agreed to, but only after providing you notice of termination.
Out-of-Pocket Payments
If you have paid out-of-pocket (or in other words, you have requested that we not bill your health plan) in full for a specific item or service, you have the right to request that your PHI with respect to that item or service not be disclosed to a health plan for purposes of payment or healthcare operations, and we will honor that request unless affirmatively terminated by you in writing. This request must be made in writing. You are required to notify all downstream healthcare providers (e.g. a pharmacist) and business associates, including Health Information Exchange(s), of the restriction.
Right to Confidential Communications
You have the right to request that we communicate with you about your PHI and health matters by alternative means or alternative locations. Your request must be made in writing and must specify the alternative means or location. We will accommodate all reasonable requests consistent with our duty to ensure that your PHI is appropriately protected.
Right to Notification of a Breach
You have the right to be notified in the event that we (or one of our Business Associates) discover a breach of any of your PHI.
Right to Voice Concerns
You have the right to file a complaint in writing with us or with the U.S. Department of Health and Human Services if you believe we have violated your privacy rights. We will not retaliate against you for filing a complaint.
Authorizations
You may provide a written authorization or release to use your PHI for any purpose that you deem necessary. You may revoke an authorization or release at any time; the revocation must be in writing. We will honor verbal revocations upon authenticating your identity until a written revocation is obtained. Your revocation will not affect any use or disclosures permitted by your authorization while it was in effect.
Uses and Disclosures
Uses and disclosures of your PHI may be permitted, required, or authorized. The following categories describe various ways that we use and disclose PHI.
We will use and/or disclose your PHI as follows: 1. to ensure that we appropriately provide for your care and treatment; 2. to obtain payment for our services; and 3. as necessary to conduct healthcare operations.
Treatment
Our staff, including doctors, nurses, and clinicians, will use your PHI to provide your treatment care. To coordinate and manage your care, but with a signed authorization, we may disclose your PHI to other providers who become involved in your care.
Payment
Your PHI may be used in connection with billing statements we send you and in connection with tracking charges and credits to your account. Your PHI will be used to check for eligibility for insurance coverage and prepare claims for your insurance company where appropriate. In addition, but with your authorization, we may disclose your PHI to third party payers to obtain reimbursement for services we provided. Such information may consist of information regarding your treatment, the conditions for which you were treated and when you were treated.
Healthcare Operations
We may use and disclose your PHI in order to conduct our healthcare business and to perform functions associated with our business activities. Your PHI may be shared with business associates who perform certain business functions on our behalf such as billing, laboratory analyses, or legal, medical, accounting or other professional services. Healthcare operations may also include accreditation and licensing.
Appointments and Reminders
We may use your PHI to contact you regarding appointment reminders or information about treatment alternatives or health health-related benefits and services that may be of interest to you.
Uses and Disclosures Requiring Your Opportunity to Agree or Object
Under certain circumstances, we may only use and disclose your PHI with your authorization, or in a context wherein we can reasonably infer it, unless you are not present, are incapacitated, or an emergency exists, in which case we are compelled by law to use our professional judgment to determine when to use your PHI, and the extent to which it is used. The following opportunities, though they are not an exhaustive list, are instances of when you will have an opportunity to agree or object.
Individuals Involved in Your Care or Payment of Care
With your written authorization, your PHI may be disclosed to a family member, friend or other person to help with your care. In emergency situations or in situations of your incapacity, and where disclosure, in our clinical judgment would be in your best interests, we will disclose your PHI as minimally necessary.
Other Providers
With your written authorization, we may disclose your PHI to your prior or current health care providers or to those with whom we are trying to coordinate your care. In emergency situations or in situations of your incapacity, and where disclosure, in our clinical judgment would be in your best interests, we will disclose your PHI as minimally necessary (e.g. a necessary medical transfer).
Research
Your PHI will not be disclosed for research purposes without your written authorization. Information without patient/client identifiable data may be used for generic research.
Marketing
We may not use your PHI for marketing purposes or sell your protected health information without your written authorization.
Workers’ Compensation and Disability
With your signed release, your PHI may be disclosed for workers’ compensation, disability or similar programs.
Disaster Relief Purposes
We may disclose your PHI to disaster relief organizations that seek your information to coordinate your care, or to notify family and friends of your location or condition in a disaster. We will provide you with an opportunity to agree or object to such a disclosure whenever practical to do so.
Uses and Disclosures That Do Not Require Your Authorization or Opportunity to Object
The following categories describe ways that we may use and disclose your PHI without your written authorization.
Required by Law
We may use or disclose your PHI to the extent that the use or disclosure is required by law (Federal, state and local). In such cases, the use or disclosure will be limited to uses and disclosures pertaining to the relevant requirements of such law.
Public Health Activities
We may disclose your PHI to government authorities for public health activities and for purposes described as follows:
- Preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions; or, at the direction of a public health authority, to an official of a foreign government agency that is acting in collaboration with a public health authority;
- Reporting child abuse or neglect
- Activities related to the quality, safety or effectiveness of a Food and Drug Administration regulated product or process;
- To persons who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, if we are authorized by law to notify such persons as necessary in the conduct of a public health intervention or investigation.
Health Oversight
We may disclose PHI to a health oversight agency for activities authorized by law such as our agency licensure.
Law Enforcement
We may disclose PHI if asked by law enforcement official if the information is: 1. in response to a court order, subpoena, warrant, summons or similar process; 2. limited information to identify or locate a suspect, fugitive, material witness, or missing person; 3. about criminal conduct on our premises; and 4. In an emergency to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.
Coroners, Medical Examiners and Funeral Directors
We may disclose PHI to a coroner, medical examiner or funeral director for the purpose of identifying a deceased person, determining a cause of death, or otherwise carrying out their duties as authorized by law.
Cadaveric Organ, Eye or Tissue Donation
We may disclose PHI to organizations that procure, bank or transplant organs, eyes or tissues for the purpose of facilitating organ, eye or tissue donation and transplantation.
Threats to Health or Safety
We may use and disclose PHI, consistent with applicable law and standards of ethical conduct, if we have a good faith belief that the use or disclosure is necessary to prevent or minimize a serious and imminent threat to the health or safety of a person or the public.
Military and Veteran Activities
If you are a member of the armed forces, we may disclose PHI as required by military command authorities. We may also disclose PHI to the appropriate foreign authority if you are a member of a foreign military.
National Security and Intelligence Activities
We may disclose PHI to authorized federal officials for intelligence, counter-intelligence, and other national security activities authorized by law.
Data Breach Notification Purposes
We may use or disclose your PHI to provide legally required notices of unauthorized access to or disclosure of your health information.
Judicial and Administrative Proceedings
We may disclose your PHI in response to a court or administrative tribunal order, a subpoena, a discovery request, or other lawful process but only when we have followed procedures required by law.
Secretary of Health and Human Services
We are required to disclose PHI to the Secretary of the U.S. Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA Privacy Rules.
Business Associates
We may disclose your PHI to the extent minimally necessary to Business Associates that are contracted by us to perform health care operations or payment activities on our behalf which may involve receipt, use or disclose of your PHI. All of our business associates are obligated to protect the privacy of protected health information and may use the information only for the purposes for which the business associate was engaged. A written contract will be executed with each business associate, and will be reviewed on a yearly basis, to ensure that the business associate is providing adequate PHI safeguards in conformance with applicable law.
Other Categories
Other uses or disclosures of PHI not covered by this notice or the laws that apply to us will be made only with your written authorization.
Certain Uses and Disclosures of PHI That We Do Not Make
We do not maintain directory information for public disclosure. We do not receive compensation for recommending any health care product or service. We do no fundraising using patient/client PHI.
Our Duties
We are required by law to maintain the privacy of your PHI; provide you with notice of our legal duties and privacy practices with respect to your PHI; and to notify you following a breach of unsecured PHI related to you. We are required to abide by the terms of this Notice of Privacy Practices. This notice is effective as of 9/23/2013 and complies with the Omnibus HIPAA Final Rule. This notice will remain in effect until it is revised. We are required to modify this notice when there are material changes to your rights, our duties, or other practices contained herein.
We reserve the right to change our privacy policy and practices and the terms of this notice, consistent with applicable law and our current business processes, at any time. Any new Notice of Privacy Practices will be effective for PHI that we maintain at that time. Notification of revisions of this notice will be provided as follows: 1. upon request; 2. electronically via our website or via other electronic means; and 3. as posted in our place of business.
In addition to the above, we have a duty to respond to your requests (e.g. those corresponding to your rights) in a timely and appropriate manner. We support and value your right to privacy and are committed to maintaining reasonable and appropriate safeguards for your PHI.
Revisions
We reserve the right to make modifications to our policies and procedures, including this notice, as necessary and appropriate to comply with applicable law, including the standards, implementation specifications, and other requirements of the HIPAA Privacy Rule.
Questions, Requests for Information and Complaints
For questions, requests for information, more information about our privacy policy or concerns, please contact us. Our Privacy Official can be contacted at:
American Addiction Centers
500 Wilson Pike Circle, Suite 360
Brentwood, TN 37027
If you believe your rights have been violated and would like to submit a complaint directly to the U.S. Department of Health & Human Services, then you may submit a formal written complaint to the following address:
U.S. Department of Health & Human Services
Office of Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
877.696.6775
We support your right to privacy of your protected health information. You will not be retaliated against in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.