HUMAN SERVICE AGENCY NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I. Who We Are

This notice describes the Privacy Practices of Human Service Agency and how protected health information (PHI) may be used or disclosed to carry out treatment, payment, health care operations, and for other purposes that are permitted or required by law. The notice also sets out our legal obligations concerning your protected health information, and describes your rights to access and control your protected health information. Protected health information (“PHI”) is individually identifiable health information, including demographic information.

II. Privacy and Confidentiality Obligations

We are required by law to maintain the privacy and confidentiality of your PHI. We are obligated to provide you with a copy of this Notice of our legal duties and of our privacy practices with respect to PHI and we must abide by the terms of this Notice. We reserve the right to change the provisions of our Notice and make the new provisions effective for all PHI that we maintain.

Protected Health Information in connection with Substance Use Disorder Services:

  • 42 CFR Part 2 protects your health information if you are applying for or receiving services (including diagnosis, treatment or referral) for substance use disorder. Generally, if you are applying for or receiving services for substance use disorder, we may not acknowledge to a person outside the program that you attend the program except under certain circumstances that are listed in this notice.

All Protected Health Information, including substance use disorder services:

  • The Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Regulations (45 CFR Parts 160 and 164), also protect our health information whether or not you are applying for or receiving services for substance use disorder. Generally, if you are not applying for or receiving services for substance use disorder, the way we may use and disclose information differs slightly. These differences are listed in this notice.

III. Uses and Disclosures WITH Your Authorization: All Protected Health Information

  • Generally, we may use or disclose your protected health information when you give your authorization to do so in writing on a form that specifically meets the requirements of laws and regulations that apply.
  • There are some exceptions and special rules that allow for uses and disclosures without your authorization or consent. They are listed in section IV.
  • You have the right to revoke your authorization, at any time, except to the extent that we have already taken action upon a valid authorization. The revocation must be in writing and is not effective until Human Service Agency receives it.
  • Human Service Agency does not sell, distribute, barter or transfer client’s protected health information to a third party.
  • It is important to note that a court with appropriate jurisdiction (or other authorized third party) may request or compel you to sign an authorization.

IV. Uses and Disclosures WITHOUT Your Authorization: All Protected Health Information

Even when you have not given your written authorization, we may use and disclose information under the circumstances listed below. This list applies to all protected health information, including the information we get when you are applying for or receiving services for substance use disorder.

If we disclose your PHI to an outside entity in order for that entity to perform a function on our behalf, we must have in place a Business Associate agreement from the outside entity that it will extend the same degree of privacy protection to your information that we must apply to your PHI. The following offers more description and some examples of our potential uses/disclosures of your PHI.

  1. Treatment.We may use or disclose your PHI to doctors, nurses, and other health care personnel who are involved in providing your health care. For example, your PHI will be shared among members of your treatment team. Your PHI may also be shared with outside entities performing ancillary services relating to your treatment, for consultation purposes and/or community mental health agencies involved in provision or coordination of your care.
  2. Payment.We may disclose your PHI to your health insurance provider or a third party for payment of services.
  3. Health Care Operations.We may use/disclose your PHI for the purposes of health care operations that include internal administration, planning and various activities that improve the quality and effectiveness of care. . For example, we may use your PHI in evaluating the quality of services provided. We may disclose information to qualified personnel for outcome evaluation, management audits, financial audits or program evaluation. Release of your PHI to state agencies might also be necessary to determine your eligibility for publicly funded services.
  4. Appointment Reminders.Unless you provide us with alternative instructions, we may contact you to remind you of appointments by phone or send reminders and other similar materials to your home. If you provide us with your email address, we may send appointment reminders by email.
  5. Other allowable uses and disclosures without your authorization, aside from treatment and health care operations, include:
    • Medical Emergencies.We may disclose your PHI to medical personnel to the extent necessary to meet a bona fide medical emergency (as defined by 42 CFR Part 2) this information might include HIV status, if applicable.
    • Minors.We may disclose to a parent or guardian, or other person authorized under state law to act on behalf of a minor, those facts about a minor which are relevant to reducing a threat to the life or physical well being of the minor or any other individual, if the facility Program Director judges that the threat will be reduced by communicating the relevant facts to such a person.
    • Incompetent and Deceased Clients.In such cases, authorization of a personal representative, guardian or other person authorized by applicable state law may be given in accordance with 42 CFR Part 2.
    • DecedentsWe may disclose PHI to a coroner, medical examiner or other authorized person under laws requiring the collection of death or other vital statistics, or which permit inquiry into the cause of death.
    • Judicial and Administrative ProceedingsWe may disclose your protected health information in response to a court order that meets the requirements of federal regulations, 42 CFR Part 2 concerning Confidentiality of Substance Use Disorder Patient Records. Note also that if your records are not actually "patient records" within the meaning of 42 CFR Part 2 (e.g., if your records are created as a result of your participation in the family program or another non-treatment setting), your records may not be subject to the protections of 42 CFR Part 2.
    • Crime on Premises or against Program Personnel.To avert a serious threat to health or safety, we may disclose PHI to law enforcement when a threat is made to commit a crime on the program premises or against program personnel.
    • Child Abuse.We may disclose your protected health information for the purpose of reporting child abuse and neglect and, in Minnesota, prenatal exposure to controlled substances, including alcohol, to public health authorities or other government authorities authorized by law to receive such reports.
    • Duty to Warn.Where the program learns that a patient has made a specific threat of serious physical harm to another specific person or the public, and disclosure is otherwise required under statute and/or common law, the program will carefully consider
    • Audit and Evaluation Activities.We may disclose protected health information to those who perform audit or evaluation activities for certain health oversight agencies, e.g., state licensure or certification agencies or public health authority.

V. Your Individual Rights

  1. Right to Receive Confidential Communications.You may request that we send your information to an alternative address or by an alternative means. We must agree to your request as long as it is reasonably easy for us to do so.
  2. Right to Request Restrictions. You have the right to ask that we limit how we use or disclose your PHI. We will consider your request, but we are not legally bound to agree to the restriction. To the extent that we do agree to any restrictions on our use/disclosure of your PHI, we will put the agreement in writing and abide by it except in emergencies. We cannot agree to limit uses/disclosures that are required by law. However, if you have paid in full for the services, you do have the right to limit disclosure to health plans.
  3. Right to Inspect and Copy Your PHI or receive electronic copies of your PHI:Unless your access is restricted for clear and documented treatment reasons, you have a right to see your PHI upon your written request. We will respond to your request within 15 calendar days with an extension of no more than an additional 15 calendar days upon receipt of request. If we deny your access, we will give you written reasons for the denial and explain any right to have the denial reviewed. If you want copies of your PHI, we may charge a reasonable, cost-based fee. You have a right to choose what portions of your information you want copied and to have prior information on the cost of copying.
  4. Right to Amend Your Records.If you believe there is a mistake or missing information in our record of your PHI, you may request, in writing, that we amend your record. We will respond within 60 days of receiving your request. We may deny the request if we determine that the PHI is: (i) correct and complete; (ii) not created by us and/or not part of our records, or; (iii) not permitted to be disclosed. Any denial will state the reasons for denial and explain your rights to have the request and denial, along with any statement in response that you provide, appended to your PHI. If we approve the request for amendment, we will change the PHI and so inform you, and tell others that need to know about the change in the PHI.
  5. Right to Receive an Accounting of DisclosuresYou have a right to get a list of when, to whom, for what purpose, and what content of your PHI has been released other than instances of disclosure: for treatment, payment and operations; to you, your family, or pursuant to your written authorization. The list also will not include any disclosures made for national security purposes, to law enforcement officials or correctional facilities, or disclosures made before April 2003. We will respond to your written request for such a list within 60 days of receiving it. Your request can relate to disclosures going as far back as six years. There will be no charge for up to one such list each year. There may be a charge for more frequent requests.
  6. Right to Receive a Paper Copy of this Notice.Upon request, you may obtain a paper copy of this notice.
  7. Right to Receive Notification of Breach.You will be notified in the event we discover a breach has occurred such that your protected health information may have been compromised. A risk analysis will be conducted to determine the probability that protected health information has been compromised. Notification will be made no more than 60 days after the discovery of the breach, unless it is determined by a law enforcement agency that notification should be delayed.
  8. Right for Further Information and Complaints.If you desire further information about your privacy and confidentiality rights or feel that we have violated your privacy rights, please contact: Human Service Agency, 123 19th Street NE, Watertown, SD 57201 or call (605)886-0123 and ask to speak with the Privacy Officer.
  9. ComplaintsYou may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. Complaints filed directly with the Secretary must: (1) be in writing; (2) contain the name of the entity against which the complaint is being lodged; (3) describe the relevant problems; and (4) be filed within 180 days of the time you became or should have become aware of the problem. We will not penalize or in any other way retaliate against you for filing a complaint with the Secretary or with us.

Effective Date: This notice was effective 8/27/2024