June 23, 2020 Important Message Update:
HIPAA breach discovered at the Philadelphia DBHIDS
(Updated June 23, June 15; Original Posting June 1, 2020)
This notice describes how your medical information may be used and disclosed and how you can get access to this information. Please review it carefully.
CBH is required by law to provide you with this Notice so that you will understand how we may use or share your information. Your information includes financial and health information and is referred to in this Notice as “Protected Health Information” (“PHI”) or simply “health information.” We are required to adhere to the terms outlined in this Notice.
When It Comes To Your PHI, You Have Certain Rights
Although your health record is the property of CBH, the information belongs to you. You have the following rights regarding your health information:
- Right to Inspect and Copy. With some exceptions, you have the right to review and copy your health information.
- Right to Amend. If you feel that health information in your record is incorrect or incomplete, you may ask us to amend the information.
We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:
- Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
- Is not part of the health information kept by CBH; or
- Is accurate and complete.
- Right to an Accounting of Disclosures. You have the right to request an “accounting of disclosures.” This is a list of certain disclosures we made of your health information, other than those made for purposes such as treatment, payment, or health care operations.
- Right to Request Restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you. For example, you may request that we limit the health information we disclose to someone who is involved in your care or the payment for your care. You could ask that we not use or disclose information about a surgery you had to a family member or friend.
We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.
- Right to Request Alternate Communications. You have the right to request that we communicate with you about medical matters in a confidential manner or at a specific location. For example, you may ask that we only contact you via mail to a post office box.
- Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice of Privacy Practices even if you have agreed to receive the Notice electronically. You may ask us to give you a copy of this Notice at any time. [View and download a PDF version of the Notice here.]
- Choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
How We May Use And Disclose Your PHI
The following categories describe the ways that we use and disclose health information. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall into one of the categories.
- For Managing Your Treatment. We may use or disclose health information about you to doctors, nurses, therapists, or other individuals who are involved in your treatment. Different departments within CBH also may share health information about you to coordinate your care. We may also disclose health information about you for treatment activities of a Health Care Provider.
Example: A doctor treating you for a condition asks another doctor about your overall health.
- For Payment. We may use and disclose health information about you so that we are able to pay for the treatment and services you receive.
Example: Health Care Providers may share information about you with CBH so they can be paid for your services.
- For Health Care Operations. We may use and disclose health information about you for our day-to-day health care operations. This is necessary to ensure that all Members receive quality care.
Example: CBH may use health information for quality improvement activities and for professional review, performance evaluation, and training programs. Other aspects of health care operations that may require use and disclosure of your health information include accreditation, certification, licensing and credentialing activities, review and auditing, including compliance reviews, medical reviews, legal services, and compliance programs.
Other Allowable Uses Of Your PHI
- Business Associates. There are some services provided at CBH through contracts with business associates. When these services are contracted, we may disclose your health information so that they can perform the job we’ve asked them to do. To protect your health information, however, we require business associates to appropriately safeguard your information.
- Providers. Many services provided to you, as part of your care under CBH, are offered by Providers in the CBH network. These Providers include a variety of physicians, psychologists, therapists, LCSWs, and others.
- Individuals Involved in Your Care or Payment for Your Care. Unless you object, we may disclose health information about you to a friend or family member who is involved in your care. We may also give information to someone who helps pay for your care. In addition, we may disclose health information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.
- As Required By Law. We will disclose health information about you when required to do so by federal, state, or local law, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
- To the County Administrator. We are permitted to share your health information with the County Administrator or their designee who is responsible for overseeing mental health services and must receive information regarding the City’s mental health operations to carry out his or her responsibilities.
- To Avert a Serious Threat to Health or Safety. We may use and disclose health information about you to prevent a serious threat to your health and safety or the health and safety of the public or another person.
- Organ and Tissue Donation, and Work with a Medical Examiner or Funeral Director. If you are an organ donor, we may disclose health information to organizations that handle organ procurement to facilitate donation and transplantation.
We may also disclose medical information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also disclose medical information to funeral directors as necessary to carry out their duties.
- Research. Under certain circumstances, we may use and disclose health information about you for research purposes to people preparing to conduct a research project so long as the health information they review does not leave CBH.
- Workers’ Compensation. We may disclose health information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
- Reporting Federal and state laws may require or permit CBH to disclose certain health information related to the following:
- Health Oversight Activities: These oversight activities may include audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
- Judicial and Administrative Proceedings: We may disclose health information about you in response to a court or administrative order, a subpoena, or discovery request, but we will make efforts to tell you about the request.
- Reporting Abuse, Neglect, or Domestic Violence: Notifying the appropriate government agency if we believe a Member has been the victim of abuse, neglect. or domestic violence.
- Law Enforcement. We may disclose health information when requested by a law enforcement official:
- In response to a court order, subpoena, warrant, summons, or similar process;
- To identify or locate a suspect, fugitive, material witness, or missing person;
- About you, the victim of a crime, if, under certain limited circumstances, we are unable to obtain your agreement;
- About a death we believe may be the result of criminal conduct;
- About criminal conduct within CBH; and
- In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description, or location of the person who committed the crime.
- Correctional Institution: We may disclose health information necessary for your health and the health and safety of others to a correctional institution or its agents should you become incarcerated.
Other Uses Of Health Information
Other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose health information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.
CBH will never share your information for marketing purposes and will not sell your protected health information to any party.
Changes To This Notice
We will post a copy of the current Notice inside CBH and on the CBH website. We may change the terms of this Notice, and the changes will apply to all information we have about you. The new Notice will be available upon request, on our website, and we will mail a copy to you.
If you are concerned that we have violated your privacy rights, you may contact CBH’s Privacy Officer. You may also send a letter to the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.
Community Behavioral Health
801 Market Street, 7th Floor
Philadelphia, PA 19107
|Office for Civil Rights, DHHS
801 Market Street, Suite 9300
Philadelphia PA 19107
(215) 861-4440 (TDD)
(215) 861-4431 (Fax)
For copies of this Notice or questions about CBH’s confidentiality policy as it relates to protected health information, or to exercise any of your rights as listed in this Notice, please contact the CBH Privacy Officer as indicated above.
We are required by law to maintain the privacy and security of your protected health information. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
Effective Date: May 1, 2020