Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: 9/1/2020

Privacy Statement

CODAC respects the privacy of our clients’ personal information. This notice explains how we use & disclose the information we gather about you to provide you services & treatment. We call this information protected health information (PHI). PHI is medical & other information about you, including demographic information, that may identify you & that relates to your past, present or future physical or mental health or condition & related health service. You have the right to the confidentiality of your PHI in accordance with the law & our policies.

We understand that information about you & your mental & physical health is personal & confidential. Therefore, protecting information about you is important to us. We create a record relating to the care & services you receive from us. We need this record to provide you with quality care & to comply with certain legal requirements. This notice applies to all records of your care maintained by CODAC, whether made by service/treatment professionals or other personnel.

This notice will tell you about the ways in which we may use & disclose PHI about you. It also describes your rights & certain obligations we have regarding the use & disclosure of PHI. We are required by law to:

Maintain the privacy of PHI;
Notify you, in a manner consistent with state & federal law, of any breaches of your PHI by CODAC &/or any of its Business Associates (BAs);
Give you this notice of our legal duties & privacy practices with respect to PHI; &
Follow the terms of the notice that are currently in effect.

How We May Use & Disclose Information about You

The following sections describe different ways that we may use & disclose your PHI. We will also describe each category of uses or disclosures & give some examples. Some information, such as certain drug & alcohol information, HIV information & mental health information, is entitled to special restrictions. We abide by all applicable state & federal laws related to the protection of this information. Not every use or disclosure will be listed. All of the ways we are permitted to use & disclose your information, however, will fall within one of the following categories:

Treatment: We will use & disclose your PHI to those treatment providers involved in your care. Different programs in our agency also may share your PHI in order to coordinate the different things you need. We may also disclose this information to other healthcare providers that you see outside CODAC to ensure continuity of care.

Payment: We may use and disclose your PHI to bill and collect payment for treatment or services that we provide. For example, before providing therapy services we may need to share information with your health plan to obtain authorization of payment prior to treatment. We may also use and disclose your PHI to confirm the appropriate amount of service to obtain payment for services; for billing, claims management, and collection activities; or to insurance companies providing you with additional coverage. We may also disclose your PHI to consumer reporting agencies relating to the collection of payments owed us, or to another healthcare provider for the payment activities of that healthcare provider. You may, however, request restrictions on disclosures of your PHI to a health plan (or their agent) if it pertains solely to a health care item or service which has been paid out-of-pocket in full and it is not prohibited to do so by law.

Healthcare Operations: We may use & disclose PHI about you in the course of operating CODAC. For example, we may use PHI about you for quality improvement, to review our treatment services & to evaluate the performance of our staff. We may also disclose information about you to personnel for review & training purposes. You may, however, request restrictions on disclosures of your PHI to a health plan (or their agent) if it pertains solely to a health care item or service which has been paid out-of-pocket in full and it is not prohibited to do so by law.

Health Information Exchanges: We may share information that we obtain or create about you with other health care providers or other health care entities, such as your health plan or health insurer, as permitted by law, through a state sponsored health information exchange (HIE). For example, information about your past medical care and current medical conditions and medications can be available to us or to your primary care physician or a hospital, if they participate in a HIE as well. Exchange of health information can provide faster access, better coordination of care and assist providers and public health officials in making more informed decisions. If you later choose to opt-out, you may do so through your state sponsored HIE. Even if you opt-out, public health reporting will still be available to providers as permitted by law.

Appointment Reminders: We may contact you to remind you that you have an appointment with a provider.

Business Associates (BAs) & Qualified Services Organizations (QSOs): CODAC may disclose PHI about you with third parties called Business Associates or Qualified Service Organizations that perform various services (e.g. administrative, legal, accounting, consulting, Health Information Exchanges, etc.) for us. Whenever an arrangement between a BA/QSO & CODAC would involve the use or disclosure of your PHI, we will have a written contract protecting the privacy of your PHI.

Treatment Alternatives: We may contact you to tell you about or recommend possible treatment options or alternatives that may be of interest to you.

Health-related Benefits & Services: We may contact you about benefits or services that we provide.

Fundraising Activities: We may contact you to provide information about fundraising programs & events to support the provision of services & care. In addition to using your contact information (e.g. name, address, phone number & dates of services provided to you), we may now use the department or program where you were treated/served, the name of your provider, the outcome of your treatment & your health insurance status for such fundraising practices. If we do contact you for fundraising activities, the communication you receive will have instructions on how you may ask for us not to contact you again for such purposes, also known as an “opt-out.” If you wish to opt-out, you may do so by contacting us in writing at: CODAC, 1052 Park Ave., Cranston, RI 02910. You may opt back in at any time in the same manner.

News-gathering Activities: We may contact you or one of your family members to discuss whether or not you want to participate in a news story for organizational publications or external news media. Your written authorization is required if we want to use or disclose any of your PHI for these kinds of purposes.

Individuals Involved in Your Care or Payment for Your Care: Unless you say no, we may release PHI to anyone involved in your healthcare, such as a friend, family members, personal representative or any individual you identify. We may also give information to someone who helps pay for your care.

Disaster Relief Efforts: We may disclose PHI about you to an organization assisting in a disaster relief effort so that your family can be notified about your condition, status & location. If you do not want to disclose your PHI for this purpose, we will not make the disclosure unless we must respond to an emergency.

Research & Related Activities: Your PHI may be important to further research efforts & the development of new knowledge. We may use & disclose PHI about our clients for research purposes under specific rules determined by the confidentiality provisions of federal & state law. Researchers may contact you regarding your interest in participating in certain research studies after receiving your authorization or approval of the contact from a special review board. Enrollment in those studies can occur only after you have been informed about the study, had an opportunity to ask questions & indicated your willingness to participate by signing a consent form.

In some instances, federal law allows us to use your PHI for research without your authorization, provided we get approval from a special review board. These studies will not affect your eligibility, benefits, treatment or welfare, & your PHI will continue to be protected. For example, a research study may involve a chart review to compare the outcomes of patients who received different types of treatment.

In addition, federal law allows us to create a “limited data set”—a limited amount of PHI from which almost all identifying PHI, such as your name, address, Social Security number & medical record number, has been removed – & share it with those who have signed a contract promising to use it only for research, health oversight & health care operations purposes & to protect its privacy.

As Required by Law: We will disclose PHI about you when required to do so by federal or state law.

To Avert a Serious Threat to Health or Safety: We may use & disclose PHI about you when necessary to prevent or lessen a serious & imminent threat to your health & safety or the health & safety of the public or another person. Any disclosure would be to help stop or reduce the threat.

Organ, Eye & Tissue Donation: We may release PHI to organizations that handle organ, eye or tissue procurement or transplantation, or to an organ-, eye- or tissue-donation bank, as necessary to help with organ, eye or tissue procurement, transplantation or donation.

Military: If you are a member of the armed forces, we may release PHI about you to military authorities as authorized or required by law. We also may release PHI about foreign military personnel to the appropriate military authority as authorized or required by law.

Workers’ Compensation: We may disclose information about you related to claims for workers’ compensation or similar programs as authorized or required by law. These programs provide benefits for work-related injuries or illness.

Public-health Disclosures: We may disclose PHI about you for public-health purposes. These purposes generally include the following:

Preventing or controlling disease (such as cancer & tuberculosis), injury or disability;
Reporting vital events such as births & deaths;
Reporting child abuse or neglect;
Reporting adverse events or surveillance related to food, medications or defects or problems with products;
Notifying persons of recalls, repairs or replacements of products they may be using;
Notifying a person who may have been exposed to a disease or may be at risk of contracting or spreading a disease or condition;
Reporting to the employer findings concerning a work-related illness or injury or workplace-related medical surveillance; &
Notifying the appropriate government authority as authorized or required by law if we believe a client has been the victim of abuse, neglect, or domestic violence.

Genetic Information: CODAC may not use or disclose any genetic information about you for underwriting purposes, except with regards to health plans that are issuers of long-term care policies.

Health-oversight Activities: We may disclose PHI to governmental, licensing, auditing & accrediting agencies as authorized or required by law.

Legal Proceedings, Lawsuits & Other Legal Actions: We may disclose PHI to courts, attorneys & court employees when we get a court order, subpoena, discovery request, warrant, summons or other lawful instructions from those courts or public bodies & in the course of certain other lawful, judicial or administrative proceedings.

Law Enforcement: If asked to do so & as authorized or required by law, we may release PHI for law enforcement. For example, we may disclose medical information about a suspected victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement, or about a death suspected to be the result of criminal conduct.

Coroners, Medical Examiners & Funeral Directors: In most circumstances, we may disclose PHI to a coroner or medical examiner. We may also disclose PHI to funeral directors as necessary to carry out their duties.

National Security & Intelligence Activities: As authorized or required by law, we may disclose PHI about you to authorized federal officials for intelligence, counterintelligence & other national security activities.

Proof of Immunization: We may disclose proof of immunization to a school about a student or prospective student of the school, as required by State or other law. Authorization (which may be oral) may be obtained from a parent, guardian, or other person acting in loco parentis, or by the adult or emancipated minor.

Protective Services for the U.S. President & Others: As authorized or required by law, we may disclose PHI about you to authorized federal officials so they may conduct special investigations or provide protection to the U.S. president, other authorized persons or foreign heads of state.

Your Rights Regarding Your PHI

Your PHI is the property of CODAC. You have the following rights, however, regarding PHI we maintain about you.

Right to be Notified in the Event of a Breach: You have the right to be notified if your PHI has been “breached,” which means that your PHI has been used or disclosed in a way that is inconsistent with law & results in it becoming compromised. If a breach of your PHI is discovered, you will be notified without unreasonable delay within no later than 45 calendar days.

Right to Review & Receive a Copy: With certain exceptions (e.g. psychotherapy notes, information collected for certain legal proceedings & PHI restricted by law), you have the right to inspect &/or receive a copy of your PHI that is maintained by us or for us in enrollment, payment, claims settlement & case or medical management record systems, or that is part of a set of records that is otherwise used by us to make a decision about you. If your PHI is maintained electronically, you have the right to access that information in a mutually agreed upon readable form & format. If an agreement cannot be reached, we will furnish you with a hardcopy of your record.

We require you to submit your request in writing. If approved, we will complete your request within 30 days. If we are unable to process your request within 30 days, we will notify you of the delay in writing & will complete your request within 30 days of notification, but no longer than 60 days from the date your original request was received. We may charge you a reasonable cost-based fee for preparation of your records, whether hardcopy or electronic.

You have the right to request that your PHI be transmitted to an individual other than yourself. The request must be made in writing, include your signature, or that of an authorized representative, & clearly identify the designated person & where to send the copy of your PHI.

We may deny access, under certain circumstances, such as if we believe it may endanger you or someone else. You may request that we designate a licensed health care professional to review the denial & the decision to deny access may be reversed.

Right to Amend: If you feel that the PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for CODAC in enrollment, payment, claims settlement & case or medical management record systems, or that is part of a set of records that is otherwise used by us to make a decision about you.

We require you to submit your request in writing & to explain why the amendment is needed. If we accept your request, we will tell you we agree & we will amend your records. We cannot change what is in the record. We add the supplemental information by an addendum (an addition to the record). With your assistance, we will notify others who have the incorrect or incomplete PHI. If we deny your request, we will give you a written explanation of why we did not make the amendment & explain your rights. We may deny your request if the PHI:

Was not created by CODAC (unless the person or entity that created the PHI is no longer available to respond to your request);
Is not part of the enrollment, payment, claims settlement & case or medical management record systems maintained by or for us, or part of a set of records that we otherwise use to make decisions about you;
Is not part of the information which you would be permitted to inspect & copy; or
Is determined by us to be accurate & complete.

If we deny your request, we will inform you in writing of the reason(s) for the denial & explain your rights regarding appealing the denial.

Right to an Accounting of Disclosures: You have the right to receive a list of the disclosures we have made of your PHI. This list will not include disclosures made:

To carry out treatment, payment & health care operations;
To you or your personal representative;
Incident to a permitted use or disclosure;
To parties you authorize to receive your PHI;
To your family members, other relatives or friends who are involved in your care, or who otherwise need to be notified of your location, general condition or death;
For national security or intelligence purposes;
To correctional institutions or law enforcement officials; or
As part of a “limited data set”

We require you to submit your request in writing. You must state the time period for which you want to receive the accounting, which may not be longer than six (6) years from the date of your request. The first accounting you request in a 12-month period will be free. We may charge you for responding to any additional requests in that same period.

Right to Request Restrictions: You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment or healthcare operations. You also have the right to request a limit on PHI we disclose about you to someone who is involved in your care or the payment for care, such as a family member or friend. If we agree, we will comply with your request unless the information is needed to provide you emergency treatment. To request restrictions, you must submit your request in writing. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; & (3) to whom you want the limit to apply. We are not required to agree to your request. If we do agree, our agreement must be in writing & we will comply with your request unless the information is needed to provide you emergency treatment or we are required by law to disclose it. We are allowed to end the restriction if we tell you. If we end the restriction, it will affect PHI that was created or received only after we notify you.

Right to Request Confidential Communications: You have the right to request that we communicate with you regarding your PHI in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. If you want us to communicate with you in a special way, you will need to give us details about how to contact you, including a valid alternative address. You also will need to give us information as to how payment will be handled. We may ask you to explain how disclosure of all or part of your PHI could put you in danger. We will comply with your request so long as we can easily provide the information in the way you request. We will honor reasonable requests. However, if we are unable to contact you using the requested ways or locations, we may contact you using any information we have.

Right to Request a Disclosure: You have the right to request that we disclose your PHI for reasons not provided in this Notice. For example, you may want your lawyer to have a copy of your health records. These requests must be provided to us in writing.

Right to a Paper Copy of this Notice: You have a right to a paper copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may also obtain a copy of this notice at our website: www.codacinc.org

Changes to this Notice

We reserve the right to change this notice at any time. If we change this notice, we will provide you with a revised copy of the notice within 60 days of the revision. Any change we make will apply to PHI we already have as well as any information we receive in the future. We will post a copy of the current notice in the CODAC reception areas. This notice supersedes any & all prior versions of this notice. At any time you may request a copy of the Notice currently in effect.

Our Right to Check your Identity

For your protection, we may check your identity whenever you have questions about your treatment or payment activities. We will check your identity whenever we get requests to look at, copy or amend your records or to obtain a list of disclosures of your PHI.

Other uses of PHI

We may not use or disclose your PHI for those purposes not covered by the Notice of Privacy Practices without first obtaining your written authorization (permission). Most uses & disclosures of your PHI for marketing purposes fall within this category & require your authorization (permission) before we may use your PHI for these purposes. Additionally, with certain limited exceptions, we are not allowed to sell or receive anything of value in exchange for your PHI without your written authorization.

Exercise of Rights, Questions or Complaints

If you would like to obtain an appropriate request form to (i) inspect &/or receive a copy of your PHI, (ii) request a restriction on the use or disclosure of your PHI, (iii) request confidential communications, (iv) request a disclosure of your PHI or (v) for other questions, please contact:

CODAC Behavioral Health

Attention: Privacy Officer

1052 Park Ave.

Cranston, RI 02910

(401) 275-5039

If you would like to (i) request an amendment to your PHI, (ii) request an accounting of disclosures of your PHI or (iii) if you believe that your privacy rights have not been followed as directed by federal regulations & state law or as explained in this Notice, please submit you request/concern in writing to:

CODAC Behavioral Health

Attention: Privacy Officer

1052 Park Ave.

Cranston, RI 02910

(401) 275-5039

You may also file a complaint with the Secretary of the U.S. Department of Health & Human Services. You will not be penalized for filing a complaint.

U.S. Department of Health & Human Services

Office of Civil Rights

200 Independence Ave., S.W.

Washington, D.C.

877-696-6775 (toll-free)

This Notice is effective September 1, 2020 & replaces earlier versions.