Effective: June 1, 2019

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I. WHAT IS THIS NOTICE?

This Notice describes the privacy practices of Public Health Solutions (”PHS” “we” or “us”). A federal law called “HIPAA” (the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act), requires us to give you this Notice to let you know how PHS may use and disclose your information called “protected health information” or “PHI”.

II. WHO DOES THIS NOTICE APPLY TO?

This Notice applies to all PHS workforce and services you receive at a PHS location or from a PHS program that is covered by HIPAA. Not all of PHS is covered by HIPAA. Only the services and programs that PHS has designated as a part of its “HIPAA-Covered Component” must follow HIPAA and provide you with this Notice. This Notice applies to the following PHS services and programs:

  • PHS Sexual and Reproductive Health Centers;
  • PHS Family Support and Home Visiting Programs;

III. WHY YOU NEED THIS NOTICE

We are committed to maintaining the privacy of your individually identifiable health information which is protected (called “PHI”). Your PHI includes information about the health care and services that you have received from us. We need this information to provide you with the appropriate level of care and also to comply with certain legal obligations we may have.

HIPAA requires that we keep private and confidential any medical information that identifies you. We take this obligation and your privacy seriously and when we need to use or disclose your PHI, we will comply with the terms of this Notice. Anytime we are permitted to or required to share your PHI with others, we only provide the minimum amount of data necessary to respond to the need or request unless otherwise permitted by law.

IV. USES AND DISCLOSURES OF YOUR PHI THAT DO NOT REQUIRE YOUR AUTHORIZATION

We are allowed by law to use and disclose your PHI without your written or other form of authorization under certain circumstances, which are explained below. This means that we do not have to ask you before we use or disclose your PHI for purposes such as to provide you with treatment, to get paid, or for our health care operations. We may also use or disclose your PHI without asking you for other reasons where authorized or required by law. Here are some examples of when HIPAA does not require us to get your prior authorization before we can use or disclosure your PHI:

  • Treatment. We may use and disclose your PHI in order to provide you with medical treatment or other services. Your PHI may be used or disclosed to our doctors, nurses, social workers, and other employees and workforce who are involved in your care and a part of PHS’s HIPAA-Covered Component. In certain instances, we can also use and disclose your PHI to other healthcare professionals who are involved in your treatment without your prior HIPAA authorization, unless another law requires to first ask you for consent.
  • Payment. We may use and disclose your PHI to obtain payment for the medical treatment and other services PHS provides to you. This means that we may provide your health insurance payor with information regarding treatment you received from us, such as laboratory tests, X-Rays or other examinations, so that we may be paid for such services. We may also contact your health insurance payor regarding future treatment or services you may be provided with in order to obtain approval or to find out whether your health plan will pay for the treatment or services.
  • Health Care Operations. We may use and disclose your PHI for our internal health care operations, such as administration, planning, quality improvement, and other activities that help us provide you with quality care. For example, your PHI may be used to help us evaluate our doctors, nurses and employees, or to help us provide them with education and training. Your PHI may also be disclosed to and used by our staff to help us coordinate your care and respond to any concerns you may have.
  • Other Healthcare Providers. We may disclose your PHI to other health care professionals where it may be required by them to treat you, to obtain payment for the services they provided you with or their own health care operations.
  • Disclosures to Relatives, Close Friends, Caregivers. We will obtain your agreement prior to disclosure of your PHI to family members and relatives, close friends, caregivers or other individuals. However, if you are not present or, due to your incapacity or an emergency, you are unable to agree or object to a use or disclosure, we may exercise our professional judgment in order to determine whether such use or disclosure would be in your best interests. Where we would disclose information to a family member, other relatives, or a close friend, we would disclose only that information we believe is directly relevant to his or her involvement with your care or payment related to your care. We may also disclose your PHI in order to notify or assist with notifying such persons of your location, general condition or death. You may at any time request that we do not disclose your PHI to any of these individuals.
  • Public Health Activities. We may disclose your PHI for certain public health activities as required by law. A few examples include:
    • to report health information to public health authorities for the purpose of preventing or controlling disease, injury or disability;
    • to report births and deaths;
    • to report child abuse to public health authorities or other government authorities authorized by law to receive such reports;
    • to report information about products and services under the jurisdiction of the U.S. Food and Drug Administration, such as reactions to medications;
    • to notify you and other patients of any product or medication recalls that may affect you;
    • to alert a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition; and
    • to report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance.
  • Health Oversight Activities. We may disclose your PHI to a health oversight agency such as Medicaid or Medicare that oversees health care systems and delivery, to assist with audits or investigations designed for ensuring compliance with such government health care programs.
  • Victims of Abuse, Neglect, Domestic Violence. Where we have reason to believe that you are or may be a victim of abuse, neglect or domestic violence, we may disclose your PHI to the proper governmental authority, including social or protective service agencies, which may be authorized by law to receive such reports.
  • Judicial and Administrative Proceedings. We may disclose your PHI pursuant to a court order, subpoena or other lawful process in the course of a judicial or administrative proceeding. For example, we may disclose your PHI in the course of a lawsuit you have initiated against another for compensation or damage for personal injuries you received to that person or his insurance carrier.
  • Law Enforcement Officials. We may disclose your PHI to police or other law enforcement officials as may be required by law or pursuant to a court order, subpoena or other lawful process.
  • Decedents. We may disclose your health information to medical coroners for purposes of identifying or determining cause of death or to funeral directors in order for them to carry out their duties as required by law.
  • Workers Compensation. We may use or disclose your PHI to the extent necessary to comply with state law for workers’ compensation or other similar programs, for example, regarding a work-related injury you received.
  • Research. Although generally we will ask for your written authorization for any use or disclosure of your PHI for research purposes, we may use or disclose your PHI under certain circumstances without your written authorization where our research committee has waived the authorization requirement.
  • Health or Safety. We may use or disclose your PHI where necessary to prevent or lessen threat of imminent, serious physical violence against you or another identifiable individual, or a threat to the general public.
  • Military and Veterans. For members of the armed forces and veterans, we may disclose your PHI as may be required by military command authorities. If you are a foreign military personnel member, your PHI may also be released to appropriate foreign military authority.
  • Specialized Government Functions. We may disclose your PHI to governmental units with special functions under certain circumstances. For example, your PHI may be disclosed to any of the U.S. Armed Forces or the U.S. Department of State.
  • National Security and Intelligence Activities. We may disclose your PHI to authorized federal officials for purpose of intelligence, counter-intelligence and other national security activities that may be authorized by law.
  • Protective Services for the President and Others. We may disclose your PHI to authorized federal officials for purposes of providing protection to the President of the United States, other authorized persons or foreign heads of state or for purposes of conducting special investigations.
  • Inmates. If you are an inmate in a correctional institution or otherwise in the custody of law enforcement, we may disclose your PHI about you to the correctional institution or law enforcement official(s) where necessary:
    • For the institution to provide health care;
    • To protect your health and safety or the health and safety of others; or
    • For the safety and security of the correctional institution.
  • Organ and Tissue Procurement. Where you are an organ donor, we may disclose your PHI to organizations that facilitate or procure organs, tissue or eye donations or transplantation.
  • As Required by Law. We may use or disclose your PHI in any other circumstances other than those listed above where we would be required by state or federal law or regulation to do so.
  • HIO Participation. We may use or disclose your PHI in connection with an electronic Health Information Exchange Organization (HIO) or Regional Health Information Organization (RHIO) that we may participate in. Other health care providers, such as physicians, hospitals and other health care facilities, may have access to your information in the HIE/RHIO for treatment and other purposes to the extent permitted by law. You will be afforded the opportunity to give or deny your Affirmative Consent to have your information accessed in the HIO/RHIO. You have the right to decline to participate in the HIO/RHIO and we will provide you with this right at the earliest opportunity. If you choose not to participate in the HIO/RHIO, we will not use or disclose any of your information in connection with the HIO/RHIO.

V. USES AND DISCLOSURES OF YOUR PHI THAT REQUIRE YOUR WRITTEN AUTHORIZATION

In general, we will need your specific written authorization to use or disclose your PHI for any purpose other than those listed above in Section III. For example, we would need your separate written authorization to disclose psychotherapy notes, or would need you to indicate on the HIPAA Authorization Form that we may send you marketing materials. Likewise, if you are a minor and you have received certain emancipated treatment, we may require your written authorization prior to disclosing information related to that emancipated treatment to your parents or guardians.

We may also be required to seek your specific written authorization where stronger state privacy laws may apply to certain categories of your sensitive information unless the use or disclosure would be otherwise permitted or required by law as described above. We will follow these stricter state laws where they may apply stronger privacy protections to certain categories of your PHI.

  • HIV/AIDS information. We generally must obtain your specific written authorization prior to disclosing your HIV/AIDS related information. There are certain purposes, however, for which we may be permitted to release your HIV/AIDS information without obtaining your specific written authorization. For example, we may release information regarding your HIV/AIDS status to your insurance company or HMO for purposes of receiving payment for services we provided you without a specific authorization to do so. Other instances where we may use or disclose HIV/AIDS information without your specific authorization include: for your diagnosis and treatment; disease prevention and control to authorized federal or state health officers, organ procurement or transplantation purposes; or for purposes of identifying a contact who is at significant risk of infection in accordance with applicable laws.
  • Psychotherapy notes. We must obtain your specific written authorization prior to disclosing any psychotherapy notes unless otherwise permitted by law. Psychotherapy notes are separate notes made by a mental health professional documenting a private counseling session or group/joint/family counseling session.
  • Mental health information. We must obtain your specific written authorization prior to disclosing certain mental health information unless we would otherwise be required to disclose such information by law.
  • Drug and alcohol information. We must obtain your specific written authorization prior to disclosing information related to drug and alcohol treatment or rehabilitation such as where you received drug or alcohol treatment at a federally funded treatment facility or program.
  • Genetic test results information. We generally must obtain your specific written authorization prior to obtaining or disclosing your genetic test results information, or using or disclosing your genetic information for treatment, payment or health care operations purposes. For example, before conducting any genetic testing, we will ask for your written authorization to conduct such testing, to whom you wish to have the results disclosed to, and the purposes for such testing (including treatment, payment and healthcare operations purposes). If you have given your Affirmative Consent to participate in one or more HIO/RHIOs, your genetic information may be used and disclosed consistent with that Affirmative Consent. We may otherwise use or disclose your genetic information, or the genetic information of your child, without your written authorization only where it would be permitted or required by law.
  • Marketing activities. We must obtain your specific written authorization in order to use any of your PHI to mail or email you marketing materials. However, we may provide you with marketing materials face-to-face without obtaining authorization, in addition to communicating with you about services or products that relate to your treatment, case management, or care coordination, alternative treatments, therapies, providers or care settings. If you do provide us with your written authorization to send you marketing materials, you have a right to revoke your authorization and may do so at any time. If you wish to revoke your authorization, please contact the Privacy Officer at 646-619-6676 or in writing to Privacy Officer, Public Health Solutions, 40 Worth Street, 4th Floor, New York, NY 10013.
  • Activities where we receive money for exchanging PHI. For certain activities in which we would receive money (remuneration) directly or indirectly from a third party in exchange for your PHI, we must obtain your specific written authorization prior to doing so. However, we would not require your authorization for activities such as for treatment, public health or research purposes. You have a right to revoke your authorization at any time. If you wish to revoke your authorization, please contact the Privacy Officer at 646-619-6676 or in writing to Privacy Officer, Public Health Solutions, 40 Worth Street, 5th Floor, New York, NY 10013.

VI. YOUR RIGHTS REGARDING YOUR PHI

  • Right to Inspect/Copy PHI. You have the right to inspect and request copies of your PHI that we maintain. For PHI that we maintain in any electronic designated record set, you may request a copy of such PHI in a reasonable electronic format. If readily producible. However, under limited circumstances, you may be denied access to a portion of your records. For example, if your doctor believes that certain information contained within your medical record could be harmful to you, we would not release that information to you. Please contact PHS’ Compliance Officer if you would like to inspect or request copies of your PHI from us. We may charge you a reasonable fee for paper copies of your PHI or the amount of our reasonable labor costs for a copy of your PHI in an electronic format.
  • Right to Confidential Communications. You have the right to make a reasonable written request to receive your PHI by alternative and reasonable means of communication or at alternative reasonable locations.
  • Right to Receive Paper Copy of NPP. You may at any time request a paper copy of this Notice, even if you previously agreed to receive this Notice by email or other electronic format. Please contact the Privacy Office to obtain a paper copy of this Notice.
  • Right to Notice of Breach. We take very seriously the confidentiality of our patients’ information, and we are required by law to protect the privacy and security of your PHI through appropriate safeguards. We will notify you in the event a breach occurs involving or potentially involving your unsecured PHI and inform you of what steps you may need to take to protect yourself.
  • Right to Request Additional Restrictions. You have the right to request restrictions be placed on our use and disclosure of your PHI, such as:
    • For treatment, payment and health care operations,
    • To individuals involved in your care or payment related to your care, or
    • To notify or assist individuals locate you or obtain information about your condition.
  • Although we will carefully consider all requests for additional restrictions on how we will use or disclose your PHI, we are not required to grant your request unless your request relates solely to disclosure of your PHI to a health plan or other payor for the sole purpose of payment or health care operations for a health care item or service that you or your representative have paid us for in full and out-of-pocket. Requests for restrictions must be in writing. Please contact the Privacy Office if you wish to request a restriction.
  • Right to Request Amendment. You may request that we amend, or change, your PHI that we maintain by contacting PHS’ Compliance Officer. We will comply with your request unless:
    • We believe the information is accurate and complete;
    • We maintain the information you have asked us to change but we did not create or author it, for example, your medical records from another doctor were brought to us and incorporated into your medical records with our doctors;
    • The information is not part of the designated record set or otherwise unavailable for inspection.
    • Requests for amendments must be in writing. Please contact the Privacy Office if you wish to request an additional restriction on a use/disclosure of your PHI.
  • Right to Revoke Authorization. You may at any time revoke your authorization, whether it was given verbally or in writing. You will generally be required to revoke your authorization in writing by contacting our Privacy Office. Any revocation will be granted except to the extent we may have taken action in reliance upon your authorization.
  • Right to Accounting of Disclosures. You may request an accounting of certain disclosures we have made of your PHI within the period of six (6) years from the date of your request for the accounting. The first accounting you request within a period of twelve (12) months is free. Any subsequently requested accountings may result in a reasonable charge for the accounting statement. Please contact the Privacy Office if you wish to request an accounting of disclosures. We will generally respond to your request in writing within thirty (30) days from receipt of the request.

VII. INFORMATION REGARDING THE LENGTH AND DURATION OF THIS NOTICE

We will abide by the terms of this Notice as is currently in effect, however, we may change this notice at any time. Changes to this Notice will apply to all PHI that we maintain. However, if we do change this Notice, we will only make changes to the extent permitted by law. We will also make the revised Notice available to you by posting it in a place where all individuals seeking services from us will be able to read the Notice. You may obtain the new Notice in hard copy as well from our Privacy Officer.

VIII. COMPLAINTS/ADDITIONAL INFORMATION

You may contact our Privacy Officer at any time if you wish any additional information or have questions concerning this Notice or your PHI. If you feel that your privacy rights have been or may have been violated, you may also contact our Privacy Office OR file a written complaint with the Office of Civil Rights of the U.S. Department of Health and Human Services. We will NOT retaliate against you if you file a complaint with us or the Office of Civil Rights. If you wish to file a written complaint with the Office of Civil Rights, please contact the Privacy Office and we will provide you with the contact information.

IX. OUR CONTACT INFORMATION

You may contact us with any concerns or for additional information regarding our privacy practices by calling the PHS Privacy Officer at 646-619-6676 or in writing to:

Public Health Solutions

Attn: Privacy Officer

40 Worth St., 5th floor

New York, New York, 10013