Notice of Privacy Practices

HIPAA

(Health Insurance Portability and Accountability Act)

Notice of Privacy Practices

Effective: April 14, 2003

Revised:  March 2024

Important Information for

Clients

** This notice describes how medical information about you may be used and disclosed and how you can get access to this Information.

 Please review it carefully.

Our Pledge Regarding Protected Health Information:

“Protected health information” (hereafter referred to as PHI) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health condition and related health care services. We understand that your PHI information is personal. We are committed to protecting your PHI and to sharing minimum necessary information required to accomplish the purpose. We create a record of the care and services you receive at each of our locations. This notice applies to all PHI compiled about you during your care with us. This Notice of Privacy Practices describes how we use and disclose your protected health information to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law (see in the body of the Notice). It also describes your rights to access and control your protected health information. We are required to abide by the terms of this Notice of Privacy Practices. We may change the terms of our notice, at any time. Whenever there is an important or material change to the uses and disclosures of protected health information, we will promptly revise and make available this notice to you.

I. Uses and Disclosures of Protected Health Information (PHI):

Authorization: Except as explained below, we will not use or disclose your protected health information for any purpose unless you have signed a form authorizing a use or disclosure. Even if you authorize us to use or disclose your PHI, you have the right to revoke or terminate that authorization at any time. We will consider your request, but are not required to agree to restrict the information, depending upon the circumstances.

Uses and Disclosures of Protected Health Information: When you come into our agency there are many forms that you will need to complete and data that you will provide. We are required to compile much of this information by payer sources. Your protected health information may be used and disclosed by our agency, our office staff and our business associates outside of our office that are involved in your care and treatment for the purpose of providing services to you. Your protected health information may also be used and disclosed to pay your health care bills and to support the operation of VBHCS. Following are examples of the types of uses and disclosures of your protected health care information that we will make.

These examples are not meant to be exhaustive, but to describe the types of uses and disclosures that may be made by our office.

If there is a Breach (unauthorized release) of your Protected Health Information you will be notified by Volunteer. We will provide you with the cause of the breach, actions taken by Volunteer to prevent another such action. In addition, we will provide you with assistance in protecting your identity.

1. Treatment: We will use and may disclose your protected health information to provide or treat, coordinate, or manage your health care and any related services. This includes the coordination or management of your healthcare. For example, we will share information that you provide with VBHCS supervisors and/or internal team members so they can ensure the best possible outcomes from the services you select.
2. Payment: Your protected health information will be used, as needed, to obtain payment for the services that we provide. This may include certain activities that your health insurance plan or service payment source may undertake before it approves or pays for the health care services we recommend for you, for example: making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity, and undertaking utilization review activities.
3. Healthcare Operations: We may use or disclose, as-needed, your protected health information for our own health care operations in order to provide quality care to all consumers, to assess staff training needs or to ensure the efficiency of program operations. Health care operations include such activities as: Quality assessment and improvement activities; Employee review activities; Training programs including those in which students, trainees, or practitioners in health care learn under supervision; Accreditation, certification, licensing, or credentialing activities; Review and auditing, including compliance reviews, record reviews, legal services and maintaining compliance programs; or Business management and general administrative activities.
4. In certain situations, we may also disclose patient information to another provider or health plan for their health care operations so they may provide continuity of care and/or assist with treatment for you. The law now gives us the right to do this without obtaining your signed release, but we would like to obtain your approval to release your protected health information first, unless it is an emergency situation.
5. E-Mailing of Your PHI: Volunteer may transmit all or part of your PHI by encrypted e-mails as a part of your continuum of treatment.
6. Childhood Immunizations: We may disclose proof of immunizations to schools requiring this information so long as Volunteer has an “informal agreement” to disclose.
7. Other Uses and Disclosures: As part of treatment, payment and health care operations, we may also use or disclose your protected health information for the following purposes: To remind you of an appointment; To inform you of potential treatment alternatives or options; To inform you of health-related benefits or services that may be of interest to you. We will not give your name, address or phone number to any “marketing firm” who wishes to talk with you about a product or sell you something.

II. Uses and Disclosures that require that You are given the Opportunity to Agree or Object:

1. Others Involved in Your Healthcare: We may use or disclose protected health information to your guardian or personal representative or any other person that is directly responsible for your care. If you are unable to agree or object, we may disclose such information as necessary if, based on professional judgment; it would be in your best interest. Finally, we may use or disclose your protected health information to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care.
2. Communication Barriers: We may use and disclose your protected health information if we attempt to obtain an authorization from you but are unable to do so due to substantial communication barriers that we cannot overcome and we determine, using professional judgment, that you intend to provide authorization to share information.

III. Other Required Uses and Disclosures:

We are permitted or required to use or disclose your protected health information in the following situations without your authorization. These situations include:

1. In Connection with Judicial and Administrative Proceedings: We may disclose your protected health information in the course of any judicial or administrative proceedings as required by law or in response to a valid order from a court of law or in response to a signed authorization.
2. For Law Enforcement Purposes: We may disclose your protected health information in cooperation with law enforcement as defined by law.
3. Business Associates: We use business associates to help us provide some services, for example: we may contract with a company to submit our insurance claims. We may disclose protected health information to a business associate so that they can perform the function(s) we have contracted with them to do, and bill you or your third-party payer (insurance company) for services rendered. To protect your PHI, however, we require the business associate to appropriately safeguard your information also.
4. To Report Abuse, Neglect or Domestic Violence: We may notify government authorities if we believe that a client is the victim of abuse, neglect, or domestic violence. We will make this disclosure only when specifically required or authorized by law or when a client agrees to the disclosure.
5. Health Oversight Activities: We may disclose protected health information to a health oversight agency for activities authorized by law, such as audits; civil, administrative or criminal investigations, proceedings or actions; inspections; licensure or disciplinary actions; or other activities necessary for appropriate oversight as authorized by law. We will not disclose your protected health information if you are the subject of an investigation and your health information is not directly related to your receipts of health care or public benefits. If a member of our work force or a business associate believes in good faith that we have engaged in unlawful conduct or otherwise violated professional or clinical standards and are potentially endangering one or more of our clients, workers or the public, they may disclose your PHI to a health oversight agency and/or public health authority.
6. In a Medical or Psychological Emergency: We may disclose protected health information to direct medical service or mental health personnel if a medical or psychological emergency arises.
7. For Research Purposes: We may disclose your protected health information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your protected health information. Unconditional and conditional authorizations can be combined for research participation, provided that you can opt-in to an unconditional research activity, which may encompass future research.
8. When Legally Required: We will disclose your protected health information when we are required to do so by law.
9. Imminent Threat to Health or Safety: Consistent with applicable federal and state laws, we may disclose your protected health information, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
10. Public Health: Consistent with applicable federal and state laws, we may disclose your protected health information to health or legal authorities charged with preventing or controlling disease, injury or disability.
11. Coroners and Funeral Directors: Consistent with applicable federal and state laws, we may disclose your protected health information to help coroners and funeral directors to carry out their duties, for example: a coroner may need to know what medications a deceased person was prescribed to determine the cause of death. Relevant disclosures of a deceased client follow the same rules as when the person was alive. Unless there was an expressed preference to the contrary. There is no HIPAA protection for PHI 50 years after the client’s death.
12. Food and Drug Administration {FDA): We may disclose to the FDA protected health information relating to adverse effects/events with respect to food, drugs, supplements, product or product defects, or post marketing surveillance information to enable the FDA to make product recalls, repairs or replacement.
13. Workers Compensation: We may disclose protected health information to the extent authorized by and to the extent necessary to comply with laws relating to workers compensation or other similar programs established by law.
14. Correctional Institutions: Should you be an inmate of a correctional institution, we may disclose to the institution or agents of the institution, protected health information necessary for your health and the health and safety of other individuals.
15. The Federal Department of Health and Human Services (DHHS): Under the privacy standards, we must disclose your protected health information to DHHS as necessary for them to determine our compliance with the privacy standards.

IV. Your Rights Regarding Protected Health Information:

Following is a statement of your rights with respect to your protected health information and a brief description of how you may exercise these rights.

1. Right to Inspect and Copy: You have the right to inspect and receive a copy of your PHI. We must respond to a written request for the release of PHI within 30 days of the request, with one 30-day extension. We will provide access in the electronic format and form requested by you. However, the released information must be in a mutually agreeable format, a hard copy may be provided if no agreed format can be decided for the electronic PHI. We may have to charge you for the cost of providing copies of your electronic PHI or paper PHI. The charges will be based on the cost to Volunteer, including labor, portable media and supplies. This cost will be in accordance with any applicable state laws. You may inspect and obtain a copy of protected health information about you that is contained in a designated record set. A “designated record set” contains PHI and billing records and any other records that we use for making decisions about you. If we perceive that providing you access to your record constitutes a danger to self or a danger to others, we can use our professional judgment regarding access. Volunteer is allowed to charge additionally for creating an Affidavit of Completeness.
2. Right to Request Restrictions: You have the right to request a restriction of your protected health information. This means you may ask us not to use or disclose any part of your protected health information for the purpose of treatment, payment or healthcare operations. Specifically, we will not disclose information to your health plan that you have paid for out of pocket, unless the disclosure is required for treatment purposes or required by law. You may also request that any part of your case record not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice of Privacy Practices. Your request must state the specific restriction requested and to whom you want the restriction to apply and must be made in writing. We are not required to agree to a restriction that you may request. If we believe it is in your best interest to permit use and disclosure of your protected health information, your protected health information will not be restricted. If we agree to the requested restriction, we may not use or disclose your protected health information in violation of that restriction unless it is needed to provide emergency treatment.
3. Right to Request Confidential Communications: You have the right to request to receive confidential communications from us by alternative means or at an alternative location. You must make this request in writing. We will accommodate reasonable requests. We may also condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. We will not request an explanation from you as to the basis for the request. We are not required to honor your request, but if we do not do so, we will explain in writing.
4. Right to Amend: You may have the right to amend your case record. This means you may request an amendment of the information in your record for as long as we maintain this information. This request must be in writing and provide a reason for the amendment. In certain cases, we may deny your request for an amendment. If we deny your request for amendment, we will do so in writing. You have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal. Please contact your provider if you request an amendment.
5. Right to an Accounting of Disclosures: You have the right to receive an accounting of certain disclosures we have made, if any, of your protected health information. This right applies to disclosures for purposes other than treatment, payment or healthcare operations as described in this Notice of Privacy Practices. By law it excludes disclosures we may have made to you, to family members or friends involved in your care, or for notification purposes. You have the right to receive specific information regarding these disclosures occurring up to 10 years prior to your request. You may request a shorter time frame.
6. Marketing and the Sale of PHI: We cannot provide any marketing or sales information to you or sell your PHI without your written consent and this includes research requests, if remuneration to Volunteer is involved. An exception to the marketing of services or products is a special circumstance involving your physician, a face to face communication, a drug prescribed, or a government sponsored program. We are still allowed to provide you with pamphlets and brochures and this restriction does not apply to disclosure of PHI for treatment or payment for a reasonable cost-based fee.
7. Fundraising Activities: We are a not-for-profit corporation and participate in fundraising activities from time to time. You have the right to opt-out of any communications regarding fundraising activities by Volunteer.
8. Right to Obtain a Copy of This Notice: Although we post a copy in prominent locations throughout our facilities, you have a right to a hard copy upon request. You may also obtain a copy of this notice at our website www.vbhcs.org.

V. Complaints:

You may complain to us or to the Secretary of Health and Human Services if you believe your privacy rights have been violated. You may file a complaint in writing with us by notifying our Privacy Officer of your complaint. You may contact our Privacy Officer Toll Free at 1- 855-372-8345 or by mail to VBHCS ATTN: Privacy Officer, 120 Omni Dr., McMinnville, TN 37110 for further information about the complaint process. There will be no retaliation for reporting or filing a complaint.

Changes to This Notice: We reserve the right to change this notice at any time. We reserve the right to make the revised or changed notice effective for PHI information we already have about you as well as any information we receive in the future, in keeping with the law. Whenever there is an important change to the use and disclosures of protected health information, we will promptly revise and make available the revised Notice. We will also indicate on our facility postings that the notice has been revised.