CONNECTICUT COMMUNITY CARE
NOTICE OF PRIVACY PRACTICES
Effective Date: reviewed and updated July 1, 2017
THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
We are required by law to maintain the privacy of your health information; to provide you this detailed Notice of our legal duties and privacy practices relating to your health information; to notify you following a reportable breach of unsecured health information; and to abide by the terms of the Notice that are currently in effect.
I. USES AND DISCLOSURES FOR TREATMENT, PAYMENT AND HEALTH CARE OPERATIONS
The following lists various ways in which we may use or disclose your protected health information (“PHI”) for purposes of treatment, payment and health care operations:
For Treatment. We will use and disclose your PHI in providing you with treatment and services and coordinating your care and may disclose your PHI to other providers involved in your care. For example, we may share information with a home health agency to enable it to provide appropriate care. We may receive information from or disclose information to your physician or hospital staff to assist with appropriate treatment. Information may be collected from a hospital or extended care facility in order to plan for appropriate care upon your discharge from the facility. We may provide information to town or municipal social workers or housing officials to help locate appropriate services.
For Payment. We may use and disclose your PHI for billing and payment purposes. We may disclose your PHI to an insurance or managed care company, Medicare, Medicaid or another third party payor. For example, we may confirm your eligibility for Medicare or Medicaid and provide the Department of Social Services, insurance companies or others with information needed to obtain payment for equipment and services.
For Health Care Operations. We may use and disclose your PHI as necessary for health care operations, such as management, personnel evaluation, education and training and to monitor our quality of care. We may disclose your PHI to another entity with which you have or had a relationship if that entity requests your information for certain of its health care operations or health care fraud and abuse detection or compliance activities. For example, PHI of many clients may be combined and analyzed for purposes such as evaluating and improving quality of care and planning for services.
II. SPECIFIC USES AND DISCLOSURES OF YOUR HEALTH INFORMATION
The following lists various ways in which we may use or disclose your PHI:
Directory. Unless you object, we will include certain limited information about you in our directory, and may disclose information about you by telephone when someone calls and asks for you by name. This information may include your name, the name of your care manager, your town, and a confirmation that you are a client of CCC. Our directory does not include specific medical information about you.
Individuals Involved in Your Care or Payment for Your Care. Unless you object, we may disclose PHI about you to a family member, close personal friend or other person you identify who is involved in your care.
Emergencies. We may use and disclose your PHI as necessary in emergency treatment situations.
As Required By Law. We may use and disclose your PHI when required by law to do so, such as responding to a court order requesting your medical information.
Public Health Activities. We may disclose your PHI for public health activities. These activities may include, for example, reporting to a public health authority for preventing or controlling disease, injury or disability; reporting elder abuse or neglect; or reporting deaths.
Reporting Victims of Abuse, Neglect or Domestic Violence. If we believe that you have been a victim of abuse, neglect or domestic violence, we may use and disclose your PHI to notify a government authority, as authorized by law.
Health Oversight Activities. We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections and licensure actions or for activities involving government oversight of the health care system.
To Avert a Serious Threat to Health or Safety. When necessary to prevent a serious threat to your health or safety or the health or safety of the public or another person, we may use and disclose your PHI, limiting disclosures to someone able to help lessen or prevent the threatened harm.
Judicial and Administrative Proceedings. We may disclose your PHI in response to a court or administrative order. We also may disclose your PHI in response to a subpoena, discovery request, or other lawful process, provided certain conditions are met. These conditions include making efforts to contact you about the request or to obtain an order or agreement protecting the PHI.
Law Enforcement. We may disclose your PHI for certain law enforcement purposes, including, for example, to comply with reporting requirements; to comply with a court order, warrant, or similar legal process; or to respond to certain requests for information concerning crimes.
Research. We may use and disclose your PHI for research purposes if the privacy aspects of the research have been reviewed and approved, if the researcher is collecting information in preparing a research proposal, if the research occurs after your death, or if you authorize the use or disclosure.
Coroners, Medical Examiners, Funeral Directors, Organ Procurement Organizations. We may release your PHI to a coroner, medical examiner, funeral director or, if you are an organ donor, to an organization involved in the donation of organs and tissue.
Disaster Relief. We may disclose your PHI to a disaster relief organization.
Military, Veterans and other Specific Government Functions. If you are a member of the armed forces, we may use and disclose your PHI as required by military command authorities. We may disclose your PHI for national security purposes or as needed to protect the President of the United States or certain other officials or to conduct certain special investigations.
Workers' Compensation. We may use and disclose your PHI to comply with laws relating to workers' compensation or similar programs.
Inmates/Law Enforcement Custody. If you are under the custody of a law enforcement official or a correctional institution, we may disclose your PHI to the institution or official for certain purposes including the health and safety of you and others.
Fundraising Activities. We may use certain limited contact information for fundraising purposes and may provide contact information to a foundation affiliated with our organization, provided that any fundraising communications explain clearly and conspicuously your right to opt out of future fundraising communications. We are required to honor your request to opt out.
Marketing: We may use certain limited contact information to inform you of programs, information or services which you may be interested in. You may opt out of receiving such notifications at any time and we never share or sell your information for marketing unless you give us written permission.
III. USES AND DISCLOSURES WITH YOUR AUTHORIZATION
Except as described in this Notice, we will use and disclose your PHI only with your written Authorization. We will obtain your authorization for any uses and disclosures of your health information for marketing purposes. You may revoke an Authorization in writing at any time. If you revoke an Authorization, we will no longer use or disclose your PHI for the purposes covered by that Authorization, except where we have already relied on the Authorization.
IV. YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION
Listed below are your rights regarding your PHI. These rights may be exercised by submitting a request to CCC. Each of these rights is subject to certain requirements, limitations and exceptions. At your request, CCC will supply you with the appropriate form to complete. You have the right to:
Request Restrictions. You have the right to request restrictions on our use and disclosure of your PHI for treatment, payment, or health care operations. You have the right to request restrictions on the PHI we disclose about you to a family member, friend or other person who is involved in your care or the payment for your care. We are not required to agree to your requested restriction (except that if you are competent you may restrict disclosures to family members and friends). If we do agree to your requested restriction, we will comply with your request except as needed to provide you with emergency treatment or in accordance with applicable law. However, if you paid out-of-pocket in full for a health care item or service, and you do not want us to disclose PHI about that item or service to your health plan for purposes of payment or health care operations, we must comply with your request.
Access to Personal Health Information. You have the right to inspect and obtain a copy of your medical and billing records and other information that may be used to make decisions about your care (“your designated record set”), subject to some exceptions. Your request must be in writing. In most cases we may charge a fee for our costs in providing the requested information, consistent with applicable law. To the extent we maintain your designated record set electronically, you also have the right to receive an electronic copy of such information. You may also direct us to send a copy directly to a third-party designated by you. We may charge a fee, consistent with applicable law, for our costs in responding to your request.
Request Amendment. You have the right to request amendment of your PHI for as long as the information is kept by or for CCC. Your request must be made in writing and must state the reason for the requested amendment. We may deny your request for amendment if the information (a) was not created by CCC, unless the originator of the information is no longer available to act on your request; (b) is not part of the PHI maintained by or for CCC; (c) is not part of the information to which you have a right of access; or (d) is already accurate and complete, as determined by CCC. If we deny your request for amendment, we will give you a written denial including the reasons for the denial and an explanation of your right to submit a written statement disagreeing with the denial.
Request an Accounting of Disclosures. You have the right to request an “accounting” of certain disclosures of your PHI. This is a listing of disclosures made by CCC or by others on our behalf, but this does not include disclosures for treatment, payment and health care operations and certain other exceptions. To request an accounting of disclosures, you must submit a request in writing, stating a time period beginning after April 13, 2003 that is within six years from the date of your request. The first accounting provided within a 12-month period will be free; for further requests, we may charge you our costs.
Notification in the Event of a Breach. In the event that your PHI is used, accessed or released in a way that is not consistent with this Notice or allowed under the law, we will promptly notify you of the circumstances and take appropriate steps to limit any damage to your privacy.
Request a Paper Copy of This Notice. You have the right to obtain a paper copy of this Notice, even if you have agreed to receive this Notice electronically. You may request a copy of this Notice at any time. In addition, you may obtain a copy of this Notice at our website, www.ctcommunitycare.org.
Request Confidential Communications. You have the right to request in writing that we communicate with you concerning your health matters in a certain manner. For example, you may ask us to contact you at a specific phone number. We will accommodate your reasonable requests.
V. SPECIAL RULES REGARDING DISCLOSURE OF PSYCHIATRIC, SUBSTANCE ABUSE AND HIV-RELATED INFORMATION
Under Connecticut or federal law, additional restrictions may apply to disclosures of health information that relates to care for psychiatric conditions, substance abuse or HIV-related testing and treatment. This information may not be disclosed without your specific written permission, except as may be specifically required or permitted by Connecticut or federal law.
VI. FOR FURTHER INFORMATION OR TO FILE A COMPLAINT
If you have any questions about this Notice or would like further information concerning your privacy rights, please contact your care manager or the CCC Privacy Officer. If you believe that your privacy rights have been violated, you may file a complaint in writing with CCC or with the Office for Civil Rights in the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.
To file a complaint with CCC, contact the CCC Privacy Officer at Connecticut Community Care, 43 Enterprise Drive, Bristol, CT 06010; or by phone at 860-589-6226. To file a complaint with the Office for Civil Rights, send your written complaint to the OCR Regional Manager by mail to Office for Civil Rights--Region I, U.S. Department of Health and Human Services, J.F. Kennedy Federal Building - Room 1875, Boston, MA 02203, by fax to (617) 565-3809 or by email to OCRComplaint@hhs.gov.
VII. CHANGES TO THIS NOTICE
We reserve the right to change this Notice and to make the revised or new Notice provisions effective for all PHI already received and maintained by CCC as well as for all PHI we receive in the future. We will post a copy of the current Notice at CCC. We will provide a copy of the revised Notice upon request.
HIPAA-01, rev. 7-17