Privacy Policy (English)

NOTICE OF PRIVACY PRACTICES

Effective Date: January 15, 2021

THIS NOTICE OF PRIVACY PRACTICES DESCRIBES HOW

YOUR MEDICAL, DENTAL, AND MENTAL HEALTH INFORMATION

MAY BE USED OR DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW THIS NOTICE OF PRIVACY PRACTICES CAREFULLY.

Community Health Center of Yavapai (“CHCY”) is required by law to maintain the privacy of your protected health information and to provide you with notice of its legal duties and privacy practices. “Protected health information” or “PHI” is information about you, including demographic information, that may identify you and that relates to your past, present, or future medical, dental, or mental health or condition and related health care services. Protected health information is inclusive of both physical and mental health information. In this Notice of Privacy Practices, “you and your” also refers to your guardian and/or medical/mental health care power of attorney, as appropriate.

This Notice of Privacy Practices describes how CHCY may use or disclose your protected health information to carry out treatment, payment, or health care operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information. CHCY is required to maintain the privacy of your health information as outlined in this Notice of Privacy Practices and its privacy policies.

CHCY will post a copy of this Notice of Privacy Practices in the front office of each CHCY health care facility location and on its website at https://yavapaiaz.gov/chcy. This Notice of Privacy Practices contains its effective date on the first page and bottom of each page thereafter.

YOUR PRIVACY RIGHTS

Right to Review and Obtain a Copy of Your Health Information. You have the right to review and obtain a copy of your health information in CHCY’s records. You must submit a written request to CHCY at 1090 Commerce Drive, Prescott, AZ 86305.

If your request is approved, CHCY will generally provide a copy or a summary of your health information within 30 days of your request. You may receive one copy in any 12-month period at no cost. CHCY may charge you a reasonable fee if you request more than one accounting in any 12-month period.

Your request to review and obtain a copy of your health information may be denied in limited circumstances. If you are denied access to any of your health information, you may request that the denial be reviewed. Information regarding how to initiate the review process will be provided in writing at the time of denial of your access to your health information.

Right to Request Amendment of Health Information. You have the right to request an amendment (correction) to your health information in CHCY’s records if you believe it is incomplete, inaccurate, untimely, or unrelated to your care. You must submit your request in writing, specify the information that you want corrected, and provide a reason to support your request for amendment. All amendment requests should be submitted to CHCY at 1090 Commerce Drive, Prescott, AZ 86305.

If your request for amendment is denied, you will be notified of this decision in writing and given information about your right to appeal the decision. In response, you may do any of the following:

1. File an appeal.
2. File a “Statement of Disagreement” which will be included in your health record.
3. Ask that your initial request for amendment accompany all future disclosures of the disputed health information.

Right to Request Receipt of Communications in a Confidential Manner. You have the right to request that CHCY provides your health information to you by alternative means or at an alternative location. CHCY will accommodate reasonable requests, as determined by CHCY policy, from you to receive communications containing your health information:

1. At a mailing address (e.g., confidential communications address) other than your permanent address.
2. In person, under certain circumstances.

Right to Request Restriction. You may request that CHCY not use or disclose all or part of your health information to carry out treatment, payment or health care operations, or that CHCY not use or disclose all or part of your health information with individuals such as your relatives or friends involved in your care, including use or disclosure for a particular purpose or to a particular person. Please be aware, that because CHCY, and other health care organizations are “covered entities” under the law, CHCY is not required to agree to such restriction, except in the case of a disclosure restricted under 45 CFR § 164.522(a)(1)(vi). To request a restriction, you must submit a written request that identifies the information you want restricted, when you want it to be restricted, to whom you want it restricted, and the extent of the restriction. All requests to restrict use or disclosure should be submitted to CHCY at 1090 Commerce Drive, Prescott, AZ 86305. If CHCY agrees to your request and is not otherwise required by law to use or disclose your protected health information, CHCY will honor the restriction until you revoke it unless the information covered by the restriction is needed to provide you with emergency treatment or the restriction is terminated by CHCY upon notification to you.

Right to Receive an Accounting of Disclosures. You have the right to know and request a copy of what disclosures of your health information have been made to you and to other individuals outside of CHCY. To exercise this right, you must submit a written request to CHCY at 1090 Commerce Drive, Prescott, AZ 86305. CHCY may charge you a reasonable fee if you request more than one accounting in any 12-month period.

HOW CHCY MAY USE OR DISCLOSE YOUR HEALTH INFORMATION

CHCY May Use or Disclose Your Health Information with Your Authorization. CHCY may use or disclose your health information for any purpose you specify in a signed, written authorization you provide CHCY. Your signed, written authorization is always required to disclose your psychotherapy notes, if they exist. If CHCY were to use or disclose your health information for marketing purposes, CHCY would require your signed written authorization. In all other cases, CHCY will not use or make a disclosure of your health information without your signed, written authorization, unless the use or disclosure falls under one of the exceptions by law or as described in this Notice of Privacy Practices. When CHCY receives your signed, written authorization, CHCY will review the authorization to determine if it is valid, and then disclose your health information as requested by you in the authorization.

IMPORTANT NOTE: A copy of your medical records can be provided to family, next-of-kin, or other individuals involved in your care only if CHCY has your signed, written authorization or if the individual is your authorized personal representative.

1. Substance Use Disorder Health Information. CHCY may use or disclose your substance use disorder health information if you provide a specific signed, written authorization to CHCY. The confidentiality and privacy of substance use patients’ records related to the diagnosis, treatment, referral for treatment, or prevention is protected pursuant to federal law at 42 U.S.C. §§ 290dd-2 and 290dd-3 and the regulations at 42 CFR Part 2. Generally, a substance use disorder program may not disclose to anyone outside the program that a client has been or is receiving treatment from CHCY unless:

• You specifically authorize such disclosure in writing. A general authorization for the release of health information is usually not sufficient. A written authorization must specifically indicate that it is for the release of confidential substance use disorder health information.
• The disclosure is allowed by a court order.
• The disclosure is made to medical personnel in a medical emergency.
• The disclosure is made to qualified personnel for research or to oversight agencies, payers, and other authorized auditors for audit or program evaluation.
• The disclosure is made to report suspected child abuse or neglect or there is a danger to self or others.

2. Communicable Disease Health Information. CHCY may use or disclose your communicable disease health information if you provide a specific signed, written authorization to CHCY. Communicable disease related information, including HIV-related information, is kept strictly confidential and released only in conformance with the requirements of state law pursuant to A.R.S. §§ 36-664 and 36-665. A general authorization for the release of medical or other communicable disease related information is usually not sufficient to release HIV health information. A written authorization must specifically indicate that it is for the release of confidential HIV health information.

Revocation of Authorization. If you provide CHCY a signed, written authorization to use or disclose your health information, you may revoke that authorization, in writing, at any time. If you revoke your authorization, CHCY will no longer use or disclose your health information unless the use or disclosure falls under one of the exceptions described in this Notice of Privacy Practices or as otherwise permitted by law. Please understand that your revocation is not retroactive, and your revocation will not have any effect on any action taken by CHCY in reliance on your authorization before it received your written notice of revocation. CHCY is also unable to take back any uses or disclosures CHCY has already made based on your signed, written authorization.

CHCY Will Not Sell Your Health Information. Receipt by CHCY of a fee expressly permitted by law, such as Privacy Act copying fees or other copying fees is not a “sale of health information.”

Genetic Information. CHCY will not use or disclose genetic information to determine your eligibility for or enrollment in health care benefits.

CHCY May Use or Disclose Your Health Information without Your Authorization Unless a Program or Grant Has Other Requirements.

1. Treatment. CHCY may use or disclose your health information without your authorization for treatment or to provide health care services. This includes, but is not limited to, using and disclosing your health information for:

• Emergency and routine health care or services, including but not limited to labs and x-rays; clinic visits; inpatient admissions.
• Contacting you to provide appointment reminders or information about treatment alternatives.
• Seeking placement in community living centers or skilled nursing homes.
• Providing or obtaining home-based services or hospice services.
• Filling and submitting prescriptions for medications, supplies, and equipment.
• Coordination of care, including care from non-CHCY providers.
• Communicating with non-CHCY providers regarding your care through health information exchanges.

Examples:

• A patient sees a CHCY medical provider who prescribes a treatment or medication based on the patient’s health information. A pharmacy or other health care provider uses this information to provide the treatment or fill the prescription.
• A patient sees a CHCY medical provider who shares the patient’s health information with others at CHCY as part of the patient’s treatment team. Physicians, physician assistants, nurse practitioners, nurses, medical assistants, student interns, and mental health therapists at CHCY use this information to provide treatment.
• A patient is taken to a hospital emergency room. Upon request from the emergency room, CHCY discloses health information to the non-CHCY hospital staff that needs the information to treat the patient.
• A patient is seen by his/her health care provider, who wants to review the patient’s last blood work results for comparison. The health care provider uses a local health information exchange to request and receive the results from CHCY to better care for the patient.

2. Payment. CHCY may use or disclose your health information without your authorization for payment purposes or to receive reimbursement for care provided. This includes, but is not limited to, using and disclosing your health information for:

• Determining eligibility for health care services.

• Coordinating benefits with other insurance payers.
• Finding or verifying coverage under a health insurance plan or policy.
• Pre-certifying insurance benefits.
• Billing and collecting for health care services provided by CHCY.
• Reporting to consumer reporting agencies regarding delinquent debt owed to CHCY.

Examples:

• A patient is seeking care at CHCY. CHCY uses the patient’s health information to determine eligibility for health care services.
• CHCY discloses a patient’s health information to a health insurance company to seek and receive payment for the care and services provided to the patient. The patient’s health plan or health insurance company may ask for health information before it will pay for the care and services.
• A patient owes CHCY $1,000 for care over two years. The patient has not responded to reasonable administrative efforts to collect the debt. CHCY releases information concerning the debt, including the patient’s name and address, to a consumer reporting agency for the purpose of making the information available for third-party decisions regarding such things as the patient’s credit or banking services.

3. Health Care Operations. CHCY may use or disclose your health information without your authorization to support the activities related to health care. This includes, but is not limited to, using and disclosing your health information for:

• Improving quality of care or services.
• Conducting patient and beneficiary satisfaction surveys.
• Reviewing competence or qualifications of health care professionals.
• Providing information about treatment alternatives or other health-related benefits and services.
• Conducting health care training programs.
• Managing, budgeting, and planning activities and reports.
• Improving health care processes, reducing health care costs, and assessing organizational performance.
• Developing, maintaining, and supporting computer systems.
• Addressing patient complaints.
• Legal services.
• Conducting accreditation activities.
• Certifying, licensing, or credentialing of health care professionals.
• Conducting audits for compliance programs, including fraud, waste, and abuse investigations.
• Performing process reviews and root cause analyses.

Examples:

• CHCY may use the health information of diabetic patient as part of a quality of care review process to determine if the care was provided in accordance with the established clinical practices.
• CHCY discloses a patient’s health information to attorneys for defense of CHCY in litigation.

4. Eligibility and Enrollment for Federal Benefits. CHCY may use or disclose your health information without your authorization to other programs within CHCY or to State or Federal agencies, including the Internal Revenue Service or Social Security Administration, to determine your eligibility for benefits.

5. Abuse or Neglect. CHCY may use or disclose your health information without your authorization to report suspected child abuse, including child pornography; elder abuse or neglect; or domestic violence to appropriate Federal, State, local, or tribal authorities. This reporting is for the health and safety of a suspected victim and the disclosure will be made consistent with the requirements of applicable federal and state laws.

6. Serious and Imminent Threat to Health and Safety. CHCY may use or disclose your health information without your authorization when necessary to prevent or lessen a serious and imminent threat to the health and safety of the public, yourself, or another person. Any disclosure would only be to someone able to help prevent or lessen the harm, such as a law enforcement agency or the person threatened.

7. Public Health Activities. CHCY may use or disclose your health information without your authorization to public health and regulatory authorities, including the Food and Drug Administration (FDA) and Centers for Disease Control (CDC), for public health activities. This includes, but is not limited to, disclosing your health information for:

• Controlling and preventing disease, injury, or disability.
• Reporting vital events such as births and deaths.
• Reporting communicable diseases such as hepatitis, tuberculosis, sexually transmitted diseases & HIV.
• Tracking FDA-regulated products.
• Reporting adverse events, including reactions to medications, and product defects or problems, including recalls of medications.
• Enabling product recalls, repairs or replacements.

8. Judicial or Administrative Proceedings. CHCY may disclose your health information without your authorization for judicial or administrative proceedings, such as when CHCY receives an order of a court, such as a subpoena signed by a judge, or administrative tribunal, requiring the disclosure.

9. Law Enforcement. CHCY may use or disclose your health information without your authorization to law enforcement agencies for law enforcement purposes when applicable legal requirements are met. This includes, but is not limited to, disclosing your health information for:

• Identifying or apprehending an individual who has admitted to participating in a violent crime.
• Reporting a death where there is a suspicion that death has occurred as a result of a crime.
• Reporting Fugitive Felons.
• Routine reporting to law enforcement agencies, such as gunshot wounds.
• Providing certain information to identify or locate a suspect, fugitive, material witness, or missing person.
• Investigating a specific criminal act.

10. Health Care Oversight. CHCY may use or disclose your health information without your authorization to a governmental health care oversight agency for activities authorized by law, such as audits, investigations, and inspections. Health care oversight agencies include government agencies that oversee the health care system, government benefit programs such as Medicare and Medicaid, other government regulatory programs such as Board of Medical Examiners and Boards of Medicine and Nursing, and agencies that enforce civil rights laws. These agencies many times need your health information to respond to complaints or to ensure compliance with state and federal laws and programs.

11. Cadaveric Organ, Eye, or Tissue Donation. CHCY may use or disclose your relevant health information without your authorization to an Organ Procurement Organization (OPO), or other entity designated by the OPO, for determining suitability of your organs or tissues for organ donation when you are an organ donor and death is imminent. If you have not specified your donation preferences and can no longer do so, your family may make the determination regarding organ donation on your behalf.

12. Coroner or Funeral Services. CHCY may use or disclose your health information without your authorization to a funeral director for burial purposes, as authorized by law upon your death. CHCY may also disclose your health information to a coroner or medical examiner for identification purposes, determining cause of death, or performing other duties authorized by law.

13. Deceased Patient’s Health Information. Upon your death, CHCY may, pursuant to A.R.S. § 12-2294(D), use or disclose your health information, including payment records to your personal representative or administrator of your estate, or if a personal representative or administrator has not been appointed, to the following persons in the following order of priority, unless during your lifetime, you or a person in a higher order of priority has notified CHCY in writing that you opposed the release of the medical records or payment records:

• Your spouse, unless you and your spouse were legally separated at the time of your death.
• The acting trustee of a trust created by you either alone or with your spouse if the trust was a revocable inter vivos trust during your lifetime and you were a beneficiary of the trust during your lifetime.
• Your adult children.
• Your parents.
• Your adult brothers or sisters.
• Your guardian or conservator at the time of your death.

14. Services. CHCY may use or disclose your health information without your authorization to individuals, companies, and others who need to see your health information to perform a function or service for or on behalf of CHCY. An appropriately executed contractual document, if applicable, and business associate agreement must be in place to ensure the individuals, companies, and others will appropriately secure and protect your health information. Business Associates are required by law to protect your health information.

15. Military and Veterans. CHCY may use or disclose your health information without your authorization to military command and federal authorities if you are or were a member of the armed forces.

16. National Security Matters. CHCY may use or disclose your health information without your authorization to authorized Federal officials for conducting national security and intelligence activities. These activities may include protective services for the President and others.

17. Workers’ Compensation. CHCY may use or disclose your health information without your authorization to comply with workers’ compensation laws and other similar programs.

18. Correctional Facilities. CHCY may use or disclose your health information without your authorization to a correctional facility if you are an inmate and disclosure is necessary to provide you with health care, to protect the health and safety of you or others, or for the safety of the correctional facility.

19. Required by Law. CHCY may use or disclose your health information without your authorization for other purposes to the extent required or mandated by law (e.g., to comply with the Americans with Disabilities Act; to comply with a Health Insurance Portability and Accountability Act (HIPAA) privacy or security rule complaint investigation or review by the Department of Health and Human Services).

20. Activities Related to Research. Before CHCY may use or disclose your health information for research, all research projects must go through a special approval process. This process requires an Institutional Review Board (IRB) to evaluate the project and its use of health information based on, among other things, the level of risk to you and to your privacy. For many research projects, including any in which you are physically examined or provided care as part of the research, you will be asked to sign a consent form to participate in the project and a separate authorization form for use and possible disclosure of your health information. However, there are times when CHCY may use or disclose your health information without an authorization, such as, when:

• A researcher is preparing a plan for a research project. For example, researcher needs to examine patient medical records to identify patients with specific medical needs. The researcher must agree to use this information only to prepare a plan for a research study; the researcher may not use it to contact the patient or actually conduct the study. The researcher also must agree not to remove that information from CHCY. These activities are considered preparatory to research.
• The IRB approves a waiver of authorization to use or disclose health information for the research because privacy and confidentiality risks are minimal and other regulatory criteria are satisfied.
• A Limited Data Set containing only indirectly identifiable health information (such as dates, unique characteristics, unique numbers or zip codes) is used or disclosed, with a data use agreement (DUA) in place.

21. Academic Affiliates. CHCY may use or disclose your health information without your authorization to support CHCY’s education and training program for students and residents to enhance the quality of care provided to you.

22. State Prescription Drug Monitoring Program (SPDMP). CHCY may use or disclose your health information without your authorization to a SPDMP in an effort to promote the sharing of prescription information to ensure safe medical care.

23. General Information Disclosures. CHCY may disclose general information about you without your authorization to your family and friends. These disclosures will be made only as necessary and on a need-to-know basis consistent with good medical and ethical practices, unless otherwise directed by you, your medical/mental health care power of attorney, or your personal representative. General information is limited to:

• Verification of identity.
• Your condition described in general terms (e.g., critical, stable, good, or prognosis poor).
• Your location in a CHCY health care facility.

24. Verbal Disclosures to Others While You Are Present. When you are present, or otherwise available, CHCY may disclose your health information to your next-of-kin, family, or to other individuals that you identify. Your medical, dental, or mental health provider may talk to your spouse about your condition while in the exam room with you. Before CHCY makes such a disclosure, the medical, dental, or mental health provider will ask you if you object or if it is acceptable for the person to remain in the room. CHCY will not make the disclosure if you object.

25. Verbal Disclosures to Others When You Are Not Present. When you are not present, or are unavailable, CHCY medical, dental, and mental health providers may discuss your health care or payment for your health care with your next-of-kin, family, or others with a significant relationship to you without your authorization. This will only be done if it is determined that it is in your best interests. CHCY will limit the disclosure to information that is directly relevant to the other person’s involvement with your medical, dental, or mental health care or payment for your care. Examples may include, but are not limited to, questions or discussions concerning your medical, dental, or mental health care; home-based care; medical supplies such as a wheelchair; and filled prescriptions.

CHANGES TO THIS NOTICE OF PRIVACY PRACTICES

CHCY may change the terms of this Notice of Privacy Practices at any time. A new Notice of Privacy Practices will be effective for all protected health information that CHCY maintains at that time. Upon your request, CHCY will provide you with any revised Notice of Privacy Practices. Copies of this Notice of Privacy Practices are available from CHCY’s receptionists, by mail, or by accessing CHCY’s website at https://yavapaiaz.gov/chcy.

RIGHT TO A PRINTED COPY OF THIS NOTICE OF PRIVACY PRACTICES

You have the right to obtain a paper copy of this Notice of Privacy Practices from CHCY at 1090 Commerce Drive, Prescott, AZ 86305. You may also obtain a copy of this Notice of Privacy Practices at the following website: https://yavapaiaz.gov/chcy.

NOTIFICATION OF A BREACH OF YOUR PROTECTED HEALTH INFORMATION

A breach pursuant to 45 CFR § 164.402 means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under 45 CFR Subpart E which compromises the security or privacy of your protected health information. If a breach of any of your protected health information occurs, CHCY will notify you and provide instruction for further actions you may take, if any.

COMPLAINTS

If you are concerned that your privacy rights have been violated, you may file a complaint. Complaints do not have to be in writing, though it is recommended. An individual filing a complaint will not face retaliation by CHCY or CHCY’s employees. Complaints may be filed with:

• CHCY at 1090 Commerce Drive, Prescott, AZ 86305.
• The U.S. Department of Health and Human Services, Office for Civil Rights at http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html.

CONTACT INFORMATION

You may contact CHCY at 1090 Commerce Drive, Prescott, AZ 86305, if you would like further explanation of this Notice of Privacy Practices, have questions regarding the privacy of your health information, or wish to request a copy of program or grant requirements.