The information below is inform you about what you can expect from us at the LeafWing Center regarding your Protected Health Information (PHI) and Electronic Protected Health Information (ePHI).
In this notice we use the terms “we,” “us,” and “our” to represent the LeafWing Center and it’s employees.
WHAT IS “PROTECTED HEALTH INFORMATION” (PHI)?
Your protected health information (PHI) is individually identifiable health information, including demographic information (e.g., address), about your past, present or future physical or mental health or condition (e.g., diagnosis), health care services you receive (e.g., treatment information), and past, present or future payment for your health care (e.g., claims information).
PHI may be in oral, written or electronic form (ePHI). Examples of PHI include your treatment record, claims record, enrollment or disenrollment information, and communications between you and your treatment team.
If your PHI is de-identified in accordance with HIPAA standards, it is no longer PHI.
Let us describe our responsibility to protect your PHI:
By law, we must:
- protect the privacy of your PHI.
- tell you about your rights and our legal responsibilities with respect to your PHI.
- notify you if there is a breach of your PHI.
- tell you about our privacy practices and follow our notice currently in effect.
We are serious about these responsibilities and have put in place safeguards (e.g., security awareness training and policies and procedures for staff), technical safeguards (e.g., de-identification, encryption, encrypted hard drives, and passwords), and physical safeguards (such as locked areas storage furniture) to protect your PHI.
Let us tell you about your rights regarding your PHI:
This section tells you about your rights regarding your PHI and describes how you can exercise these rights.
Your right to access and amend your PHI.
Subject to certain exceptions, you have the right to view or get a copy of your PHI that we maintain in records relating to your treatment or decisions about your treatment or payment for your treatment. Requests must be in writing (email preferred). We may charge you a reasonable, cost-based fee for the copies, summary or explanation of your PHI.
If we do not have the record you asked for but we know who does, we will tell you who to contact to request it (e.g., pediatrician/PCP).
If you believe there is a mistake in your PHI or that important information is missing, you may request that we correct or add that information to the record. Requests must be in writing (email preferred), tell us what corrections or additions you are requesting, and why the corrections or additions should be made. We will respond in writing after reviewing your request (i.e., email).
Submit all written requests to the LeafWing Center at [email protected]g.
Your right to choose how we send PHI to you or someone else.
You may ask us to send your PHI to you at a different address (e.g., your work address) or by different means (e.g., fax instead of email).
If your PHI is stored electronically, you may request a copy of the records in an electronic format. You may also make a specific written request to us at the LeafWing Center to transmit a copy of your PHI/ePHI to a designated third party. We may charge a reasonable, cost-based fee.
Your right to an accounting of disclosures of PHI.
You may ask us for a list of our disclosures of your PHI. You are entitled to one disclosure accounting in any 12-month period at no charge. If you request any additional accountings less than 12 months later, we may charge a fee.
- An accounting does not include certain disclosures. For example, disclosures:
- Necessary to carry out treatment, payment and health care operations.
- For which the LeafWing Center had a signed authorization from you;
- Of your PHI/ePHI to you.
- For notifications for disaster relief purposes;
- To persons involved in your care and persons acting on your behalf (e.g., legal guardians for minor children).
- Not covered by the right to an accounting.
Your right to request limits on uses and disclosures of your PHI.
You may request that we limit our uses and disclosures of your PHI for treatment, payment, and treatment care purposes. In the overwhelming number of circumstances, these are the extent of the ways in how we use your PHI/ePHI (treatment, billing, and treatment coordination of care purposes.
You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say ‘no’ if it would affect your treatment. We will consider all submitted requests and, if we deny your request, we will notify you in writing.
Your right to receive a paper copy of this notice.
You also have a right to receive a paper copy of this notice upon request.
How we may use and disclose your PHI/ePHI.
Your confidentiality is important to us. Our clinicians and administrative staff are required to maintain the confidentiality of the PHI/ePHI of our members/clients/students. We have policies and procedures and other safeguards to help protect your PHI from improper use and disclosure.
Sometimes we are allowed by law to use and disclose certain PHI/ePHI without your written permission. Let us briefly describe these uses and disclosures below and give you some examples.
How much PHI/ePHI is used or disclosed without your written permission will vary depending, for example, on the intended purpose of the use or disclosure. Sometimes we may only need to use or disclose a limited amount of PHI/ePHI, such as to send you an appointment reminder or to confirm that you are a health plan member. At other times, we may need to use or disclose more PHI/ePHI such as when we are providing treatment or requesting pre-authorization or authorization for treatment.
Treatment.
This is the most important use and disclosure of your PHI/ePHI. For example, our clinical team, including trainees, involved in your care use and disclose your PHI/ePHI to assess the condition and to evaluate treatment needs. If you need care from health care providers who are not a part of the LeafWing Center team, such as a pediatrician to assist with health care needs, we may disclose your PHI/ePHI to them.
Payment.
Your PHI/ePHI may be needed to permit us to bill and collect payment for treatment that you receive.
Behavioral health care operations.
We may use and disclose your PHI/ePHI for certain behavioral health care operations (e.g., quality assessment and improvement, training and evaluation of health care professionals, licensing, accreditation, and determining premiums and other costs of providing care).
Business associates.
We may contract with business associates to perform certain functions or activities on our behalf, such as payment and health care operations. These business associates must agree to safeguard your PHI/ePHI and we maintain that agreement.
Appointment reminders.
We may use your PHI/ePHI to contact you about appointments for treatment.
Health Information Exchange (coordination of care).
We may share your health information electronically with other organizations where you receive health care. Sharing information electronically is a faster way to get your health information to the health care providers treating you.
Specific types of PHI/ePHI.
There are stricter requirements for use and disclosure of some types of PHI/ePHI —for example, mental health and drug and alcohol abuse patient information, HIV tests, and genetic testing information. However, there are still circumstances in which these types of information may be used or disclosed without your authorization.
Communications with family and others when you are present.
Sometimes a family member or other person involved in your care will be present when we are discussing your PHI with you. If you object, please tell us and we won’t discuss your PHI or we will ask the person to leave.
Communications with family and others when you are not present.
There may be times when it is necessary to disclose your PHI to a family member or other person involved in your care because there is an emergency, you are not present, you lack the decision making capacity to agree or object, or you are a minor. In those instances, we will use our professional judgment to determine if it’s in your best interest to disclose your PHI. If so, we will limit the disclosure to the PHI that is directly relevant to the person’s involvement with your health care. For example, we may allow someone to pick up a prescription for you.
Disclosure in case of disaster relief.
We may disclose your name, city of residence, age, gender, and general condition to a public or private disaster relief organization to assist disaster relief efforts, unless you object at the time.
Disclosures to parents as personal representatives of minors.
In most cases, we may disclose your minor child’s PHI to you. In some situations, however, we are permitted or even required by law to deny your access to your minor child’s PHI. An example of when we must deny such access based on type of health care is when a minor who is 12 or older seeks care for a communicable disease or condition. Another situation when we must deny access to parents is when minors have adult rights to make their own health care decisions. These minors include, for example, minors who were or are married or who have a declaration of emancipation from a court.
Research.
At times, the LeafWing Center engages in important research. Some of our research may involve treatment procedures and some is limited to collection and analysis of behavioral health data. Research of all kinds may involve the use or disclosure of your PHI. Your PHI can generally be used or disclosed for research without your permission if an Institutional Review Board (IRB) approves such use or disclosure. An IRB is a committee that is responsible, under federal law, for reviewing and approving human subjects research to protect the safety of the participants and the confidentiality of PHI.
Public health activities.
Public health activities cover many functions performed or authorized by government agencies to promote and protect the public’s health and may require us to disclose your PHI/ePHI.
For example, we may disclose your PHI/ePHI as part of our obligation to report to public health authorities certain diseases, injuries, conditions, and vital events.
We may use and disclose your PHI/ePHI as necessary to comply with federal and state laws that govern workplace safety.
Behavioral health oversight.
As behavioral health care providers and health plans, we are subject to oversight conducted by federal and state agencies. These agencies may conduct audits of our operations and activities and in that process, they may review your PHI/ePHI.
Workers’ compensation.
We may use and disclose your PHI/ePHI in order to comply with workers’ compensation laws. For example, we may communicate your medical information regarding a work-related injury or illness to claims administrators, insurance carriers, and others responsible for evaluating your claim for workers’ compensation benefits.
Military activity and national security.
We may sometimes use or disclose the PHI/ePHI of armed forces personnel to the applicable military authorities when they believe it is necessary to properly carry out military missions. We may also disclose your PHI/ePHI to authorized federal officials as necessary for national security and intelligence activities or for protection of the president and other government officials and dignitaries.
Required by law.
In some circumstances federal or state law requires that we disclose your PHI to others. For example, the secretary of the Department of Health and Human Services may review our compliance efforts, which may include seeing your PHI/ePHI.
Lawsuits and other legal disputes.
We may use and disclose PHI/ePHI in responding to a court or administrative order, a subpoena, or a discovery request. We may also use and disclose PHI/ePHI to the extent permitted by law without your authorization, for example, to defend a lawsuit or arbitration.
Law enforcement.
We may disclose PHI/ePHI to authorized officials for law enforcement purposes, for example, to respond to a search warrant, report a crime on our premises, or help identify or locate someone.
Serious threat to health or safety.
We may use and disclose your PHI/ePHI if we believe it is necessary to avoid a serious threat to your health or safety or to someone else’s.
Abuse or neglect.
By law, we may disclose PHI/ePHI to the appropriate authority to report suspected child abuse or neglect or to identify suspected victims of abuse, neglect, or domestic violence.
Inmates.
Under the federal law that requires us to give you this notice, inmates do not have the same rights to control their PHI/ePHI as other individuals. If you are an inmate of a correctional institution or in the custody of a law enforcement official, we may disclose your PHI/ePHI to the correctional institution or the law enforcement official for certain purposes, for example, to protect your health or safety or someone else’s.
All other uses and disclosures of your PHI/ePHI require your prior written authorization.
Except for those uses and disclosures described above, we will not use or disclose your PHI without your written authorization. Some instances in which we may request your authorization for use or disclosure of PHI/ePHI are:
Psychotherapy Notes: On rare occasions, we may ask for your authorization to use and disclose “psychotherapy notes”. Federal privacy law defines “psychotherapy notes” very specifically to mean notes made by a mental health professional recording conversations during private or group counseling sessions that are maintained separately from the rest of your medical record. Generally, we do not maintain psychotherapy notes, as defined by federal privacy law.
When your authorization is required and you authorize us to use or disclose your PHI/ePHI for some purpose, you may revoke that authorization by notifying us in writing at any time. Please note that the revocation will not apply to any authorized use or disclosure of your PHI/ePHI that took place before we received your revocation.
How to contact us about this notice or to ask questions about Privacy Practices.
If you have any questions about this notice, please email us to us [email protected]. You also may notify the secretary of the Department of Health and Human Services.
We will not take retaliatory action against you if you file a complaint about our privacy practices.
Changes to this notice.
We may change this notice and our privacy practices at any time, as long as the change is consistent with state and federal law. Any revised notice will apply both to the PHI/ePHI we already have about you at the time of the change, and any PHI/ePHI created or received after the change takes effect. If we make an important change to our privacy practices, we will promptly change this notice and make the new notice available on our website at www.leafwingcenter.org/privacy practices. Except for changes required by law, we will not implement an important change to our privacy practices before we revise this notice.
Effective date of this notice.
This notice is effective on August 12, 2021.