Privacy Policy

If you have any questions about this Notice please contact the Privacy Officer for DePaul Family Services at 540-265-8923.

This Privacy Notice is provided to you on behalf of DePaul Family Services, Inc. (“DePaul”), as a requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). This Notice describes how we may use and disclose your protected health information (hereinafter, “PHI”) to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your PHI in some cases. “Protected health information” means any recorded or oral information about you, including demographic data, that may identify you, that is created or received by DePaul, and that relates to your past, present or future physical or mental health or condition, the provision of health care to you, or payment for the provision of health care to you.

Our Pledge Regarding Medical Information:
We understand that PHI about you is confidential. We are committed to protecting the privacy of your PHI. We create a record of the services you receive to provide you with quality services and to comply with the law. This Notice applies to all PHI generated or received by our Company.

We are required by law to:

  • make sure that your PHI is kept confidential;
  • give you this Notice of our legal duties and privacy practices with respect to PHI about you; and
  • abide by the terms of the Notice as currently in effect.
THE ORGANIZATIONS AND PEOPLE COVERED BY THIS NOTICE
I. This Notice describes Company’s practices, which extend to:
  • Any social work or support staff authorized to enter information into your records maintained by DePaul (including social workers, clinicians, case a ides, mentors, support staff and finance department staff);
  • All locations of DePaul and all areas of each location (front desk, administration, billing and collection, etc.);
  • Any member of a volunteer group we allow to help you while you are a client;
  • All employees, staff and other personnel that work for DePaul;
  • Our Business Associates with whom we have signed or will sign business associate agreement as required by HIPAA.
II. USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION

The following describes different ways that we are permitted by HIPAA to use and disclose your PHI. For each category of uses or disclosures we will give some examples. All of the ways we are permitted to use and disclose PHI will fall within one of the categories. Disclosure of your PHI for the purposes described in this Notice may be made in writing, orally, or electronically (e-mail), by facsimile or by other means.

A. TREATMENT, PAYMENT AND HEALTH CARE OPERATIONS

  1. For Treatment. We may use and disclose PHI about you to provide services. This includes the coordination or management of your care with a third party. We may disclose PHI about you to social workers, FAPT teams, doctors, nurses, therapists, or other personnel who are involved in taking care of you. For example, we may disclose your PHI to any social services office, health care provider or other referral source who has referred you to us for services. We may also disclose PHI about you for treatment activities of other health care providers. For example, if your doctor determines that you need to be seen by a DePaul clinician for services, we may send him a report of our findings to assist him. Different departments of DePaul also may share PHI about you in order to coordinate the different things you need, such as treatment foster care, mentoring services, clinical services, day support and other services. We also may disclose PHI about you to people outside DePaul who may be involved in your care after you leave DePaul.

  2. For Payment. We may use and disclose PHI about you so that the services you receive at DePaul may be billed to, and payment may be collected from insurance company or other third party. For example, we may need to give Medicaid information about services you received so they will pay us for the services. We may also tell your health plan about a service you are going to receive in order to obtain approval or to determine whether your plan will cover the service. We may also need to disclose information to your health insurance company to demonstrate the medical necessity of the services or, as required by your insurance company, for utilization review. For example, Medicaid or your insurance plan may require copies of our progress notes and treatment plan for the purposes of evaluating medical necessity. We may also disclose PHI to another provider involved in your care for the other provider’s payment activities. This might include disclosures of demographic information to other providers for payment of their services.

  3. For Health Care Operations. We may use PHI about you for our operations. These uses are necessary to run DePaul and provide quality services to all our clients. For example, we may use PHI to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also combine PHI about many of our clients to decide what additional services we should offer, what services are not needed, and whether certain new services are effective. We may also disclose information to DePaul personnel for review and training programs. We may sometimes remove information that identifies you from this set of PHI so others may use it to study health care and health care delivery without learning who the specific clients are. We may also provide your PHI to our accountants, attorneys, consultants and others in order to operate DePaul and to make sure we are complying with the laws that affect us.

    We may also disclose PHI to another entity for health care operations of that entity, if the entity has or had a relationship with you, such as for treatment, and if the PHI pertains to such relationship. Such disclosure is limited to certain activities of the other entity, including quality assessment and related activities, care coordination, reviewing the competency and qualifications of our professionals, conducting training programs, certification, licensure or credentialing activities.

B. USES AND DISCLOSURES BEYOND TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS PERMITTED WITHOUT AUTHORIZATION OR OPPORTUNITY TO OBJECT

Federal privacy rules allow us to use or disclosure your PHI without your authorization for a number of reasons including the following:

  1. Appointment and Client Recall Reminders. We may use and disclose PHI about you to contact you as a reminder you have an appointment at DePaul. This contact may be by phone, in writing, automated appointment system, e-mail, or otherwise and may involve leaving an email, message over an answering machine or which could (potentially) be received or intercepted by others.
  2. As Required by Law. We may disclose PHI about you when required to do so by federal, state or local law.

  3. To Avert a Serious Threat to Health or Safety. We may disclose PHI about you when we believe it is necessary to prevent a serious threat to your health and safety or that of the public. Any disclosure, however, would only be to someone able to help prevent the threat.

  4. Public Health Activities. We may disclose PHI about you to a public authority for public health activities, including the following: · to prevent, control, or report disease, injury or disability; · to report vital events such as births and deaths; · to report child abuse or neglect; · to report reactions to medications or problems with products, track FDA regulated products, enable product recalls, repairs or replacements and to conduct post-marketing surveillance; · to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.
  5. Emergency Situations. We may disclose PHI about you to an organization assisting in a disaster relief effort or in an emergency situation so that your family can be notified about your condition, status and location.

  6. Victims of Abuse, Neglect and Domestic Violence. We may use and disclose PHI about you to notify the appropriate government authorities if we believe you have been a victim of abuse, neglect or domestic violence, but we will only make this disclosure; (i) if you agree; (ii) when required by law; or (iii) when authorized by law and certain other conditions are met.

  7. Health Oversight Activities. We may use and disclose PHI to a health oversight agency for activities authorized by law, including, for example, audits, investigations, inspections and licensure. These activities are necessary for the government to monitor the health care system, government programs and compliance with civil rights laws.

  8. Lawsuits and Administrative Proceedings. If you are involved in a lawsuit or an administrative dispute, we may disclose PHI about you in response to a court or administrative order. We may also disclose PHI pursuant to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made by the party requesting the information to tell you about the request or to obtain an order protecting the information requested. We may also use such information to defend ourselves in any actual or threatened action.

  9. Law Enforcement. We may disclose PHI if asked to do so by a law enforcement official:

    In response to a court order, subpoena, warrant, summons, grand jury subpoenas or similar process;

    • To identify or locate a suspect, fugitive, material witness, or a missing person;
    • About the victim of a crime if he/she agrees and, under certain circumstances, where we are unable obtain the person’s agreement;
    • About a death we believe may be the result of criminal conduct;
    • About criminal conduct at DePaul;
    • In emergency circumstances to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime;
    • About certain types of wound or physical injuries as required by law.

  10. Incidental Disclosures. We may disclose PHI about you incident to otherwise permitted or required disclosures. For example, we may ask you to sign a sign-in sheet when you arrive for an appointment at DePaul as an incident to the treatment process.

  11. To the Secretary of the Department of Health and Human Services. We are required to disclose PHI about you when requested by the Secretary of the Department of Health and Human Services in order to investigate or determine our compliance with HIPAA.

    12. C. USES AND DISCLOSURES PERMITTED WITHOUT AUTHORIZATION BUT WITH YOUR OPPORTUNITY TO OBJECT.

    • Disclosures to Family, Friends or Others Involved in Your Case. We may disclose your PHI to your family members or other person that you identify if it is directly relevant to the person’s involvement in your care. We may also disclose PHI concerning your location, condition or death in connection with trying to locate or notify family members or others involved in your care. Generally, we will obtain your verbal agreement before using or disclosing PHI in this way. However, under certain circumstances, such as in an emergency situation, we may make these uses and disclosures without your express agreement if we feel in the exercise of professional judgment that it is in your best interest.

    • Objection to Disclosures. You may object to these disclosures by indicating the names and relationship of those that you do not want to receive your PHI on the “Acknowledgement of Receipt of Notice of Privacy Practices” form, available from any of our offices. If you are present and do not object to these disclosures, or if you are present and we can infer from the circumstances that you do not object, or if you are not present or able to object and we determine, in the exercise of professional judgment, that it is in your best interests for us to make disclosure of PHI that is directly relevant to the person’s involvement with your care, we may disclose your PHI for such purpose.

    D. USES AND DISCLOSURES WHICH YOU MAY AUTHORIZE

    Other uses and disclosures of PHI not described above in this Notice or the laws that apply to us will be made only with your written authorization. If you provide us with such authorization, you may revoke it, in writing, at any time. If you revoke your authorization, we will no longer disclose PHI about you pursuant to that revoked authorization. You understand that we are unable to take back any disclosures we have already made with your authorization, and that we are required to retain our records of the services that we provided you.

    III. PATIENT RIGHTS THIS SECTION DESCRIBES YOUR RIGHTS AND THE OBLIGATIONS OF DEPAUL REGARDING THE USE AND DISCLOSURE OF PHI.

    You have the following rights regarding PHI we maintain about you:

    A. Right to Inspect and Copy You have the right to inspect and copy your PHI that is contained in a “designated record set.” A “designated record set” contains treatment and billing records and any other records that DePaul uses for making decisions about your services. This does not include information compiled for use in, a civil, criminal, or administrative action; and PHI that is subject to a law that prohibits access to PHI which your doctor identifies as potentially harmful to you or others if it is released.

    To inspect and copy PHI in your designated record set, you must submit your request in writing to DePaul’s Privacy Officer, as identified on the last page of this Notice. If you request a copy of the PHI, we may charge a cost-based fee for the costs of copying, mailing or other supplies associated with your request. We will respond to you within 15 days after receiving your written request.

    We may deny your request to inspect or copy, in certain limited circumstances. If you are denied access to your PHI because a physician has determined it may be dangerous to you or another person, you may request that the denial be reviewed. Another licensed health care professional chosen by DePaul will review your request and the denial. The person conducting the review will not have participated in the first decision to deny your request. We will comply with the outcome of that review.

    B. Right to Amend. If you feel that the PHI in your designated record set is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for DePaul.

    A request for amendment must be made in writing and submitted to DePaul’s Privacy Officer. In addition, you must provide

    • the reasons for the request;
    • a description of the problem – how the information is incorrect or incomplete;
    • a description of the:
      • administrative information to be corrected; and/or
      • medical information to be amended including the source if known, date and provider of service;
    • the specific wording to make the entry correct/complete;
    • identification of persons to be advised of the amendment, including authorization to advise them if necessary.

    The request must be dated and signed by you. We will act on your request within 60 days of receiving it. If we are unable to act on the request within the 60-day period, we may extend the time for action by no more than 30 days by providing you, within the initial 60 days, with a written statement of the reasons for the delay and the date by which we will complete our action on your request.

    We may deny your request for an amendment if it is not made in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

    • Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
    • Is not part of the designated record set kept by or for DePaul;
    • Is not part of the information which you would be permitted to inspect or copy; or
    • Is accurate and complete.
    Our written denial will state the reasons for the denial and explain your right to file a written statement of disagreement. If you don’t file one, you have the right to ask that your request and our denial be attached to all future disclosures of your PHI. If we approve your request, we will make the change to your PHI, tell you we have done it, and tell others whom you authorize us to tell that need to know.

    C. Right to an Accounting of Disclosures. You have the right to an accounting of certain disclosures of your PHI. This right applies to disclosures for purposes other than treatment, payment or health care operations as described in this Notice. We are also not required to account for disclosures that you agreed to by signing an authorization, disclosures for a facility directory or newsletter, to friends or family members involved in your care, incidental disclosures, or certain other disclosures we are permitted to make without your authorization. This list will not include disclosures made for national security purposes, or to correction or law enforcement personnel.

    To request this accounting of disclosures, you must submit your request in writing to DePaul’s Privacy Officer, as identified on the last page of this Notice. Your request must state a time period, which may not be longer than six years and may not include dates before April 14, 2003. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs involved and you may choose to withdraw or modify your request at that time, before any costs are incurred. We will respond within 60 days of receiving your request. If we are unable to respond within the 60 day period, we may extend the period for up to 30 days if we send you a written statement of the reasons for the delay within the initial 60 day period. In certain situations we are required by HIPAA to suspend your right to receive an accounting of disclosures.

    D. Right to Request Restrictions. You have the right to request a limitation on the PHI we disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care, like a family member or friend. For example, you could ask that we not use or disclose PHI about a particular behavior.

    We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment or unless the information is required to be disclosed by law.

    To request such restrictions, you must make your request in writing to DePaul’s Privacy Officer, as identified on the last page of this Notice. In your request, you must tell us
    (i) what information you want to limit;
    (ii) whether you want to limit our use, disclosure or both; and
    (iii) to whom you want the limits to apply, for example, disclosures to your parents or siblings.

    E. Right to Request Confidential Communications. You have the right to request that we communicate with you about PHI in a certain way or at a certain location. For example, you can ask that we only contact you at home or by mail or that we not leave voice mail.

    To request confidential communications, you must make your request in writing to DePaul’s Privacy Officer, as identified on the last page of this Notice. We will not ask you the reason for your request. We will accommodate all reasonable requests so long as we can easily provide it in the format you requested. Your request must specify how or where you wish to be contacted.

    F. Right to a Paper Copy of this Notice. You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice. You may also view a copy of this Notice on our web site at www.depaulfamilyservices.org.

    G. The Right To Get This Notice by E-mail. You have the right to get a copy of this Notice by e-mail. Even if you have agreed to receive this Notice via e-mail, you also have the right to request a paper copy of this Notice.

    To obtain a paper copy of this Notice contact DePaul’s Privacy Officer as identified on the last page of this notice.

    IV. CHANGES TO THIS NOTICE
    We reserve the right to change this Notice at any time. We reserve the right to make the revised or changed Notice effective for PHI that we already have about you as well as any such information we receive in the future. We will post a copy of the current Notice in DePaul’s office locations. The Notice will contain on the first page, in the top right-hand corner, and at the end of the Notice, the effective date. In addition, each time you register at, or are admitted to, DePaul for services, you may request a copy of the current Notice in effect. You may also view a copy of the current Notice on our web site at www.depaulfamilyservices.org.

    V. COMPLAINTS
    If you believe your privacy rights have been violated, you may file a complaint with DePaul or with the Secretary of Health and Human Services. To file a complaint with DePaul, contact our Privacy Officer at 5650 Hollins Road, Roanoke, VA 24019, phone number 540-265-8923. All complaints must be submitted in writing and all complaints will be investigated.

    You will not be retaliated against or penalized by us for filing a complaint.

    VI. CONTACT PERSON
    DePaul’s contact person for all issues regarding your rights under the federal privacy standards is the Privacy Officer of DePaul. Information regarding matters covered by this Notice can be requested by contacting the Privacy Officer. He/she may be reached at:

    DePaul Family Services, Inc.
    5650 Hollins Road
    Roanoke, VA 24019
    540-265-8923

    VII. EFFECTIVE DATE
    This Notice is effective April 14, 2003.




Copyright © 2007 DePaul Family Services. All rights reserved.