NOTICE OF PRIVACY POLICY

THIS NOTICE DESCRIBES HOW PERSONAL INFORMATION AND MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We are committed to protecting your personal information and ensuring the privacy and confidentiality of your health records. In accordance with the Final Rule, we will not release your reproductive health or substance use disorder information for any other purposes without your explicit written authorization. You have the right to request restrictions on the use and disclosure of this information, and we will make every effort to comply with your requests as legally permissible.

We use the following terms in this Privacy Policy

“Personal Information” means any information about you, including name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment history, family members for contact purposes, bank account number, credit card number, debit card number, or any financial information.  “Personal Information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.  “Personal Information” also does not include medical or health information regulated by certain laws applicable to that type of information.

“Protected Health Information” or “PHI” is Personal information about your medical or health condition, history, or care, and related matters such as insurance.

We create a record of the care and services you receive from Hillsides. We need this record to provide you with quality care and to comply with certain legal and payment requirements. This notice will tell you about the ways in which we may use and disclose your Personal Information.  We also describe your rights and certain obligations we have regarding the use and disclosure of your Personal Information.

We are required by law to:

• Keep your Personal Information private;
• Notify you of our legal duties and privacy practices concerning your Personal Information;
• Notify you if your Personal Information is affected by a breach; and
• Follow the terms of the notice that is currently in effect.

 

1. Collection, Use, and Disclosure of Your PHI and other Personal Information

We may collect PHI and other Personal Information from you and members of your family, and from health care professionals. We may use or disclose your PHI for the following purposes:

Treatment. Your health information may be used by staff members or disclosed to other health care professionals for the purpose of treatment. For example, your health information may be used by our staff to send you appointment reminders, and we may disclose Personal Information to other health care professionals so that they may treat you and so that we can coordinate the services we provide to you. We may use your Personal Information to send you information on your treatment and treatment alternatives.

Payment. Your Personal Information may be used or disclosed to seek payment for our services from your health plan or from other sources of coverage. For example, we may need to give information about you to your health plan to obtain preauthorization for treatment or reimbursement for our services.

Health care operations. Your Personal Information may be used or disclosed to support the day-to-day activities that are necessary for the operations and management of Hillsides and ensure that our patients receive quality care. For example, we may use information to train our staff or review their performance.

Other Uses and Disclosures. We may also use or disclose your Personal Information for certain other purposes permitted by applicable federal or state law and regulations, including:

• Process & Proceedings. We may disclose information in response to a court or administrative order, subpoena, discovery request, or other lawful process.
• Specialized governmental functions, including to correctional institutions. We may disclose information about an inmate or other person in lawful custody to an official or correctional institution, or in other law enforcement custodial situations.
• Required by law. We may disclose information when required by law to do so.
• Public health reporting. Your PHI may be disclosed to public health agencies as required by law. For example, we are required to report certain communicable diseases to the state’s public health department. We are also required to report child abuse and neglect.
• Abuse, neglect, and domestic violence. We may disclose information concerning victims of abuse, neglect, or domestic violence to the appropriate government agency.
• Health oversight activities. We may disclose information to health oversight agencies for health oversight activities including audits, investigations, licensure or disciplinary actions.
• Serious threats to health or safety. We may disclose information necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Social services agencies and agencies providing public benefits. We may disclose information to social service agencies. For example, under our contract with the Department of Mental Health, if your case becomes open with Department of Children and Family Services (DCFS), there is automatic sharing of information including date of intake agency and primary therapist providing treatment to the DCFS County Social Worker (CSW). Likewise, DCFS will share information back to the mental health provider pertaining to the open case, CSW and Supervisor information.
• Research. We may use or disclose information for research purposes if certain conditions are satisfied. Certain trusted third parties, such as those who provide information technology services and systems, may have access to your PHI, subject to confidentiality obligations.
• Law enforcement. Your health information may be disclosed to law enforcement agencies to facilitate law-enforcement investigations, and to comply with government mandated reporting. We may disclose to a law enforcement official concerning the PHI of a suspect, fugitive, material witness, crime victim or missing person, or a crime committed on our premises.

 

2. Disclosures We May Make Unless You Object

Unless you tell us otherwise, we may disclose your information for the following purposes:

Individuals Involved in Your Care or Payment for Your Care. We may disclose PHI about you to a family member, friend, or other person you designate if you give us permission to do so, which you can do orally. We will limit the disclosure to information relevant to that person’s involvement in your care or payment for your care.

Fundraising. We may use your name and contact information to support our fund-raising efforts. If you do not want to participate in fund-raising efforts, please check the appropriate box on the Acknowledgement of Notice of Privacy Practices.

Facility Directory. We may use and disclose information to maintain our residential treatment facility directory. If a person asks for you by name, we will only disclose your name, general condition, and location in our facility, but only if the law permits us to do so. We may also disclose your religious affiliation to clergy.

 

3. Other Uses and Disclosures Require Your Authorization

Disclosure of your Personal Information or its use for any purposes other than those listed above requires your specific written authorization. If you change your mind after authorizing the use or disclosure of your information, you may submit a written revocation of the authorization. However, your decision to revoke the authorization will not affect or undo any use or disclosure of your information that occurred before you notified us of your decision to revoke your authorization.

Without your authorization, we are prohibited from using or disclosing your Protected Health Information for marketing purposes, and we are required to disclose in such authorization if financial remuneration is involved in such marketing. We may not sell your Protected Health Information without your authorization. We may not use or disclose most psychotherapy notes contained in your Protected Health Information without your authorization.

 

4. Your Individual Rights Concerning Your PHI

You have certain rights under the federal privacy laws. These include:

a. The right to request restrictions on the use and disclosure of your Protected Health Information.
b. The right to receive confidential communications concerning your treatment
c. The right to inspect and copy your Protected Health Information
d. The right to amend or submit corrections to your Protected Health Information
e. The right to receive an accounting of how and to whom your Protected Health Information has been disclosed
f. The right to receive a printed copy of this notice.

This section explains your rights and some of our responsibilities to help you

Get an electronic or paper copy of your medical record

• You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. Ask us how to do this.
• We will provide a copy or a summary of your health information, usually within 15 days of your request.

Ask us to correct your medical record

• You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this.
• We may say “no” to your request, but we’ll tell you why in writing within 30 days.

Request confidential communications

• We normally contact you by telephone at your home, cell or at your home address.
• You can ask us to contact you in a specific way (for example, home, cell or office phone) or to send mail to a different address.
• We will say “yes” to all reasonable requests.

Ask us to limit what we use or share

• You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no” if it would affect your care.
• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or operations with your health insurer. We will say “yes” unless a law requires us to share that information.

Get a list of those with whom we’ve shared information

• You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why.
• We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make).

Choose someone to act for you

• If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
• We will make sure the person has this authority and can act for you before we take any action.

Get a copy of this notice

• You may obtain a paper copy of this Notice upon request.
• You may receive a paper copy, even if you agreed to receive electronic notices from us.

 

5. Notice to California Residents

We also comply with California’s statutes and regulations, including the California Privacy Rights Act A (CPRA). The CPRA provides California residents with specific rights regarding their Personal Information. This section describes your rights as outlined with CPRA, and explains how to exercise those rights.

The Right to Access Your Personal Information

You have the right to request and obtain from us the types of Personal Information we have collected, used and shared about you, in the 12 months preceding your request, and why we collected, used and shared that information. You have the right to make this request twice withing a 12-month period. Once we receive and verify request, we will disclose to you:

• The categories of Personal Information we collected.
• The specific pieces of Personal Information we collected.
• The categories of sources from which we collected Personal Information.
• The purpose for which we use your Personal Information.
• The categories of third parties with whom we share your Personal Information

The Right to Delete

Hillsides maintains case records for a period that is at least equivalent to the latter of the following: ten years following the conclusion of services; for minors, until such time as the minor reaches 25 years of age.

The Right to Opt-Out of Sale

We do not sell your Personal Information; therefore, we do not offer an opt out.

The Right to Not be Discriminated Against

We will not discriminate against you for exercising any of your CPRA defined rights. We will not discriminate against you for exercising your rights under the CPRA by doing any of the following:

• Denying you goods or services
• Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties
• Providing you a different level of quality of goods or services
• Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services

Tracking

We do not track our patients over time and across third party websites to provide advertising, and therefore we do not respond to Do Not Track (DNT) signals from your web browser)

 

6. Right to Revise Privacy Practices and Changes to This Notice

As permitted by law, we reserve the right to amend or modify our privacy policies and practices at any time. These changes in our policies and practices may be required by changes in federal and state laws and regulations. If we materially change our privacy policies and practices, we will revise this Notice and post a copy of the current Notice in our reception areas and on our website. Upon request, we will provide you with the most recently revised notice. The revised policies and practices will be applied to all protected health information we maintain, regardless of when we received it.

 

7. Complaints

If you would like to submit a comment or complaint about our privacy practices, or believe that your privacy rights have been violated, you should call the matter to our attention by sending a letter outlining your concerns to: Beth Foster, Privacy Officer:

940 Avenue 64 Pasadena, CA 91105. T (323) 572-3854 Email bfoster@hilllsides.org

You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696- 6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

You will not be penalized or otherwise retaliated against by us, for filing a complaint.

 

8. Contact Person

If you have any questions about this Notice, or if you want to exercise any right explained above, or complain about any use or disclosure of your information, the name and address of the person you may contact is: Beth Foster, Privacy Officer:

940 Avenue 64 Pasadena, CA 91105. T (323) 572-3854 Email bfoster@hilllsides.org

 

9. Effective Date

This notice was updated on August 1, 2024

Acknowledgment of Notice of Privacy Practices

Hillsides reserves the right to modify the privacy practices outlined in the notice.

• I have received a copy of the notice of privacy practices for Hillsides.
• Please do not use my information for fund-raising purposes.

Name of Client (Print or Type):

Signature of Client:

Date:

Signature of Client’s Personal Representative:

(Required if the client is a minor or an adult who is unable to sign this form)

Relationship of Client’s Personal Representative to Client: