Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can obtain access to this information. Please review it carefully.

How may we use and disclose your protected health information?

We may use and disclose your Protected Health Information (PHI) without your prior written permission. Below, we describe the different categories of our uses and disclosures and give you some examples of each category:

  1. For Treatment. This is the most important use and disclosure of your PHI. Our physicians, nurses and other clinicians use and disclose your PHI to diagnose, evaluate, coordinate and manage your care. We may disclose your PHI among clinicians and other staff at CRMHS. For example, our staff may discuss your care at a case conference. We may also disclose your PHI to another health care provider; for example, your primary care physician.
  2. For Payment. We may use and disclose your PHI in order to bill and collect payment for the treatment and services provided to you. For example, we may provide portions of your PHI to our billing department and your health plan to get paid for the services we provided to you. For Medicaid clients or low-income clients on a sliding fee schedule, we will also provide demographic and service information to the Washington State Mental Health Division.
  1. For Operations. We may disclose your PHI in order to operate this mental health center. For example, we may use your PHI in order to evaluate the quality of health care services that you received or to evaluate the performance of the professionals who provided health care services to you. We may also provide your PHI to our accountants, attorneys, consultants, and others in order to make sure we are complying with the laws that affect us.
  1. For Appointment Reminders. We may use and disclose your PHI to contact you for appointment reminders.
  2. For Treatment Alternatives. We may contact you to describe services we offer; for treatment, for case management, care coordination, or to recommend treatment options. For example, we may tell you about a new therapy group that may be appropriate for your treatment.
  1. To Business Associates. We may contract with business associates to perform certain functions or activities on our behalf; for example, payment and health care operations. All of our business associates are obligated to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract.
  2. Specific types of PHI. There are stricter requirements for use and disclosure of some types of PHI; for example, drug and alcohol addiction treatment information and HIV information. However, there are still circumstances in which these types of information may be used or disclosed without your authorization. If you become a patient in our chemical dependency program, we will give you specific information about your privacy rights for that program.
  1. For Disaster Relief. We may disclose your name, city of residence, age, gender and general condition to a public or private disaster relief organization to assist disaster relief efforts, unless you object at the time.
  2. For Public Health Activities. Many functions performed or authorized by government agencies promote and protect the public’s health and may require us to disclose your PHI. For example, we have an obligation to report certain diseases or exposure to disease, injuries, conditions and vital events such as deaths. We may use and disclose your PHI as needed to comply with federal and state laws governing workplace safety.
  3. For Health Oversight. As a health care provider we are subject to oversight conducted by federal and state agencies. These agencies may conduct audits of our operations and activities and in that process they may review your PHI.
  1. For Research. Under certain circumstances, we may use and disclose PHI for research. For example, a research project may involve comparing the health of clients who received one treatment to those who received another, for the same condition. Before we use or disclose PHI for research, the project will go through a special approval process. Even without special approval, we may permit researchers to look at records to help them identify clients who may be included in their research project or for other similar purposes, as long as they do not remove or take a copy of any Protected Health Information.
  1. For Workers’ Compensation. We may use and disclose your PHI to comply with workers’ compensation laws by providing information to administrators, insurance carriers, or others responsible for evaluating your claim for benefits.
  2. For Military Activity and National Security. We may use or disclose the PHI of armed forces personnel to the applicable military authorities when they believe it is necessary to carry out military missions. We may also disclose your PHI to authorized federal officials for national security and intelligence activities or for protection of the President and other government officials and dignitaries.
  3. For Fundraising. We may use or disclose PHI to contact you to raise funds for our organization.
  4. As Required by Law. In some circumstances federal or state law requires that we disclose your PHI. For example, the Secretary of the Department of Health and Human Services may review our compliance efforts, which may include seeing your PHI.
  5. For lawsuits and other legal disputes. We may use and disclose PHI if responding to a court or administrative order, a subpoena, or a discovery request. We may also use and disclose PHI to the extent permitted by law without your authorization to defend a lawsuit or arbitration.
  6. Data Breach Notification Purposes. We may use or disclose your Protected Health Information to provide legally required notices of unauthorized access to or disclosure of your health information.
  7. For Law Enforcement. We may disclose PHI to authorized officials for law enforcement purposes; for example, to respond to a search warrant, report a crime on our premises or help identify or locate someone.
  8. For Serious Threat to Health or Safety. If we believe it is necessary to avoid a serious threat to your health or safety or to someone else’s.
  9. For Abuse and Neglect. We may disclose PHI to the appropriate authority to report suspected child abuse or neglect or to identify suspected victims of abuse, neglect, or domestic violence.
  10. To Coroners, Medical Examiners or Funeral Directors. We may disclose PHI to a coroner or medical examiner to determine cause of death or for other official duties.
  1. Inmates. Under the federal law that requires us to give you this notice, inmates do not have the same rights to control their PHI as other individuals. If you are an inmate of a correctional institution or in the custody of a law enforcement official, we may disclose your PHI to them for certain purposes; for example, to protect your health or safety or someone else’s.

No other exclusions to your written permission.

Except for those uses and disclosures described above, we will not use or disclose your PHI without your written authorization. You may revoke that authorization by notifying us in writing at any time. The revocation will not apply to any authorized use or disclosure that took place before we received your revocation. Your written authorization is required for other uses and disclosures.

The following uses and disclosures of your Protected Health Information will be made only with your written authorization:

  1. Most uses and disclosures of psychotherapy notes;
  2. Uses and disclosures of Protected Health Information for marketing purposes; and
  3. Disclosures that constitute a sale of your Protected Health Information.

What rights do you have regarding your PHI?

You have the right to:

  1. See and get copies of your PHI. In general you have the right to see and receive copies of the PHI in your medical record or billing records, other than psychotherapy notes. If you wish to see or receive such records please write to us at Medical Records, P.O. Box 1337, Vancouver, WA 98666. We will respond to you within 15 days after receiving your written request. We will charge you the standard copying fees allowed by Washington State law. In certain situations, we may deny your request. If we do, we will tell you in writing our reasons for the denial and explain your right to have the denial reviewed.
  1. An Electronic Copy of Electronic Medical Records. If your Protected Health Information is maintained in an electronic format (known as an electronic medical record or an electronic health record), you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. We will make every effort to provide access to your Protected Health Information in the form or format you request, if it is readily producible in such form or format. If the Protected Health Information is not readily producible in the form or format you request your record will be provided in either our standard electronic format or if you do not want this form or format, a readable hard copy form. We may charge a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.
  1. Out-of-Pocket Payments. If you paid out-of-pocket (or in other words, you have requested that we not bill your health plan) in full for a specific item or service, you have the right to ask that your Protected Health Information with respect to that item or service not be disclosed to a health plan for purposes of payment or health care operations, and we will honor that request.
  1. Get Notice of a Breach. You have the right to be notified upon a breach of any of your unsecured Protected Health Information.
  2. Choose how we send PHI to you. You have the right to ask that we send information to an alternate address (for example, sending information to your work address rather than your home address) or by alternate means (for example, e-mail instead of regular mail). When we can reasonably and lawfully agree to your request we will. We are permitted to charge you for any additional costs incurred by granting your request.
  1. Correct or update your PHI. If you believe there is a mistake in your PHI or that important information is missing, you may request in writing that we correct or add to the record. Send your request to Privacy Officer, P.O. Box 1337, Vancouver, WA 98666. We will respond in writing. If we approve your request we will make the correction or addition. If we deny your request we will tell you why and explain your right to file a written statement of disagreement.
  1. An accounting of disclosures of PHI. You may ask for a list of disclosures of your PHI. Write to us at Medical Records, P.O. Box 1337, Vancouver, WA 98666. The list will not include disclosures we have made for treatment, payment and health care operations; disclosures that occurred prior to April 14, 2003; disclosures for which CRMHS had a signed authorization; disclosures of your PHI to you; disclosures for notifications for disaster relief purposes; or disclosure to persons involved in your care.
  1. Request limits on uses and disclosures of your PHI. CRMHS will attempt to honor your right to limit use of your PHI, but may not be able to meet all requests. You may not limit the uses and disclosures that we are legally required or allowed to make.
  1. A paper copy of this notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time.

How to contact us about this notice or to complain about our privacy practices.

If you have any questions about this notice please contact our Privacy Officer at 360-993-3000. If you want to lodge a complaint about our privacy practices please call our Customer Service Representative at 360-993-3121. You may also notify the Secretary of the Department of Human Services (HHS): Office of Civil Rights, 200 Independence Ave. S.W., Room 509F, HHH Building, Washington, D.C. 20201. You will not be penalized for filing a complaint.

Effective date of this notice.

This notice went into effect on April 11, 2014.

HIPAA, 45 CFR Parts 160 and 164.

Back To Top