Notice of Privacy Practices

Columbia River Mental Health Services and NorthStar

This notice describes how medical, mental health, and substance use disorder information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

I. Who will follow this notice

This notice describes Columbia River Mental Health Services practices and that of our
workforce. The workforce includes our employees, volunteers and others who work at CRMHS. CRMHS includes services based at the main clinic, other satellite facilities, and services provided in the community.

II. We have a legal duty to safeguard your protected health information (PHI)

We are legally required to protect the privacy of your health information. We call this information “protected health information” or “PHI” for short and it includes information that can be used to identify you that we have created or received about your past, present, or future health or condition, the provision of health care to you, or the payment of this health care. Our employees, interns, volunteers, and contractors are required to maintain the confidentiality of your PHI. We have policies and procedures and other safeguards to help protect your PHI from improper use and disclosure. We must provide you with this notice about our privacy practices that explains how, when, and why we use and disclose your PHI. With some exceptions, we may not use or disclose any more of your PHI than is necessary to accomplish the purpose of the use or disclosure. We are legally required to follow the privacy practices that are described in this notice.

We reserve the right to change this notice and our privacy policies. Any changes will apply to PHI we already have. Before we make an important change to our policies, we will change this notice, distribute a copy to all active clients, and post a new notice in waiting areas of our facilities. You can also request a copy of this notice at the front desk of our facilities.

III. How we may use and disclose your protected health information

We may use and disclose your PHI without your prior written permission. Below, we describe the different categories of our uses and disclosures and give you some examples of each category.

1. For Treatment. This is the most important use and disclosure of your PHI. Our physicians, nurses and other clinicians use and disclose your PHI to diagnose, evaluate, coordinate and manage your care. We may disclose your PHI among clinicians and other staff at CRMHS. For example, our staff may discuss your care at a case conference. We may also disclose your PHI to another health care provider, for example, your primary care physician.
2. For Payment. We may use and disclose your PHI in order to bill and collect payment for the treatment and services provided to you. For example, we may provide portions of your PHI to our billing department and your health plan to get paid for the services we provided to you. For Medicaid clients or low-income clients on a sliding fee schedule, we will also provide demographic and service information to the Washington State Mental Health Division.

3. For Operations. We may disclose your PHI in order to operate this mental health center. For example, we may use your PHI in order to evaluate the quality of health care services that you received or to evaluate the performance of the professionals who provided health care services to you. We may also provide your PHI to our accountants, attorneys, consultants, and others in order to make sure we are complying with the laws that affect us.

4. For Appointment Reminders. We may use and disclose your PHI to contact you for appointment reminders.
5. For Treatment Alternatives. We may contact you to describe services we offer; for treatment, for case management, care coordination, or to recommend treatment options. For example, we may tell you about a new therapy group that may be appropriate for your treatment.

6. To Business Associates. We may contract with business associates to perform certain functions or activities on our behalf; for example, payment and health care operations. All of our business associates are obligated to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract.
7. Specific types of PHI. There are stricter requirements for use and disclosure of some types of PHI; for example, substance use disorder, reproductive health, and HIV treatment information. However, there are still circumstances in which these types of information may be used or disclosed without your authorization. If you become a patient in our substance use disorder program we will give you specific information about your privacy rights for that program.

8. For Disaster Relief. We may disclose your name, city of residence, age, gender, and general condition to a public or private disaster relief organization to assist disaster relief efforts, unless you object at the time.
9. For Public Health Activities. Many functions performed or authorized by government agencies promote and protect the public’s health and may require us to disclose your PHI. For example, we have an obligation to report certain diseases or exposure to disease, injuries, conditions and vital events such as deaths. We may use and disclose your PHI as needed to comply with federal and state laws governing workplace safety.
10. For Health Oversight. As a health care provider, we are subject to oversight conducted by federal and state agencies. These agencies may conduct audits. For example, Department of Health may request a client for quality or complaint review and we will provide the chart.

11. For Research. Under certain circumstances, we may use and disclose PHI for research. For example, a research project may involve comparing the health of clients who received one treatment to those who received another, for the same condition. Before we use or disclose PHI for research, the project will go through a special approval process. Even without special approval, we may permit researchers to look at records to help them identify clients who may be included in their research project or for other similar purposes, as long as they do not remove or take a copy of any Protected Health Information.

12. For Worker’s Compensation. We may use and disclose your PHI to comply with workers’ compensation laws by providing information to administrators, insurance carriers, or others responsible for evaluating your claim for benefits.
13. For Military Activity and National Security. We may use or disclose the PHI of armed forces personnel to the applicable military authorities when they believe it is necessary to carry out military missions. We may also disclose your PHI to authorized federal officials for national security and intelligence activities or for protection of the President and other government officials and dignitaries.
14. For Fundraising. We may use or disclose PHI to contact you to raise funds for our organization.
15. As Required by Law. In some circumstances federal or state law requires that we disclose your PHI. For example, the Secretary of the Department of Health and Human Services may review our compliance efforts, which may include seeing your PHI.
16. For lawsuits and other legal disputes. We may use and disclose PHI if responding to a court or administrative order, a subpoena, or a discovery request. We may also use and disclose PHI to the extent permitted by law without your authorization to defend a lawsuit or arbitration.
17. Data Breach Notification Purposes. We may use or disclose your Protected Health Information to provide legally required notices of unauthorized access to or disclosure of your health information.
18. For Law Enforcement. We may disclose PHI to authorized officials for law enforcement purposes. For example, to report a crime, such as illegal substances being bought or sold on CRMHS property or being physically/verbally aggressive towards CRMHS staff.
19. For Serious Threat to Health or Safety. If we believe it is necessary to avoid a serious threat to your health or safety or to someone else’s.
20. For Abuse and Neglect. We may disclose PHI to the appropriate authority to report suspected child abuse or neglect or to identify suspected victims of abuse, neglect, or domestic violence.
21. To Coroners, Medical Examiners or Funeral Directors. We may disclose PHI to a coroner or medical examiner to determine cause of death or for other official duties.

22. Inmates. Under the federal law that requires us to give you this notice, inmates do not have the same rights to control their PHI as other individuals. If you are an inmate of a correctional institution or in the custody of a law enforcement official, we may disclose your PHI to them for certain purposes.

Except for those uses and disclosures described above, we will not use or disclose your PHI without your written authorization.

You may revoke that authorization by notifying us in writing at any time. The revocation will not apply to any authorized use or disclosure that took place before we received your revocation.

Your written authorization is required for other uses and disclosures.

The following uses and disclosures of your Protected Health Information will be made only with your written authorization:

1. Most uses and disclosures of psychotherapy and substance use disorder counseling notes;
2. Uses and disclosures of Protected Health Information for marketing purposes; and
3. Disclosures that constitute a sale of your PHI.

IV. Prohibited uses and disclosures

1. Use and Disclosure of genetic information for underwriting purposes: We will not share you PHI with your health plan for underwriting purposes. For example, we will not provide your insurance your genetic information for any other reason then to receive reimbursement or comply with a regulatory required audit.
2. Sale of protected health information: We may not sell your protected health information. For example, we will not accept payment for referrals to other agencies.
3. Use and disclosure of reproductive health care for the purpose of conducting a criminal, civil, or administrative investigation against you for the mere act of seeking, obtaining, providing, or facilitating reproductive health care: We may not disclose your personal health information for specific purposes that are prohibited by HIPAA. For example, we would not release records to an attorney if their purpose was to charge you with a crime for obtaining lawful reproductive services.

• • We are required to obtain a written attestation for all health oversight activities, judicial and administrative proceedings, law enforcement purposes, and disclosures to coroners and medical examiners to ensure the release is NOT for prohibited purposes.

V. What rights you have regarding your PHI

1. The right to see and get copies of your PHI. In general, you have the right to see and receive copies of the PHI in your medical record or billing records, other than psychotherapy and substance use disorder counseling notes. If you wish to see or receive such records please write to us at Health Information Management (HIM) Department, P.O. Box 1337, Vancouver, WA 98666. We will respond to you within 15 days after receiving your written request. We will charge you the standard copying fees allowed by Washington State law. In certain situations, we may deny your request. If we do, we will tell you in writing, our reasons for the denial and explain your right to have the denial reviewed.

2. Right to an Electronic Copy of Electronic Medical Records. If your Protected Health Information is maintained in an electronic format (known as an electronic medical record or an electronic health record), you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. We will make every effort to provide access to your Protected Health Information in the form or format you request, if it is readily producible in such form or format. If the Protected Health Information is not readily producible in the form or format you request your record will be provided in either our standard electronic format or if you do not want this form or format, a readable hard copy form. We may charge a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.

3. Out-of-Pocket Payments. If you paid out-of-pocket (or in other words, you have requested that we not bill your health plan) in full for a specific item or service, you have the right to ask that your Protected Health Information with respect to that item or service not be disclosed to a health plan for purposes of payment or health care operations, and we will honor that request.

4. Right to get Notice of a Breach. You have the right to be notified upon a breach of any of your unsecured Protected Health Information.
5. The right to choose how we send PHI to you. You have the right to ask that we send information to an alternate address (for example, sending information to your work address rather than your home address) or by alternate means (for example, e-mail instead of regular mail). When we can reasonably and lawfully agree to your request, we will. We are permitted to charge you for any additional costs incurred by granting your request.

6. The right to correct or update your PHI. If you believe there is a mistake in your PHI or that important information is missing, you may request in writing that we correct or add to the record. Send your request to Privacy Officer, P.O. Box 1337, Vancouver, WA 98666. We will respond in writing. If we approve your request we will make the correction or addition. If we deny your request we will tell you why and explain your right to file a written statement of disagreement.

7. The right to an accounting of disclosures of PHI. You may ask for a list of disclosures of your PHI made by us or an intermediary. Write to us at HIM Department P.O. Box 1337, Vancouver, WA 98666. The list will not include disclosures we have made for treatment, payment and health care operations, disclosures that occurred prior to April 14, 2003, disclosures for which CRMHS had a signed authorization, disclosures of your PHI to you; disclosures for notifications for disaster relief purposes; or disclosure to person’s involved in your care.

8. The right to request limits on uses and disclosures of your PHI. CRMHS will attempt to honor your right to limit use of your PHI, but may not be able to meet all requests. You may not limit the uses and disclosures that we are legally required or allowed to make.

9. Right to a copy of this notice. You have the right to a paper or electronic copy of this notice. You may ask us to give you a copy of this notice at any time.

How to contact us about this notice or to complain about our privacy practices

If you have any questions about this notice please contact our Privacy Officer at 360-993-3000. If you want to lodge a complaint about our privacy practices please call our Customer Service Representative at 360-993-3121. You may also notify the Secretary of the Department of Human Services (HHS): Office of Civil Rights, 200 Independence Ave., S.W., Washington, D.C. 20202. You will not be penalized for filing a complaint.

Effective date of this notice

This notice went into effect on October 1, 2024 .

HIPAA, 45 CFR Parts 160 and 164.