NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

If you have any questions about this Privacy Notice, please contact our Privacy Officer at (508)792-5400.

I. Introduction

Spectrum Health Systems, Inc. programs, facilities, and services will be referred to in this Notice of Privacy Practices (“Notice”) as “Spectrum.” This includes programs in both Massachusetts and Virginia and covers Outpatient Treatment, Inpatient/Residential Treatment, Pre-release Programming, Programs for Incarcerated Individuals, Community Partnership Services, etc. While receiving services, Spectrum will keep record of your Personal Health Information (“PHI”) which may include your name, address, relevant health history, treatment history, etc.

Spectrum is required by law to protect your confidentiality and PHI under the rules set forth by local, state, and federal law including the Health Information Portability Accountability Act (HIPAA) and 42.CFR.Part 2. In certain circumstances, pursuant to this notice, patient authorization, or applicable laws and regulations, PHI can be used by Spectrum or “shared” (further referred to as “disclosed”) to other parties.

The information below will describe the ways and reasons in which Spectrum may use and disclose your PHI and provide examples to help you better understand your rights in each situation.

II. USES AND DISCLOSURES THAT REQUIRE YOUR AUTHORIZATION

Spectrum may not disclose your PHI without your written authorization in most circumstances. You may give permission for Spectrum personnel to disclose your information by filling out the Authorization for Release of Information form (also known as an ROI). You may be as broad or specific as to the type of information, the date range of the information, and the manner in which you wish to permit us to share that information (written, e-mail, phone call, etc.). Spectrum personnel are trained to support and coach you as to filling these ROIs out in full, but you are ultimately responsible for identifying the entities and information you wish to have shared. Spectrum will never release information in regard to genetic information, HIV/AIDS status, or records regarding venereal diseases without your explicit written permission.

You may revoke any authorization except to the extent that Spectrum has already taken action upon the authorization. If you are receiving care and wish to revoke any authorization, you may speak to any Spectrum employee to initiate the revocation.

Please be aware that a court with appropriate jurisdiction or other authorized third party could request or compel you to sign an authorization. For instance, you may have requirements through legal entities such as DCF or Probation that require Spectrum to share information with them, Spectrum cannot do so without your written authorization in most circumstances. Your willingness to comply with the court may impact the ability Spectrum has to help you meet their expectations.

Whenever your personal health information is disclosed, Spectrum personnel will always practice the “Minimum Necessary” rule which requires personnel to take reasonable steps to limit the disclosure to the minimum detail necessary to accomplish the intended purpose.

III. USES AND DISCLOSURES THAT MAY BE USED WITHOUT YOUR AUTHORIZATION

Spectrum may use or disclose your PHI for the purposes of treatment, payment, and health care operations without obtaining your written authorization for the following:

1. For Treatment: Spectrum will use and disclose your PHI without your authorization to provide and/or coordinate your healthcare and any related services. For Example: Spectrum may need to disclose information to a case manager or recovery support navigator who is responsible for coordinating your care. However, if we make any disclosures to a third party (other than your healthcare plan/Insurance provider) for coordination or management of your health care, Spectrum must obtain your written authorization prior to the disclosure (with some exceptions defined below in this notice). A third party is a person or entity who is not affiliated with our organization such as a primary care provider, medical specialist, legal entity (DCF, Probation, etc.), etc.

2. For Payment: Spectrum may use or disclose your PHI without your authorization so that the treatment and services you receive are billed to and payment is collected from your healthcare plan or other third-party payer. For example, Spectrum may disclose your PHI to permit your healthcare plan to take certain actions before your healthcare plan approves or pays for your services. These actions may include:

a. Making a determination of eligibility or coverage for health insurance;
b. Reviewing your services to determine if they were medically necessary;
c. Reviewing your services if they were appropriately authorized or certified in advance of your care; or
d. Reviewing your services for purposes of utilization review, to ensure the appropriateness of your care, or to justify the changes for your care.

3. For Healthcare Operations: Spectrum may use and/or disclose your PHI without your authorization for our health care operations. These uses and disclosures are necessary to run our organization and make sure that our patients receive quality care. These activities may include, by way of example, quality assessment and improvement, reviewing the performance or qualifications of our clinicians, training student interns in clinical activities, licensing and accreditation, business planning and development, and general administrative activities, including:

a. Spectrum may combine general, de-identified, health information of our patients to help in making decisions of potential services that are no longer needed and/or whether certain new treatments are effective. Spectrum may also combine the generalized, de-identified health information with the generalized health information from other providers to compare how we are doing and see where we can make improvements in our services.
b. Spectrum may also use and disclose your PHI to contact you and remind you of appointments. Finally, we may use and disclose your PHI to inform you about possible treatment options or alternatives that may be of interest to you.

4. For Intra-agency Professional and Quality Enhancement: Spectrum may also disclose your health information without your authorization among our clinicians and other staff (including clinicians, other than your primary therapist/clinician/practitioner) who also work at Spectrum. For example, our staff may discuss your care at a case conference or group clinical supervision.

5. As Required by Law and Law Enforcement Entities: Spectrum may use or disclose PHI when required by law or ordered to in a judicial or administrative proceeding, in response to a court order signed by a judge. In the event that there was a crime on our property, including driving under the influence and child endangerment/suspected abuse, Spectrum may share information regarding the perpetrator of the crime including name, description, and camera footage, if applicable.

6. For Public Health Activities and Risks: Spectrum may disclose PHI to government officials in charge of collecting information about preventing and controlling disease, reactions to medications or product defects or problems, or to notify a person who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease or condition.

7. Coroners and Medical Examiners: Spectrum may disclose PHI to coroners and/or medical examiners for the purpose of determining a cause of death, or otherwise as necessary to enable these parties to carry out their duties consistent with applicable law.

8. Organ, Eye, and Tissue Donation: Spectrum may release PHI to organ procurement organizations to facilitate organ, eye, and tissue donation and transplantation.

9. To Report a Serious Threat to Health and/or Safety: Spectrum may disclose PHI to report a serious threat to the health and safety to yourself, others, or general public. This includes suspected child abuse and/or neglect and/or reported specific plans to harm yourself or others. Federal law and regulations governing of substance use disorders permit Spectrum to report suspected child abuse or neglect under state law to appropriate state or local authorities. For reference, see 42 U.S.C. § 290dd-2 for federal law and 42 CFR Part 2 for Federal regulations governing confidentiality of alcohol and substance use records.

10. The Department of Corrections: If you are an inmate of a correctional institution or under the custody of a law enforcement official, Spectrum may disclose health information about you to the correctional institution.

11. Medical Emergencies: Spectrum may use and disclosure PHI in emergency situations, such as to an EMT or ER staff that is attending to your safety and medical needs to the extent required to provide you emergency care.

12. Lawsuits and Disputes: If you are involved in a lawsuit or a dispute with Spectrum Health Systems, Spectrum may disclose health information about you in response to a court or administrative order.

13. Military and Veterans: Spectrum may use or disclose PHI of military personnel and veterans as required by military or veterans’ authorities. Spectrum may also disclose your information for the purpose of determining your eligibility for benefits provided by the Department of Veterans Affairs. Finally, if you are a member of a foreign military service, Spectrum may disclose your information to that foreign military authority.

14. Specialized Government Functions: Spectrum may disclose PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities, and for the provision of protective services to the President or other authorized persons or foreign heads of state or to conduct special investigations.

15. Disclosures to You or for HIPAA Compliance Investigations: Spectrum may disclose your PHI to you or to your personal representative, and are required to do so in certain circumstances described below in connection with your rights of access to your PHI and to an accounting of certain disclosures of your PHI. Facility must disclose your PHI to the Secretary of the U.S. Department of Health and Human Services (the “Secretary”) when requested by the Secretary in order to investigate compliance with privacy regulations issued under the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)

16. Worker’s Compensation: Spectrum may disclose PHI to comply with workers’ compensation or other similar laws that provide benefits for work-related injuries or illnesses.

IV. USES AND DISCLOSURES THAT DO NOT REQUIRE AUTHORIZATION BUT THAT YOU MAY LIMIT THE INFORMATION DISCLOSED

Spectrum may use or disclose your PHI for the purposes of treatment, payment, and health care operations with considering limitations under your direction for the following:

  1. Persons Involved in Your Care: Spectrum may provide health information about you to someone who helps pay for your care. Spectrum may also use or disclose your health information to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition or death. Spectrum may also use or disclose your health information to an entity assisting in disaster relief efforts and to coordinate uses and disclosures for this purpose to family or other individuals involved in your health care.
  2. Incapacitation: In limited circumstances, Spectrum may disclose health information about you to a friend or family member who is involved in your care. If you are physically present and have the capacity to make health care decisions, your health information may only be disclosed with your agreement to persons you designate to be involved in your care.

V. MINORS

Pursuant to 42 CFR § 2.14, a minor’s parent or guardian may never consent to the disclosure of that minor’s substance abuse treatment information. Spectrum must obtain the consent from the minor receiving the treatment in order to disclose information to the parents or guardian or to another third party.

VI. YOUR INDIVIDUAL RIGHTS:

In regard to Privacy Practices, you have:

  • The Right to Receive Confidential Information: Spectrum will typically communicate with you by phone. You have the right to request receipt of your PHI by alternative means of communication or at alternative locations (personal e-mail, work address, work phone, etc.). Spectrum will accommodate any reasonable request put in writing.

  • The Right to Request Restrictions: Spectrum will not disclose health information to your health plan if the disclosure if for payment of a service for which you have paid Spectrum out of your pocket in full. You may also request restrictions on our use and disclosure of PHI for treatment, payment, and health care operations. While we will consider requests for additional restrictions carefully, Spectrum is not required to agree to a requested restriction. If you wish to request additional restrictions and you are currently receiving services, please contact a Spectrum Employee.

  • The Right to Inspect and Copy Your Health Information: You may request access to the record of services that Spectrum maintains in order to inspect or request copies of its contents. Under limited circumstances, Spectrum may deny access to a portion of your records. If you wish to access your records and are a current or former patient, you can ask any Spectrum employee for a copy of your records.

  • The Right to Amend Your Records: You have the right to request that we amend PHI maintained in your clinical file or billing records. All active patients wishing to amend their record by contacting a Spectrum employee. Once you have discharged from treatment, you may need to contact the Regional Program Director of the program/programs of which you were a patient. Under certain circumstances, Spectrum has the right to deny your request to amend your records and will notify you of this denial as provided in the HIPAA regulations. If your requested amendment to your records is accepted, a copy of your amendment will become a permanent part of the medical record. When we “amend,” a record, we may append information to the original record, as opposed to physically removing or changing the original record. If your requested amendment is denied, you will be informed of your right to have a brief statement of disagreement placed in your medical record.

  • The Right to Receive and Accounting of Disclosures: You may obtain a list of instances in which Spectrum has disclosed your PHI. The accounting will apply only to covered disclosures prior to the date of your request provided such period does not exceed six years and does not apply to disclosures that occurred prior to April 14, 2003. If you request an accounting more than once during a twelve (12) month period, there may be a charge. You will be told the cost prior to the request being filled.

  • The Right to Receive Notification of a Breach: You will be notified should Spectrum discover a breach of your confidentiality has occurred and your information has been compromised. A risk analysis will be conducted to determine the probability that protected health information has been compromised. Notification will be made no more than 60 days after the discovery of the breach unless it is determined by a law enforcement agency that the notification should be delayed.

  • The Right to Receive a Paper Copy of This Notice: Upon request, you may obtain a paper copy of this notice

VII. For Further Information and Complaints:

For more information regarding your rights to privacy and confidentiality, you may contact Spectrum Health Systems at 508-792-5400 or 149 Oak St., Westborough, MA, 01581. If you believe that Spectrum or Spectrum personnel have violated your privacy rights, you can contact Spectrum Health Systems at the aforementioned or you can call Spectrum Health Systems’ Confidential Corporate Compliance Hotline at 1-866-355-9693. You may also call this number if you disagree with a decision that Spectrum has made about access to your information, or to complain about our breach notification process.

You also have the right to file a written complaint with the Secretary of the United States Health and Human Services. Upon request, Spectrum personnel will provide you with the correct address. Spectrum will not retaliate against any individual that files a complaint.

VII. Right to Change Terms of This Notice:

Spectrum may change the terms of this notice at any time. If Spectrum changes this notice, it may apply to all PHI that Spectrum maintains, including information created or received prior to issuing the new notice. Should this notice be changed, a notice will be posted visibly in all Spectrum programs or facilities that house Spectrum programming. Spectrum will also keep a copy of this notice posted on the company website: www.SpectrumHealthSystems.org. Spectrum will offer copies of the updated Notice to any stakeholder that makes a request to a Spectrum employee.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.