Notice of Privacy Practices of Cumberland Heights

THIS NOTICE DESCRIBES:

• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED.
• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION.
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION.

YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH OUR QUALITY MANAGEMENT OFFICE AT (615) 432-3215 OR BY EMAIL AT qm@cumberlandheights.org IF YOU HAVE ANY QUESTIONS.

Who We Are

This Notice of Privacy Practices (“Notice”) describes the privacy practices of Cumberland Heights Foundation and Cumberland Heights Professional Associates (“Cumberland Heights”). “Cumberland Heights” is inclusive of inpatient, outpatient and virtual services offered at these facilities, individually and collectively.

Our Privacy and Confidentiality Obligations

This Notice describes how we may use and disclose your Protected Health Information (“PHI”) in accordance with all applicable laws. It also describes your rights regarding how you may gain access to and control your PHI. Your health information is protected by federal law and regulations, including the Health Insurance Portability and Accountability Act (“HIPAA”) and its implementing regulations set forth at 45 C.F.R. Parts 160 and 164 and federal regulations that protect the confidentiality of substance use disorder patient records set forth at 42 C.F.R. Part 2. Your information may be stored and disclosed electronically and on paper.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

• Get an electronic or paper copy of your medical record
  • You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you or ask us to send records stored in an electronic record to a third party you designate by contacting us in writing at the contact information listed at the end of this Notice.
  • We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee.

• Ask us to correct your medical record
  • You can ask us to correct health information about you that you think is incorrect or incomplete by contacting us in writing at the contact information listed at the end of this Notice.
  • We may say “no” to your request, but we’ll tell you why in writing within 60 days.

• Request confidential communications
  • You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
  • We will say “yes” to all reasonable requests.
  • Please note that you may provide your mobile phone number to opt in to receiving text messages (SMS) from Cumberland Heights for purposes such as care coordination, appointment reminders, billing notifications, program information, and other service-related communications. Your consent to receive such text messages is not a condition of receiving treatment or services, and you may withdraw consent at any time. If you choose to receive communications from us via text message or other electronic means, such options may not be a secure means of communication and your health information that may be contained in our communications with you may not be encrypted. This means that there is risk that your health information in such communications may be intercepted and read by, or disclosed to, unauthorized third parties. Mobile phone numbers and text message content are used solely to support Cumberland Heights’ communication with you. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes.

• Ask us to limit what we use or share
  • You can ask us not to use or share certain health information for treatment, payment, or our operations, including when you have previously signed a written consent for such disclosures. We are not required to agree to your request, and we may say “no” if it would affect your care.
  • If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

• Get a list of those with whom we have shared information
  • You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask.
  • We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make) that we are not required by law to include. We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

• Get a list of disclosures by an intermediary
  • If you consent under a general designation to the disclosure of your health information to another person (other than us or an entity covered by HIPAA) who has a treating provider relationship with you, that other person is required to provide you with a list of disclosures they make for the past 3 years.

• Fundraising communications
  • You have the right to elect not to receive communications about our fundraising activities by using the contact information listed at the end of this Notice.

• Discuss this Notice with us
  • You have the right to discuss this Notice with us. You can do so by contacting us using the contact information provided at the end of this Notice

• Get a copy of this privacy Notice
  • You can ask for a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically. We will provide you with a paper copy promptly.

• Choose someone to act for you
  • If you have given someone medical power of attorney, if someone is your legal guardian, or if another individual is authorized by law to make health care decisions for you (known as a “personal representative”), that person can exercise any of your rights listed above and make choices about your health information.
  • We will make sure the person has this authority and can act for you before we take any action.

• File a complaint if you feel your rights are violated
  • If you believe your privacy rights have been violated, you can file a complaint with our Quality Management Office using the contact information at the end of this Notice or the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr/privacy/hipaa/complaints/
  • We will not retaliate against you for filing a complaint.

Our Uses and Disclosures with Your Written Consent

For any purpose other than those described in this Notice, we will obtain your written consent before using or disclosing your substance use disorder patient records. You may revoke any consent you give us at any time by contacting us using the contact information provided at the end of this Notice. For example, we can use and disclose your patient records with your consent for the following purposes:

• Treat you – We can use your health information and share it with other professionals who are treating you. Example: A doctor treating you asks another doctor about your overall health condition.
• Bill for your services – We can use and share your health information to bill and get payment from health plans or other entities. Example: We give information about you to your health insurance plan so it will pay for your services.
• Run our organization – We can use and share your health information to run our practice, improve your care, and contact you when necessary. Example: We may use health information about you to manage your treatment and services, conduct quality improvement activities, and other operational purposes.
• Multiple enrollments – We may disclose your health information to a central registry or to any withdrawal management or maintenance treatment program within 200 miles of Cumberland Heights to ensure that you are not enrolled in multiple substance use disorder treatment programs.
• To persons within the criminal justice system who referred you – We may disclose your health information to those persons within the criminal justice system who have made participation in our program a condition of the disposition of any criminal proceedings against you or a condition of your parole or other release from custody.
• Prescription drug monitoring programs – If required by law, we may report substance use disorder medication Cumberland Heights prescribes or dispenses to you to applicable state prescription drug monitoring programs.

You may provide a single consent for all future uses and disclosures for treatment, payment, and healthcare operations purposes. Health information that is disclosed to a federally-assisted substance use disorder program or a covered entity or business associate under HIPAA for treatment, payment, and healthcare operations may be further disclosed by that entity without your consent if permitted by HIPAA. When health information is disclosed pursuant to HIPAA, it is possible that the information could be re-disclosed by the recipient and no longer be protected by HIPAA.

Though HIPAA permits certain disclosures of health information without your express written consent, including for treatment, payment, and healthcare operations purposes, our disclosure of patient records relating to substance use disorders is more limited and often requires consent. For example, HIPAA permits health information to be used or disclosed for treatment, payment and health care operations purposes, public health and safety, research, health oversight, as required by law (including to the government to investigate privacy law violations), organ and tissue donation, as needed by a medical examiner or funeral director, workers’ compensation, law enforcement, other government requests, lawsuits and legal actions and when incidental to a permitted disclosure, subject to applicable conditions and restrictions.

How Else Can We Use or Share Your Health Information?

We are allowed or required to share your information in other ways without your written consent. We have to meet all required conditions in the law before we can share your information for these purposes. Not every use or disclosure in a category will be listed. For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.

To you or your personal representative – We may disclose your health information to you or your personal representative, including if you or they request access, as described above.

Between and among Cumberland Heights – We may use and disclose your health information between and among our staff and any entities with direct administrative control over our programs that need the information to perform their job duties related to providing diagnosis, treatment, or referral for treatment of substance use disorders.

Business associates – We may disclose your health information to business associates with whom we contract to provide services to us. Examples of business associates include administrative and management services, medical records, IT vendors, consultants, accountants, attorneys, medical transcriptionists, and third-party billing companies. We will only make these disclosures if we have received assurance that the business associate will properly safeguard your health information.

Medical emergencies – We may use and disclose your health information in the event of a bona fide medical emergency in which your prior informed consent cannot be obtained, including disclosures to the Food and Drug Administration.

Public health – We may disclose your health information to public health authorities provided your health information is first de-identified in accordance with the HIPAA standards for de-identification.

Child abuse and neglect – We may use and disclose your health information as required by state law to report to appropriate state or local authorities incidents of suspected child abuse and neglect. We may not, however, disclose the original substance use disorder patient records we maintain unless otherwise permitted or required by law, including disclosures for civil or criminal proceedings that arise out of a report of suspected child abuse and neglect.

Research – We can use or share your information for health research as permitted by HIPAA (such as using de-identified data or obtaining a privacy waiver).

Audit and evaluation activities – We may use and disclose your health information for certain audit and evaluation activities, such as if Cumberland Heights is audited by a government agency.

Crimes on the premises – We may disclose your health information that is directly related to the commission of a crime on our premises or against a staff member or a threat to commit such a crime to law enforcement agencies or officials. The disclosure must be limited to information related to the circumstances of the incident, including the individual’s status as a patient at Cumberland Heights, name and address and last known whereabouts.

Deceased patients: We may use and disclose health information related to the cause of death of a patient under applicable laws requiring the collection of death or other vital statistics or permitting inquiry in the cause of death.

Respond to lawsuits and legal actions – We can share health information about you if required by a valid court order. A court order must be accompanied by a subpoena or similar legal mandate compelling disclosure before health information is used or disclosed. Your health information, or testimony relaying the contents of those records, will not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless based on your specific written consent or based on a court order. If required by law, your records will only be used or disclosed based on a court order after you receive notice and an opportunity to be heard.

AI – We may use Artificial Intelligence (AI) tools or technology (including, without limitation, any Machine Learning tool or technology) when using or disclosing PHI for purposes described in this Notice. For example, we may use tools that record your interactions with our providers to assist with drafting notes or that assist with responding to routine inquiries such as scheduling appointments.

If information we maintain is not protected by federal regulations that protect the confidentiality of substance use disorder patient records, we can also use and disclose health information without your written consent for purposes permitted by HIPAA, including treatment, payment and heath care operations.

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must provide notice of and follow the duties and privacy practices described in this Notice as currently in effect and give you a copy of it.

For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

Changes to the Terms of this Notice

We can change the terms of this Notice, and the changes will apply to all information we have about you. The new Notice will be available upon request, in our office, and on our web site.

How to Contact Us

If you have any questions or would like additional information about our privacy practices, including how to exercise your rights, please contact our Privacy Office at Quality Management Office at 8283 River Road Pike, Nashville, TN 37209, 615-432-3215 or by e-mail at qm@cumberlandheights.org.