COMMUNITY COUNSELING SOLUTIONS
Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. Who We Are
This notice gives you information about the privacy and security practices of Community Counseling Solutions (CCS). CCS offers a wide variety of behavioral health services to four counties in the state of Oregon, including individual, family, and group therapy, gambling counseling, alcohol and drug treatment, 24/7 crisis intervention services, psychiatric consultation, and medication management, in addition to cooperation with various other organizations including residential and acute psychiatric services and school programs. We also offer case management for developmental disabilities in five counties.
II. Our Privacy Obligations
We are required by law to maintain the privacy and security of your health information (“protected health information” or “PHI”) and to provide you with this Notice of our legal duties and privacy practices with respect to your protected health information. When we use or disclose your protected health information, we are required to abide by the terms of this Notice (or other notice in effect at the time of the use or disclosure).
Protected health information may be spoken (oral), written (on paper) or electronic (stored in a computer). Only people who need your PHI for health care operations, coordinating your care and other reasons explained below are allowed to see your PHI. Because PHI may be spoken, written, or electronic, CCS has many ways to keep it safe. We use methods such as cabinet locks for paper records, passwords, encryption and firewalls for our computer systems. Paper that is no longer needed is shredded or destroyed in such a way that your PHI cannot be read or reconstructed. Electronic information that is no longer needed is cleared, purged or destroyed so that PHI cannot be retrieved.
III. Permissible Uses and Disclosures without Your Written Authorization or Opportunity to Agree or Object
If you are receiving mental health or public health services, subject to the limitations which we will describe in Sections III and IV below, we may use and/or disclose your PHI without your written permission for the following purposes:
A. Uses and Disclosures for Treatment, Payment and Health Care Operations.
- Treatment. We may disclose your PHI to health care providers and practitioners involved in your health care. For example, treatment includes activities performed by licensed clinical social workers and other types of health care professionals providing care to you or coordinating or managing your care.
- Payment. We may use and disclose your PHI to assure that services provided to you are paid for. For example, PHI may be shared with an acute care hospital providing services to a behavioral health client to confirm that payment is made to the hospital.
- Health Care Operations. We may use and disclose your PHI for our business operations. For example, we may use PHI to evaluate the quality of care provided to you. We may also disclose PHI to our privacy officer that is needed in order to resolve any complaints you may have.
B. Public Health Activities. We may disclose your PHI for the following public health activities: (1) to report health information to public health authorities for the purpose of preventing or controlling disease, injury or disability; (2) to report child abuse and neglect to public health authorities or other government authorities authorized by law to receive such reports; (3) to report information about products and services under the jurisdiction of the U.S. Food and Drug Administration; (4) to alert a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition; and (5) to report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance.
C. Victims of Abuse, Neglect or Domestic Violence. If we reasonably believe you are a victim of abuse, neglect or domestic violence, we may disclose your PHI to a governmental authority, including a social service or protective services agency, authorized by law to receive reports of such abuse or neglect.
D. Health Oversight Activities. We may disclose your PHI to a health oversight agency that oversees the health care system and is charged with responsibility for ensuring compliance with the rules of government health programs such as Medicaid.
E. Judicial and Administrative Proceedings. We may disclose your PHI in the course of a judicial or administrative proceeding in response to a legal order or other lawful process.
F. Law Enforcement Officials. We may disclose your PHI to the police or other law enforcement officials as required or permitted by law or in compliance with a court order or a grand jury or administrative subpoena.
G. Cadaveric Organ, Eye or Tissue Donation. We may disclose your PHI to organizations that facilitate organ, eye or tissue donation and transplantation.
H. Health or Safety. We may, consistent with applicable law and standards of ethical conduct, use or disclose your PHI to prevent or lessen a threat of imminent, serious physical violence against you or another readily identifiable individual.
I. Specialized Government Functions. We may use and disclose your PHI to units of the government with special functions, such as the U.S. military, or for national security and intelligence activities and for the protection of the president of the United States.
J. Workers’ Compensation. We may disclose your PHI as authorized by and to the extent necessary to comply with state law relating to workers’ compensation or other similar programs.
K. Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
L. Coroners, Medical Examiners and Funeral Directors. We may disclose your protected health information to a coroner, medical examiner or funeral director to carry out their duties.
M. Business Associates. We may disclose your protected health information to our business associates who perform functions on our behalf or provide us with services if the PHI is necessary for those functions or services.
N. Disaster Relief. We may disclosure your protected health information to disaster relief organizations that seek your PHI to coordinate your care or notify family and friends of your location or condition in a disaster. We will provide you with an opportunity to agree or object to such a disclosure whenever we can practicably do so.
O. Incidental disclosures. Disclosures that are incidental to permitted or required uses or disclosures under HIPAA are permissible, so long as we implement safeguards to avoid such disclosures, and we limit the PHI exposed through these incidental disclosures.
P. Notice to the Secretary of the Department of Health and Human Services. Disclosures may be made to the Secretary of HHS for HIPAA rules compliance and enforcement purposes.
Q. Other Uses and Disclosures as Required by Law. We may use and disclose your PHI when required to do so by any other law not already referred to in the preceding categories.
IV. Permissible Uses and Disclosures without Your Written Authorization or Opportunity to Agree or Object
If you are receiving alcohol or drug treatment, we may use and/or disclose your PHI without your written permission for the following purposes:
A. Internal Program Communications. CCS staff members involved in your care may use or disclose your PHI to communicate on a “need to know” basis.
B. In Response to a Crime against Program Personnel or on Program Premises. CCS may disclose PHI to law enforcement agencies or officials which:
- Are directly related to a client’s commission of a crime on the premises of CCS or against CCS personnel or to a threat to commit such a crime; and
- Are limited to the circumstances of the incident, including the client status of the individual committing or threatening to commit the crime, that individual’s name and address, and that individual’s last known whereabouts.
C. To Report Suspected Child Abuse or Neglect. CCS may report incidents of suspected child abuse and neglect to the appropriate state or local authorities. However, Part 2 restrictions continue to apply to the original substance use disorder patient records maintained by CCS including their disclosure and use for civil or criminal proceedings which may arise out of the report of suspected child abuse and neglect.
D. Medical Emergencies. CCS may disclose your protected information to medical personnel for the purpose of treating a condition that poses an immediate threat to the health of any individual and that requires immediate medical intervention.
E. In a Communication with a Qualified Service Organization. CCS may disclose to a qualified service organization information needed by the qualified service organization to provide services to CCS.
F. For Audit and Evaluation Activities. CCS may disclose patient-identifying information to qualified persons who are conducting an audit or evaluation of CCS’s substance abuse treatment program, without your consent, provided that certain safeguards are met. As with other disclosure requirements discussed, disclosures will be limited to the minimum necessary to accomplish the audit or evaluation.
G. In Response to a Valid Court Order. CCS may disclose your health information in response to an authorizing court order.
H. For Research Activities. CCS may disclose the minimum PHI necessary to conduct research activities, with certain restrictions.
I. Reporting Vital Statistics. CCS may disclose client PHI relating to the cause of death of a client under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death.
V. Uses and Disclosures Requiring Your Written Authorization
A. Use or Disclosure with Your Authorization. For any purpose other than the ones described above in Section III and in this Section IV, we only may use or disclose your PHI when you grant us your written authorization to do so.
B. Specially Protected Health Information. Genetic, HIV/AIDS and substance abuse treatment related Information is specially protected by law and your authorization is generally required for its release. Genetic information may not be used to decide whether coverage can be given or at what price.
C. Marketing and Sale of Protected Health Information. CCS will not disclose your protected health information for marketing purposes or sell your protected health information without your written authorization.
D. Disclosures to Family, Friends and Others. CCS may not disclose your health care information to members of your family, friends of yours or other persons who are involved in your care without your written authorization.
VI. Your Rights Regarding Your Protected Health Information
A. Right to Request Restrictions. You may request restrictions on our use and disclosure of your PHI (1) for treatment, payment and health care operations, (2) to individuals (such as a family member, other relative, close personal friend or any other person identified by you) involved with your care or with payment related to your care, or (3) to notify or assist in the notification of such individuals regarding your location and general condition. While we will consider all requests for restrictions carefully, we are not required to agree to a requested restriction. If you wish to request restrictions, please obtain a request form from our Privacy Office and submit the completed form to the Privacy Office. We will send you a written response. If we agree to the requested restrictions, we will comply with your request unless PHI is needed for emergency treatment.
B. Right to Receive Confidential Communications. You may request, and we will accommodate, any reasonable written request for you to receive your PHI by alternative means of communication or at alternative locations. If you wish to make a request, please contact our privacy officer in writing.
C. Right to Revoke Your Authorization. You may revoke your authorization, except to the extent that we have taken action in reliance upon it, by delivering a written revocation statement to the privacy officer identified below.
D. Right to Inspect and Copy Your Health Information. You may request access to any protected health information maintained by us that is used to make decisions about your health care. Under limited circumstances, we may deny you access to a portion of your records. If you desire access to your records, please obtain a record request form from the privacy officer and submit the completed form to the privacy officer. If you request copies, we may charge a reasonable cost-based fee. If you are denied access, you may request that the denial be reviewed. You should take note that, if you are a parent or legal guardian of a minor, certain portions of the minor’s medical record will not be accessible to you (for example, records relating to pregnancy, abortion, sexually transmitted diseases, substance use or abuse, or contraception and/or family planning services).
E. Right to an Electronic Copy of PHI. You have the right to receive your protected health information electronically, upon request.
F. Right to Receive Paper Copy of this Notice. Upon request, you may obtain a paper copy of this Notice, even if you have agreed to receive such notice electronically.
G. Right to Amend Your Records. You have the right to request that we amend protected health information maintained in your medical record file or billing records. If you desire to amend your records, please obtain an amendment request form from the privacy officer and submit the completed form to the privacy officer. We will comply with your request unless we believe that the information that would be amended is accurate and complete or other special circumstances apply.
H. Right to Receive an Accounting of Disclosures. Upon request, you may obtain an accounting of certain disclosures of your PHI made by us during any period of time prior to the date of your request provided such period does not exceed six years and does not apply to disclosures that occurred prior to April 14, 2003. The accounting will not include uses or disclosures for treatment, payment, or healthcare operations, or uses or disclosures you have already authorized. If you request an accounting of disclosures more than once during a twelve (12) month period, you may be charged for the accounting disclosure statement. We will also charge you for our postage costs, if you request that we mail the copies to you.
I. Right to Restrict Disclosures to a Health Plan. If you paid out-of-pocket (or in other words, you have requested that we not bill your health plan) in full for a specific item or service, you have the right to ask that your protected health information with respect to that item or service not be disclosed to a health plan for purposes of payment or health care operations. We will honor that request except where CCS is required by law to make a disclosure. Your request to restrict must be made in writing and should identify: (i) the information to be restricted, (ii) the type of restriction being requested (i.e. on the use of information, the disclosure of information, or both), and (iii) to whom the limits should apply.
J. Right to get Notice of a Breach. You have the right to be notified upon any breach of any of your unsecured protected health information.
VII. Effective Date and Duration of This Notice
A. Effective Date. This Notice is effective on March 1, 2020.
B. Right to Change Terms of this Notice. In the future, CCS may change its Notice of Privacy Practices. Any changes will apply to information CCS already has, as well as any information CCS receives in the future. A copy of the new notice will be posted on CCS’s website and provided as required by law. You also may obtain any new notice by contacting the CCS privacy officer.
VIII. Complaints or Additional Information
If you desire further information about your privacy rights, if you are concerned that we have violated your privacy rights or if you disagree with a decision that we made about access to your PHI, you may contact our privacy officer below. You will not be retaliated against for filing a complaint.
Community Counseling Solutions – Privacy Officer
550 W. Sperry St.
Heppner, OR 97836
Phone: 541-676-9161
Fax: 541-676-5662
Email: ccscompliance@ccsemail.org
State of Oregon Department of Human Services – Governor’s Advocacy Office
500 Summer St. NE, E17
Salem, OR 97301-1097
Phone: 800-442-5238
Fax: 503-378-6532
TTY/TDD: 503-945-6214
Email: GAO.info@state.or.us
Office for Civil Rights – Medical Privacy, Complaint Division
U.S. Department of Health and Human Services
200 Independence Avenue, SW HHH Building, Room 509H
Washington D.C. 20201
Phone: 866-627-7748 • TTY: 866-788-4989
Email: OCRComplaint@hhs.gov