In accordance with HIPAA, Core Recovery does not disclose Protected Health Information (PHI) unless authorized or legally obligated to do so under law. Core Recovery’s full policies and practices are described in the following notice.
- Notice of Privacy Practices
This notice describes how Core Recovery, LLC. may use and disclose your Protected Health Information (PHI) to carry out treatment, payment, or health care operations. It also describes Core Recovery’s legal obligations concerning your PHI and your rights to access and control your PHI. This notice takes effect on April 14, 2003, in accordance with the privacy regulations issued under the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA Privacy Regulations”).
PHI refers to individually identifiable health information, including actual medical information as well as your name, address, phone number, identification number or other identifiers, collected from you or created by or received by a health care provider, a health plan, or your employer and that relates to: 1) your past, present, or future physical or mental health condition; 2) the provision of mental health care to you; or 3) the past, present, or future payment for health care provided to you.
Core Recovery is required by law to maintain the privacy of your PHI. Core Recovery is obligated to provide you with a copy of this Notice and Core Recovery must abide by the terms of this Notice.
- Uses and Disclosures of Protected Health Information (PHI):
Your PHI may be used and disclosed by your primary behavioral health provider (counselor and/or case manager), Core Recovery office staff and others outside of Core Recovery offices who are involved in your care and treatment for purposes of providing health care services to you, to pay your health care bills, to support the operation of Core Recovery practices, and any other use required by law.
Treatment: Core Recovery may use and disclose your PHI to provide, coordinate or manage your health care and other services related to your health care. This includes the coordination or management of your health care with a third party such as when Core Recovery staff consult with the criminal justice agent(s) you report to, or another health care provider, such as your family physician or another behavioral health professional.
Payment: Your PHI may be used, as needed, to obtain payment for your health care services. Examples of payment are when Core Recovery discloses your PHI to the criminal justice agency that pays for your services or a health insurer to obtain reimbursement for your health care or to determine eligibility or coverage.
Health Care Operations: Core Recovery may use and disclose your PHI for our health care operations. These activities include but are not limited to: Quality assessment and improvement activities, employee review activities, training of behavioral health students, licensing, and conducting or arranging business-related matters such as audits and administrative services, and case management and care coordination.
Business Associates: Core Recovery contracts with individuals and entities (business associates) to perform various functions on our behalf, which involves the use and/or disclosure of PHI. Business associates must agree in writing to appropriately safeguard your information.
- Uses and disclosures requiring authorization
Core Recovery may use or disclose PHI for purposes outside of treatment, payment, or health care operations when your written authorization is obtained. In those instances when Core Recovery is asked for information for purposes outside of treatment, payment or health care operations, Core Recovery staff will obtain an authorization from you before releasing this information.
You may revoke all authorizations of PHI at any time, provided each revocation is in writing. You may not revoke an authorization to the extent that Core Recovery has taken an action in reliance on the use or disclosure indicated in the authorization. However, for persons court-ordered or on probation or parole, if consent is given for disclosure to the criminal justice system, this consent may not be revoked (See 42 CFR, Part 2 for federal regulations governing confidentiality of alcohol and drug use clinical records).
- Uses and Disclosures with Neither Consent nor Authorization
Core Recovery may use or disclose PHI without your consent or authorization in the following circumstances:
- Required by Law – Core Recovery staff may use or disclose PHI in keeping with the law.
- Public Health – Core Recovery staff may use or disclose PHI for the purposes of controlling disease, injury or disability.
- Child Abuse – Core Recovery staff are required to report PHI to the appropriate authorities when there are reasonable grounds to believe that a minor is or has been the victim of neglect or physical and/or sexual abuse.
- Adult Abuse – If you have the responsibility for the care of an incapacitated or vulnerable adult, Core Recovery staff are required to disclose PHI when there is reasonable basis to believe that abuse or neglect of the adult has occurred or that exploitation of the adult’s property has occurred.
- Health Oversight Activities – If the Arizona Department of Health Services or other oversight entity is investigating, then Core Recovery is required to disclose PHI upon receipt of notice.
- Legal Proceedings – Core Recovery may disclose your PHI: 1) during any judicial or administrative proceeding; 2) in response to an order of a court; and 3) in response to a subpoena, a discovery request, or other lawful process.
- Serious Threat to Health or Safety – If you communicate to any Core Recovery staff an explicit threat of imminent serious physical harm or death to a clearly identified or identifiable victim(s) and it is believed you have the intent and ability to carry out such a threat, Core Recovery staff have a duty to take reasonable precautions to prevent the harm from occurring, including disclosing information to the potential victim and the police and in order to initiate hospitalization procedures. If staff believes there is an imminent risk that you will inflict serious harm on yourself, staff may disclose information in order to protect you. Duty to Warn.
- Worker’s Compensation – Core Recovery may disclose PHI as authorized by and to the extent necessary to comply with laws relating to worker’s compensation or other similar programs, established by law, which provide benefits for work-related injuries or illness without regard to fault.
- Appointment Reminders – Core Recovery staff may use or disclose PHI to set up appointments or provide you with appointment reminders (such as answering machine/voicemail messages, letters).
- Potential Impact of State Law – In some situations, the HIPAA Regulations do not take the place of state privacy or other laws that provide individuals greater privacy protections. As a result, the privacy laws of Arizona, or other federal laws, rather than the HIPAA Privacy Regulations, might impose a privacy standard under which Core Recovery will be required to operate. For example, records from drug and alcohol programs may be subject to additional restrictions (See 42 CFR, Part 2 for federal regulations governing confidentiality of alcohol and drug use clinical records).
- Patient’s Rights and Core Recovery Staff Duty
- Right to Inspect and Copy – You have the right to inspect or obtain a copy (or both) of PHI in Core Recovery’s clinical and billing records used to make decisions about you for as long as the PHI is maintained in the record. Core Recovery may deny your access to PHI under certain circumstances (such as information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding, and PHI that is subject to law that prohibits access to PHI). If you request a copy of the information, Core Recovery may charge a fee for the costs of copying, mailing, or other supplies associated with your request.
- Right to Request a Restriction – You have the right to request restrictions on certain uses and disclosures of protected health information. However, Core Recovery is not required to agree to a restriction you request. If Core Recovery agrees to the restriction, we will comply with the restriction unless the information is needed to provide emergency treatment to you or unless the use or disclosure is otherwise permitted or required by law.
- Right to Request to Receive Confidential Communications by Alternative Means or at Alternative Locations – You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations. (For example, you may not want a family member to know that you are in treatment at Core Recovery). On your request, Core Recovery will send you communications at another address.
- Right to Request Amendment of PHI – You have the right to request an amendment of your PHI (in writing with an explanation of why the information should be amended) from the Core Recovery staff you are working with. Core Recovery may deny your request under certain circumstances.
- Right to an Accounting – You have the right to receive an accounting of certain disclosures (other than for treatment, payment, and healthcare operations) made by Core Recovery staff or our business associates of your PHI. Your request may be for disclosures made up to 6 years before the date of your request but may not include disclosures made before April 14, 2003. If you request an accounting more than once in a 12-month period, Core Recovery may charge you a reasonable fee for responding to these requests.
- Further Information.
If you would like further information about Core Recovery’s privacy policies, you may contact the Practice Administrator at 602-810-1210.