ROCKBRIDGE TREATMENT & RECOVERY
NOTICE OF PRIVACY PRACTICES
EFFECTIVE DATE OF THIS NOTICE: December 9, 2024
FOR PURPOSES OF PART 2:
THIS NOTICE (“NOTICE”) DESCRIBES:
- HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
- YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
- HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION
YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM); AND
TO DISCUSS IT WITH OUR COMPLIANCE DIRECTOR AT DANA.FORBES@MNTC.ORG (612)238-6166 IF YOU HAVE ANY QUESTIONS.
FOR PURPOSES OF HIPAA:
THIS NOTICE ALSO DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. WHO WE ARE. This Notice describes the privacy practices of Minnesota Teen Challenge, Inc. d/b/a RockBridge Treatment & Recovery and its substance use disorder treatment programs, mental health treatment and other programs (“RockBridge Treatment & Recovery” or “we” or “us” or “our”).
II. OUR PRIVACY AND CONFIDENTIALITY OBLIGATIONS.
The privacy of your health information is important to us. We are required by federal and state laws to protect the privacy of your protected health information and substance use disorder records, as applicable, and to provide you with this Notice of our legal duties and privacy practices. While we are required to abide by the terms of this Notice, we reserve the right to change the terms and to make new Notice provisions effective for all protected health information and Records that we maintain. We will post a revised Notice in our offices and on our website and make copies available to you upon request.
At the federal level, RockBridge Treatment & Recovery is covered by the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Regulations (45 C.F.R Parts 160 and 164) and by the federal law protecting the confidentiality of substance use disorder patient records 42 C.F.R. Part 2 (“Part 2”). Which law applies in a given context depends upon the services you receive from us. Below is a brief summary of the applicability and scope of each law.
a. Part 2.
Part 2 protects patient records maintained in connection with substance use disorder services (“Records”). Under Part 2, RockBridge Treatment & Recovery may not use or disclose any information about any patient applying for or receiving services (including diagnosis, treatment or referral) for substance use disorder unless the patient has consented in writing (on a form that meets the requirements established by the regulations) or unless another very limited exception specified in the regulations applies. Any disclosure must be limited to the information necessary to carry out the purpose of the disclosure. In addition, if you are applying for or receiving services for substance use disorder, we may not acknowledge to a person outside RockBridge Treatment & Recovery that you attend our treatment program or disclose any information identifying you as a person having or having had a substance use disorder except as otherwise described in this notice.
b. HIPAA.
HIPAA provides protection for your protected health information (“PHI”) whether or not you are applying for or receiving services for substance use disorder. That is, HIPAA provides another layer of protection for individuals if you are applying for or receiving services for substance use disorder. If we are providing other health services, the PHI generated from those services is governed by HIPAA.
III. USES AND DISCLOSURES OF YOUR PHI AND RECORDS.
There are a number of purposes for which it may be necessary for us to use or disclose your PHI or Records. For some of these purposes, we are required to obtain your authorization under HIPAA, and/or your consent under Part 2, depending on the circumstances. Following is a description of these uses and disclosures. For each category of uses or disclosures, we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories. Additionally, for some of the disclosures of PHI or Records described below, Minnesota law may require us to obtain written consent from you.
a. Uses and Disclosures of PHI That Require HIPAA Authorization:
i. Uses and Disclosures You Specifically Authorize. You may give us written authorization to use your PHI or to disclose it to anyone for any purpose. If you give us an authorization, you may revoke it in writing at any time. If you revoke your authorization, we will stop using or disclosing your PHI in accordance with that authorization, except to the extent we have already relied on it. Without your written authorization, we may not use or disclose your PHI for any reason except those described in this Notice.
ii. Psychotherapy Notes. We must obtain an authorization for any use or disclosure of psychotherapy notes, except in limited circumstances as provided in 45 C.F.R. §164.508(a)(2).
iii. Marketing. We must obtain an authorization for any use or disclosure of PHI for marketing (as defined under HIPAA), except if the communication is in the form of a face-to-face communication made by us to an individual, or a promotional gift of nominal value provided by us. If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at 45 C.F.R. §164.501, to us from a third-party, the authorization must state that such remuneration is involved.
iv. Sale of PHI. Except in limited circumstances covered by the transition provisions in 45 C.F.R. §164.532, we must obtain an authorization for any disclosure of PHI which is
a sale of PHI, as defined in 45 C.F.R. § 164.501. Such authorization must state that the disclosure will result in remuneration to RockBridge Treatment & Recovery.
b. Uses and Disclosures of PHI That Do Not Require HIPAA Authorization:
i. Treatment, Payment, and Health Care Operations.
1. Treatment. We may use or disclose PHI about you to provide and manage your health care. This may include communicating with other health care providers regarding your treatment and coordinating and managing the delivery of health services with others. For example, we may use or disclose PHI about you when you need a prescription, lab work, drug testing or other health care services.
2. Payment. We may use or disclose your PHI to bill and collect payment for the treatment and services provided to you. For example, a bill may be sent to you or a third-party payer. The information on or accompanying the bill may include information that identifies you, as well as your diagnosis, procedures and supplies used.
3. Health Care Operations. We may use or disclose PHI about you to allow us to perform business functions. For example, we may use your PHI to help us train new staff and conduct quality improvement activities. We may also disclose your information to consultants and other business associates who help us with these functions (for example, billing, computer support and transcription services). We may disclose your PHI to an agent or agency which provides services under a qualified service organization agreement and/or business associate agreement, in which they agree to abide by applicable federal law and related regulations 42 C.F.R. Part 2 and HIPAA. We may contact you to send you reminder notices of future appointments for your treatment.
ii. Appointment Reminders and Other Contacts. We may use your PHI to contact you with reminders about your appointments, alternative treatments you may want to consider, or other services provided by RockBridge Treatment & Recovery that may be of interest to you.
iii. Fundraising. We may use or disclose your demographic information and dates of treatment to contact you to raise money for our organization; however, we must allow you to opt out of receiving future fundraising communications and provide clear procedures as to how you would opt out of such communications.
iv. Law Enforcement Purposes. For example, when complying with laws that require the reporting of certain types of wounds or injuries. We may disclose your PHI to the police or other law enforcement officials if you commit a crime on the premises or against RockBridge Treatment & Recovery personnel or threaten to commit such a crime.
v. Judicial and Administrative Proceedings. For example, when responding to a request for PHI contained in a court order.
vi. Health Oversight Activities. For example, when disclosing PHI to a state or federal health oversight agency so that they can appropriately monitor the health care system.
vii. Abuse and Neglect. We may disclose your PHI for the purpose of reporting child abuse and neglect and, in Minnesota, prenatal exposure to controlled substances, including alcohol, to public health authorities or other government authorities authorized by law to receive such reports.
viii. Minors. We may disclose to a parent or guardian or other person authorized under state law to act on behalf of a minor, those facts about a minor which are relevant to reducing a threat to the life or physical well-being of the minor or any other individual, if RockBridge Treatment & Recovery determines that the minor applicant lacks capacity to make a rational decision and the minor’s situation poses a substantial threat to the life or physical well-being of the minor or any other individual which may be reduced by communicating relevant facts to such person.
ix. Public Health Activities. For example, when reporting to public health authorities, the exposure to certain communicable diseases or risks of contracting or spreading a disease or condition.
x. Related to Correctional Institutions. We may disclose PHI as allowed under applicable law to correctional institutions and in other custody situations.
xi. Research. We may use or disclose PHI if our privacy board, or an Institutional Review Board, as described at 45 CFR 164.512(i)(1)(i)(A)-(B), approves a waiver of authorization for disclosure.
xii. Incompetent and Deceased Patients. In the event an individual is determined to be incompetent or dies, we may obtain authorization of a personal representative, guardian or other person authorized by applicable law. We may also use or disclose PHI to a coroner, medical examiner, or other authorized person for the purpose carrying out their duties authorized by law, such as identifying a deceased person or determining cause of death.
xiii. Organ, Eye, or Tissue Donation. We may use or disclose PHI to an entity for the purpose of facilitating organ, eye or tissue donation and transplantation.
xiv. Health or Safety. We may use or disclose PHI to prevent or lessen a serious and imminent threat to the health or safety or you, another person or the public.
xv. Worker’s Compensation. We may disclose PHI as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs.
xvi. Required by Law. We may disclose your PHI when such disclosure is required by federal, state or local laws.
c. Additional Information Regarding Uses and Disclosures Under HIPAA:
i. Redisclosure Notice. We are required to advise you that PHI disclosed by RockBridge Treatment & Recovery may be subject to redisclosure by the recipient and no longer protected by HIPAA.
ii. Special HIPAA Privacy Protections for Reproductive Health Care.
1. Prohibition. Under HIPAA, we are prohibited from using or disclosing PHI for either of the following purposes:
(a) To conduct a criminal, civil or administrative investigation into or impose criminal, civil or administrative liability on any person for the mere act of seeking, obtaining, providing or facilitating reproductive health care.
(b) For the identification of any person for the purpose of conducting such investigation or imposing such liability.
2. Applicability of Prohibition. This prohibition applies so long as we have reasonably determined that the reproductive health care is lawful under the circumstances in which it is provided. For example, the prohibition would apply if a resident of one state traveled to another state to receive reproductive health care, such as an abortion, that is lawful in the state where such health care was provided. It would also apply, for example, where the underlying reproductive health care continues to be protected by the United States Constitution, such as contraception, or is expressly required or authorized under Federal law. Reproductive health care provided by an entity other than RockBridge Treatment & Recovery is presumed lawful unless we have actual knowledge or factual information that it is not.
3. Attestation Requirement. Under certain circumstances, if we receive a request for PHI that is potentially related to reproductive health care, we must obtain a signed attestation that the use or disclosure is not for one of the prohibited purposes described above. This requirement applies if the request is for health oversight activities, judicial and administrative proceedings, law enforcement purposes, or disclosures to coroners and medical examiners. For example, if a federal or state agency monitoring the health care system sought PHI from us that was potentially related to reproductive health care, we would be required to obtain a signed attestation from the agency that the use or disclosure was not for one of the prohibited purposes described above.
d. Uses and Disclosures of Part 2 Records That Require Written Consent:
i. Uses and Disclosures for Which You Have Given Consent. You may give us written consent to use or disclose your Records for any purpose. Without your consent, we may not use or disclose your Records for any purpose not described in this Notice. You have the right to revoke your consent at any time in writing, except to the extent that we have already acted in reliance on it.
ii. Treatment, Payment and Health Care Operations. With your consent, we may use or disclose your Records for purposes of treatment, payment and health care operations, as defined in the Treatment, Payment and Health Care Operations section pertaining to HIPAA authorizations. You may provide a single consent for all future uses or disclosures for treatment, payment and health care operations purposes.
iii. Substance Use Disorder Notes. With your consent, we may use or disclose substance use disorder counseling notes, except in limited circumstances as provided in 42 C.F.R. § 2.31(b). For instance, with your consent, we may disclose your substance use disorder counseling notes to another treating provider.
iv. Civil, Administrative, Criminal or Legislative Proceedings. We may only use or disclose your Records, or testimony relaying the content of such Records, in a civil, administrative, criminal or legislative proceeding against you if we have your specific written consent or a court order. Records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to the patient or the holder of the Record, where required by law. Additionally, a court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the Record is used or disclosed.
v. Prevention of Multiple Enrollments. With your consent, we may make a limited disclosure of your Records to a central registry or withdrawal management or maintenance treatment program within 200 miles of our program for the purpose of preventing multiple enrollments. For example, with your consent, we may disclose your use of a withdrawal management medication to prevent duplicative prescriptions.
vi. Criminal Justice Referrals. With your consent, we may disclose information from a Record to persons in the criminal justice system who have made participation in our program mandatory. For instance, if participation in our program is a condition of probation, we may disclose information from your Record to the probation officer responsible for monitoring your progress.
vii. Prescription Drug Monitoring Programs. We may report any substance use disorder medication that we prescribe or dispense to you to a state prescription drug monitoring program if required by state law. We must obtain your consent prior to making such a report.
e. Uses and Disclosures Under Part 2 That Do Not Require Written Consent:
i. Medical Emergencies. We may disclose your patient identifying information, as defined under Part 2, to medical personnel to the extent necessary to meet a bona fide medical emergency.
ii. Research. We may use and disclose your patient identifying information for the purposes of conducting scientific research under certain circumstances as permitted by law.
iii. Management Audits, Financial Audits and Program Evaluation. We may disclose your patient identifying information for management audits, financial audits and program evaluation under certain circumstances as permitted by law.
iv. Minors. We may disclose to a parent or guardian or other person authorized under state law to act on behalf of a minor, those facts about a minor which are relevant to reducing a threat to the life or physical well-being of the minor or any other individual, if RockBridge Treatment & Recovery determines that the minor applicant lacks capacity to make a rational decision and the minor’s situation poses a substantial threat to the life or physical well-being of the minor or any other individual which may be reduced by communicating relevant facts to such person.
v. Public Health. We may disclose de-identified information about you from your Records to public health authorities for public health purposes.
vi. Patients Who Lack Capacity and Deceased Patients. In the event an individual is determined as lacking capacity or dies, we may obtain consent of a personal representative, guardian or other person authorized by applicable law. We may also disclose patient identifying information relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death.
vii. Fundraising. We may use or disclose your Records to fundraise for the benefit of RockBridge Treatment & Recovery provided that we first give you the opportunity to opt out. Please contact us to opt out.
viii. Disclosures to the Secretary of the United States Department of Health and Human Services. We must disclose Records to the Secretary of the United States Department of Health and Human Services for enforcement of Part 2.
ix. Communication Within RockBridge Treatment & Recovery’s Part 2 Program or Between RockBridge Treatment & Recovery ’s Part 2 Program and an Entity Having Direct Administrative Control Over the Program. We may use or disclose information about you as part of communications between or among personnel having a need for information in connection with their duties arising from the provision of diagnosis, treatment or referral for treatment of substance use disorder, provided that the communications are within RockBridge Treatment & Recovery’s Part 2 program or with an entity having direct administrative control over the program.
x. Qualified Service Organizations. We may use or disclose information about you as part of communications between RockBridge Treatment & Recovery’s Part 2 program and a qualified service organization that requires information in order to provide services to or on behalf of RockBridge Treatment & Recovery’s Part 2 program.
xi. Crimes on RockBridge Treatment & Recovery’s Premises or Against RockBridge Treatment & Recovery Personnel. We may use or disclose information about you as part of communications between RockBridge Treatment & Recovery’s Part 2 program personnel and law enforcement, when the communications are directly related to a patient’s commission of a crime on RockBridge Treatment & Recovery’s Part 2 program premises or against RockBridge Treatment & Recovery Part 2 program personnel (or a threat to commit such crime) and when limited to the circumstances of the incident, including patient status of the individual committing or threatening to commit the crime, the individual’s name and address, and the individual’s last known whereabouts.
xii. Reports of Suspected Child Abuse and Neglect. We may report suspected child abuse and neglect to the appropriate state or local authorities. However, restrictions continue to apply to the original Records maintained by RockBridge Treatment & Recovery’s Part 2 program including their use and disclosure for civil or criminal proceedings which may arise out of the report of suspected child abuse and neglect.
IV. YOUR INDIVIDUAL RIGHTS
a. Right to Access and Copy Your PHI.
You have the right to access and receive a copy or a summary of your PHI contained in clinical, billing and other records that we maintain and use to make decisions about you. We ask that your request be made in writing. We may charge a reasonable fee. There might be limited situations in which we may deny your request. Under these situations, we will respond to you in writing, stating why we cannot grant your request and describing your rights to request a review of our denial.
b. Right to Request an Amendment of Your PHI.
You have the right to request amendments to the PHI about you that we maintain and use to make decisions about you. We ask that your request be made in writing. Your request must explain, in as much detail as possible, your reason(s) for the amendment. Under limited circumstances, we may deny your request. If we deny your request, we will respond to you in writing stating the reasons for the denial. You may file a statement of disagreement with us. You may also ask that any future disclosures of the PHI under dispute include your requested amendment and our denial to your request.
c. Right to Request Restrictions on Uses and Disclosures of Your PHI and Records.
You have the right to request that we restrict our use or disclosure of your PHI or Records, as applicable. We ask that your request be made in writing. We are not required to agree to your request unless the disclosure is to your health plan for the purpose of carrying out payment or health care operations, the information pertains solely to a health care item or service for which you have paid us in full, and disclosure is not otherwise required by law. We will notify you of our decision with respect to your request. If we agree to your request, we will comply with our agreement unless there is an emergency or we are otherwise required by law to use or disclose the information.
d. Right to Request Confidential Communications.
Normally, we will communicate with you by phone, mail or email using contact information for you in our files. You have the right to request, and we will accommodate any reasonable written request for you, to receive your PHI by alternative means of communication or at alternative locations.
e. Right to Request an Accounting of Disclosures of PHI and Records.
You have the right to request and receive a listing of certain disclosures that we have made of your PHI. You may ask for disclosures made up to six (6) years before the date of your request.
In the future, once the HIPAA rules are modified to provide for an accounting of disclosures made through an electronic health record system, and with respect to Records, you will have the right to request and receive a listing of certain disclosures that we have made with your consent. You may request disclosures made in the three (3) years prior to the date of your request. We will provide you with a list of disclosures of Records for purposes of treatment, payment and health care operations only where such disclosures were made through an electronic health record. In addition, you have the same right to request and receive a list from an intermediary if you consented to disclosure of your Records to the intermediary without being provided the name(s) of the intermediary’s participants.
We ask that any request for a list of disclosures be made in writing. We will provide you one accounting in any 12-month period free of charge.
f. Right to Receive a Copy of This Notice.
You have the right to request and receive a copy of this Notice at any time (in paper or electronic form). We will make this Notice available in electronic form and post it in our web site. You also have the right to discuss this Notice with us if you have any questions.
g. Right to Notice of Breach.
You will be notified following a breach of your unsecured PHI or Records, to the extent required by applicable law. We will provide such notice to you by mail and/or email, as authorized by you.
h. Right to Electronic Copy of “Electronic Health Record.”
If we maintain your “Electronic Health Record,” you have the right to ask for an accounting of disclosures of where we disclosed your PHI. You may request an accounting for a period of three (3) years prior to the date the accounting is requested. You also have the right to ask our business associates for an accounting of their disclosures. In addition, if you have an “Electronic Health Record” with us, you have a right to request an electronic copy of your Electronic Health Record. Not all health care information stored electronically is considered an Electronic Health Record. The term “Electronic Health Record” means an electronic record of health-related information on an individual that is created, gathered, managed and consulted by authorized health care clinicians and staff.
If you have any questions about these rights or wish to exercise any of them, please contact our Privacy Officer using the contact information listed below.
If you are concerned that your privacy rights have been violated, you may file a complaint with our Privacy Officer. You may also submit a written complaint to the U.S. Department of Health and Human Services. We will provide you with the address to file your complaint with the U.S. Department of Health and Human Services upon request. We support your right to the privacy of your protected health information. We will not retaliate in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.
Privacy Officer Contact Information:
Dana Forbes
Compliance Director
740 E 24th St
Minneapolis, MN 55404
Telephone: 612-373-3366
Direct: 612-238-6166
If you want more information about our privacy practices generally, or have questions or concerns, please contact our Director of Administration & Human Resources.