Notice of Privacy Practices

We are required by law to maintain the privacy of your protected health information and to provide you with notice of our legal duties and privacy practices with respect to your protected health information.

Individually identifiable information about your past, present, or future health or condition, the provision of health care to you, or payment for the health care is protected health information (PHI) subject to the Health Insurance Portability and Accountability Act and its implementing regulations (collectively, “HIPAA”). Some of your PHI may be subject to other laws or requirements that are even more restrictive than HIPAA. We maintain your protected health information in accordance with all applicable laws and requirements.

This Notice explains how, when and why we may use or disclose your PHI. We are required to follow the privacy practices described in this Notice, though we reserve the right to change our privacy practices and the terms of this Notice at any time, as permitted by law. If we do so, we will post a new Notice at the reception desk. You may request a copy of the new notice from the Quality and Risk Administrator, at 602-285-1999. The terms of the new Notice will apply to all PHI we maintain about you.

We may use and disclose your PHI for a variety of reasons. For most uses and disclosures, we will obtain your written authorization. However, in some situations, we may use or disclose your PHI without your written authorization. We explain those situations below.

Uses and Disclosures Relating to Treatment, Payment, or Operations. Generally, we do not need your consent to use or disclose your PHI as follows:

• • For treatment: We may use and disclose your PHI to treat you and to provide you with other types of health care services that you request. Staff members, volunteers, and other service delivery personnel involved in providing services to you may access your PHI in order to provide you with such services. We may also share your PHI with other health care providers to coordinate your treatment or services.

• • To obtain payment: If we bill or collect payment for services, we may use or disclose your PHI for payment purposes. For example, we may release portions of your PHI to Medicaid, a private insurance plan, or a state office to get paid for services that we delivered to you.
    
    
• • For our operations: We may use or disclose your PHI in the course of operating our programs. For example, we may use your PHI in evaluating the quality of services provided, and we may disclose your PHI to our accountant or attorney if necessary for audit or legal purposes.

Other Uses and Disclosures Not Requiring Authorization: We may also use or disclose your PHI without your authorization in the following circumstances:

• • When required by law: We may use or disclose your PHI when we are legally required to do so, but we will only disclose PHI to the extent required.

• • For public health activities: We may use or disclose your PHI for public health activities, such as when we are required to collect or report information about disease or injury or abuse or neglect, or to report vital statistics to the public health authority.

• • For health oversight activities: We may use or disclose PHI for health oversight activities, such as disclosing PHI to an agency responsible for monitoring the health care system, including in connection with audits, civil, administrative or criminal investigations, inspections, licensure or disciplinary actions.

• • For judicial or administrative proceedings: We may use or disclose PHI in the course of judicial or administrative proceedings, such as in response to a court order, subpoena, discovery request or other lawful process, so long as all conditions are met and we are required to do so.

• • For law enforcement purposes: We may use or disclose PHI for some limited law enforcement purposes, including identification and location and investigations related to a victim of a crime or crime on premises or reporting a crime in emergencies.

• • Decedents: We may use or disclose PHI relating to an individual's death to coroners, medical examiners or funeral directors, and to organ procurement organizations relating to organ, eye, or tissue donations or transplants.

• • For research purposes: In certain circumstances, we may use or disclose PHI for purposes of research.

• • To avert threat to health or safety: In order to avoid a serious threat to health or safety, we may disclose PHI as necessary to law enforcement or other persons who can reasonably prevent or lessen the threat of harm.

• • For specific government functions: We may use or disclose PHI in connection with certain military and veteran activities, national security and intelligence, and other specialized government functions.

• • For worker’s compensation: We may use or disclose your PHI to the extent necessary to comply with laws relating to worker’s compensation or other similar programs.

Uses and Disclosures Requiring an Opportunity to Object: We may use or disclose your PHI in the following situations if we inform you about the use or disclosure in advance and you do not object:

• • In facility directories: Your name, location, general condition and religious affiliation may be put into a facility directory for use by clergy and callers or visitors who ask for you by name.
• • To family members, friends or others involved in your care: We may share your PHI with family members, friends or others involved in your care but only to the extent directly related to their involvement in your care, or payment for your care, or to notify them about your location, general condition, or death.

If there is an emergency situation and we cannot provide you an opportunity to object, we may disclose your PHI if the disclosure is consistent with any prior expressed wishes and determined to be in your best interest. You must be informed and given an opportunity to object to further disclosure as soon as you are able to do so.

Uses and Disclosures Requiring Authorization: For any use or disclosure of PHI that is not described in this Notice, we will obtain your written authorization. For example, we will obtain your authorization for most uses and disclosures of your PHI for marketing efforts. You may revoke your authorization at any time to stop future uses and/or disclosures of your PHI, but your revocation will not apply if we have taken an action in reliance upon your authorization.

You have the following rights relating to your PHI:

• • To request restrictions: You have the right to ask in writing that we limit how we use or disclose your PHI. We will consider your request, but we are not required to agree to a restriction. However, if you or someone on your behalf pays for a health care item or service in full and you ask us not to disclose information about that item or service to your health plan for payment or operation purposes, we will abide by that request.

• • To inspect and copy your PHI: You have a right to request in writing to access the PHI in your record. We will respond to your request within 30 days. If we deny you access, we will give you a written reason for the denial and explain any right to have the denial reviewed. If you want copies of your PHI, we may charge you a reasonable fee depending on your circumstances.

• • To request amendment of your PHI: If you believe that there is a mistake or missing information in our records, you may request in writing that we amend your PHI in our record. We will respond within 60 days of receiving your request. If we deny your request, we will state the reasons for denial and explain your rights to have the request and denial, along with any statement in response that you provide, appended to our record of your PHI.

• • To find out what disclosures have been made: You have the right to request a list of certain disclosures we make of your PHI. We will provide the first list to you for free, but we may charge you for any additional lists you request during the same year. We will tell you in advance what this list will cost.

• • To choose how we contact you: You have the right to ask us in writing to contact you at an alternative address or by an alternative means. We will agree to your request so long as it is reasonable for us to do so. If you ask us to communicate with you through unsecure email or text, it is important for you to know that there is risk in those types of communication that your information may be intercepted/accessed by a third-party.

• • To receive this Notice: You have a right to receive a paper copy of this Notice and/or an electronic copy by email upon request. If you request an electronic copy via email, you must sign a consent form that allows us to communicate with you in that manner.

• • To be notified of a breach: We will notify you if there is a breach of your unsecured PHI.

If you think we may have violated your privacy rights, you may file a complaint with the person listed in the contact section below. You also may file a written complaint with the Secretary of the U.S. Department of Health and Human Services: https://www.hhs.gov/hipaa/for-individuals/index.html. We will not penalize you or retaliate against you in any way for filing a complaint.

If you have questions about this Notice or you want to file a complaint about our privacy practices, you may submit a Client Grievance form, which may be obtained from your case worker, or contact: Quality and Risk Administrator, 5151 N 19^th Avenue, Phoenix AZ 85015 or 602-285-1999.