Notice of Privacy Practices

We are required by law to maintain the privacy of your protected information and to provide you with notice of our legal duties and privacy practices with respect to your protected information.

Any individually identifying information, including any information likely to disclose your location, or other information that would serve to identify you (e.g., your racial or ethnic background or religious affiliation) is “personal information” subject to the confidentiality provisions of the Family Violence Prevention and Services Act (“FVPSA”), Violence Against Women Act (“VAWA”) and/or Victims of Crime Act (“VOCA”).

Any individually identifiable information about your past, present, or future health or condition, the provision of health care to you, or payment for the health care is “protected health information” subject to the Health Insurance Portability and Accountability Act (“HIPAA”).

Some of your protected information may be subject to laws and requirements that are even more restrictive than the laws noted above. We maintain your protected information in accordance with all applicable laws and requirements.

This Notice explains how, when and why we may use or disclose your protected information. We are required to follow the privacy practices described in this Notice, though we reserve the right to change our privacy practices and the terms of this Notice at any time, but we will only change our practices and terms as permitted by law. If we do so, we will post a new Notice at the reception desk. You may request a copy of the new Notice from the Quality and Risk Administrator, at 602-285-1999. The terms of the new Notice will apply to all protected information we maintain about you.

We may use and disclose your protected information for a variety of reasons. In most cases, we will only do so with your consent or written authorization. While there are some situations in which we may use your protected information without your consent or written authorization (noted below), we will not disclose, reveal or release your protected information without your written, time-limited consent except in a few very limited circumstances (described below), and you will never be required to provide such consent in order to receive services. NOTE: The address of My Sisters’ Place is not made public.

Uses For Services and Operations. Generally, we do not need your consent or authorization to use your protected information for the following:

• • To provide services to you: We may use your protected information to provide you with our services. Staff members, volunteers, and other service delivery personnel involved in providing services to you may access your protected information to provide such services. However, we will only disclose your protected information to a health care provider with your written consent.

• • For our operations: We may use your protected information to operate our program. For example, we may use your protected information in evaluating the quality of services provided. Because the services offered at My Sisters’ Place are free; we do not use or disclose your protected information for any billing or payment purposes.

Other Uses and Disclosures: We may also use and/or disclose your protected information without your consent or authorization in these very limited circumstances:

• • When required by law: We may use or disclose your protected information to the extent we are legally required to do so. If we are compelled by statute or a court mandate to release your protected information, we will (i) make reasonable attempts to notify you of such release of that protected information; and (ii) take steps necessary to protect the privacy and safety of you and any other persons affected by the release of that protected information.

NOTE: Under Arizona law, if you are a domestic violence victim and communicate with a domestic violence victim advocate, those communications are privileged (and the advocate cannot be required to testify) except in a few limited circumstances.

• • For public health and health oversight activities: We may use your protected information as necessary for public health or health oversight activities, but we may only disclose (i) non-personally identifiable data regarding our services in the aggregate; or (ii) non-personally identifiable demographic information in order to comply with reporting, evaluation, or data collection requirements.

• • Victims of abuse or neglect: We will only use or disclose your protected information to report abuse and neglect if we believe a minor is or has been the victim of abuse or as otherwise required or permitted by law.

• • For law enforcement purposes: We may use protected information for limited law enforcement purposes, but we may only disclose (i) court-generated information and law enforcement-generated information contained in secure, governmental registries for protective order purposes; and (ii) law enforcement- and prosecution-generated information necessary for law enforcement and prosecution purposes.

• • To avert threat to health or safety: We may use protected information if we believe, in good faith, it is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public, but we may only report imminent risk of serious bodily injury or death of a victim or another person as required or permitted by law.

• • For research purposes: We will not use or reveal any research or statistical information that includes your protected information except for the purposes for which such information was obtained and in accordance with VOCA.

Other Uses and Disclosures Require Consent or Authorization: For any use or disclosure of protected information not described above, we will obtain your written consent or authorization as required by law. For example, we will not share any of your protected information with any family member or friend without your written consent unless it is required by law. You may revoke your consent/authorization at any time to stop future uses and/or disclosures of your protected information, but your revocation will not apply if have taken an action in reliance upon your consent/authorization.

You have the following rights relating to your protected information:

• • To request restrictions on uses/disclosures: You have the right to ask in writing that we limit how we use or disclose your protected information. We will agree to all reasonable requests.

• • To choose how we contact you: You have the right to ask in writing to communicate with you at a certain address or through certain means. We will only communicate with you in a confidential manner and in the manner you request.

• • To inspect and copy your protected information: You have a right to request in writing to see or to receive a copy of your protected information. We will respond to your request within 30 days. We will not charge you for a copy of your protected information.

• • To request amendment of your protected information: If you believe that there is a mistake or missing information in our records, you may request in writing that we correct or add to the protected information in our record. We will respond within 60 days of receiving your request. If we deny your request, we will state the reasons for denial and explain your rights to have the request and denial, along with any statement in response that you provide, appended to our record of your protected information.

• • To find out what disclosures have been made: You have the right to request a list of certain disclosures we make of your protected information.

• • To receive this notice: You have a right to receive a paper copy of this Notice and/or an electronic copy by email upon request. If you request an electronic copy via email, you must sign a consent form that allows us to communicate with you in that manner.

• • To be notified of a breach: We will notify you if there is a breach of your unsecured protected information in accordance with any applicable law.

If you think we may have violated your privacy rights, you may file a complaint with the person listed in Section VI below. You also may file a written complaint with the Secretary of the U.S. Department of Health and Human Services: https://www.hhs.gov/hipaa/for-individuals/index.html. We will not penalize you or retaliate against you in any way for filing a complaint.

If you have questions about this Notice or you want to file a complaint about our privacy practices, you may submit a Client Grievance form, which may be obtained from your case worker, or contact: Quality and Risk Administrator, 5151 N 19^th Avenue, Phoenix AZ 85015 or 602-285-1999.