DMH Privacy Notice~1.pdf

COMMONWEALTH OF MASSACHUSETTS

DEPARTMENT OF MENTAL HEALTH

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU

MAY BE USED AND DISCLOSED AND

HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY

Notice Effective Date: May 15, 2018

Privacy The Department of Mental Health (DMH) is required by state and federal law to maintain the privacy and security of your protected health information (PHI). PHI includes any identifiable information about your physical or mental health, the health care you receive, and the payment for your health care. Information about care that you received from other providers may also be included in your PHI.

DMH is required by law to provide you with this notice to tell you how it may use and disclose your PHI and to inform you of your privacy rights. DMH must follow the privacy practices as set forth in its most current Notice of Privacy Practices.

Changes to this Notice DMH may change its privacy practices and the terms of this notice at any time. Changes will apply to PHI that DMH already has as well as PHI that DMH receives in the future. The most current privacy notice will be posted in DMH facilities and programs, on the DMH website (www.state.ma.us/dmh), and will be available on request. Every privacy notice will be dated.

How DMH MAY Use and Disclosure Your PHI DMH may use your PHI within the DMH organization and disclose it outside of the organization without your authorization for the following purposes:

1. For Treatment - DMH may use/disclose PHI to doctors, nurses, residents or students and other health care providers that are involved in delivering your health care and related services. Your PHI will be used to assist in developing your treatment and/or service plan and to conduct periodic reviews and assessments. PHI may be disclosed to other health care professionals and providers to obtain prescriptions, lab work, consultations, and other items needed for your care. PHI will be disclosed to health care providers for the purposes of referring you for services and then for coordinating and providing the services you receive.

2. For Payment - DMH may use/disclose your PHI to bill and collect payment for your health care services. DMH may release portions of your PHI to the Medicaid or Medicare program or a third party payor to determine if they will make payment, to get prior approval, and to support any claim or bill.

3. For Health Care Operations - DMH may use/disclose PHI to support activities such as program planning, management and administrative activities, quality assurance, receiving and responding to complaints, compliance programs (e.g., Medicare), audits, training and credentialing of health care professionals, and certification and accreditation (e.g., The Joint Commission).

4. Appointment Reminders - DMH may use PHI to remind you of an appointment or follow up instructions or to provide you with information about treatment alternatives or other health related benefits and services that may be of interest to you.

5. Business Associates - DMH may use/disclose PHI to contractors, agents and other business associates who need the information to assist DMH with obtaining payment or carrying out its business operations. If DMH discloses your PHI to a business associate, DMH will have a written contract with that business associate to ensure that it also protects your PHI.

6. Family and Friends/Clergy - DMH may disclose a limited amount of PHI for the following purposes:

Clergy – If you agree, verbally or otherwise, your religious affiliation may be disclosed to clergy.

To Family, Friends or Others – If you agree or do not object, PHI may be disclosed to persons involved in your care or payment for your care if directly related to their involvement in your care or payment for your care.

7. Required by Law - DMH may use/disclose PHI as required by law, such as to report a felony committed on its premises; pursuant to a court order; to report abuse or neglect, and other situations where DMH is required to make reports and/or disclose PHI pursuant to a statute or regulation.

8. Lawsuits and Disputes - If you bring a legal action or other proceeding against DMH or our employees or agents, we may use and disclose PHI to defend ourselves.

9. Other Purposes - DMH may use/disclose your:

For guardianship or commitment proceedings when DMH is a party;

For other judicial and administrative proceedings if certain criteria are met;

To public health authorities that are to receive reports of abuse or neglect;

For research purposes, following strict internal review;

To avert a serious and imminent threat to health or safety;

To persons involved in your care in an emergency situation if certain criteria are met;

To correctional institutions if you are an inmate or you are detained by a law enforcement officer, we may disclose your PHI to the prison officers or law enforcement officers if necessary to provide you with health care, or to maintain safety, security and good order at the place where you are confined;

To authorized public health officials for public health activities such as tracking diseases and reporting vital statistics;

To government agencies authorized to conduct audits, investigations, and inspections of our facility. These government agencies monitor the operations of the health care system, government benefit programs such as Medicare and Medicaid, and compliance with government regulatory programs and civil rights laws;

For workers' compensation claims;

For certain specialized government functions if certain criteria are met; and

In the unfortunate event of your death, we may disclose your PHI to coroners, medical examiners, funeral directors, and certain organ and tissue procurement organizations.

Uses/Disclosures Requiring Written Authorization DMH is required to have a written authorization from you or your legally authorized personal representative for uses/disclosures beyond treatment, payment, and health care operations, unless an exception listed above applies. You may cancel an authorization at any time, if you do so in writing. A cancellation will stop future uses/disclosures except to the extent DMH has already acted based upon your authorization.

Authorization is required for most uses and disclosures of psychotherapy notes (these are the notes that certain professional behavioral health providers maintain that record your appointments with them and are not stored in your medical record), certain substance use disorder information, HIV testing or test results, and certain genetic information even if disclosure is being made for treatment, payment, or health care operations purposes as described above.

Although the following types of uses/disclosures are not contemplated by DMH, we need to inform you that any use or disclosure of PHI for marketing that involves financial remuneration to DMH will require an authorization. Similarly, to sell PHI, DMH must obtain an authorization.

DMH will not use or disclose your PHI for fundraising purposes.

Your Rights Concerning Your PHI You or your legally authorized personal representative has the right to:

Request that DMH use a specific address or telephone number to contact you. DMH will try to accommodate all reasonable requests.

Obtain, upon request, a paper copy of this notice or any revision of this notice, even if you agreed to receive it electronically.

Inspect and request a copy of the PHI used to make decisions about your care. When records are kept electronically, you may request an electronic copy. Access to your records may be restricted in limited circumstances. If DMH denies your request, in whole or in part, you may request that the denial be reviewed. Fees may be charged for copying and mailing. Ordinarily, DMH will respond to your request within 30 days. If additional time is needed to respond, DMH will notify you within the 30 days to explain the reason(s) for the delay and indicate when you can expect a final answer to your request. This request must be made in writing.

Request additions or corrections to your PHI. DMH is not required to agree to such a request. If it does not comply with your request, DMH will tell you why in writing within 60 days and notify you of your specific rights in that event. If additional time is needed to respond, DMH will notify you within the 60 days to explain the reason(s) for the delay and indicate when you can expect a final answer to your request. This request must be made in writing.

Request an accounting of disclosures (up to the past six years) which will identify, in accordance with applicable laws, certain other persons or organizations to which DMH disclosed your PHI and why. An accounting will not include disclosures that were: (1) made to you or your personal representative; (2) authorized or approved by you; (3) made for treatment, payment, and health care operations; and (4) some that were required by law to be made. Ordinarily, DMH will respond to your request within 60 days. If additional time is needed to respond, DMH will notify you within the 60 days to explain the reason(s) for the delay and indicate when you can expect a final answer to your request. This request must be made in writing.

Request that DMH restrict how it uses or discloses your PHI. DMH is not required to agree to such restriction, with the exception that if you, or someone on your behalf, pay for a service or health care item out-of-pocket in full, DMH will agree to not disclose PHI pertaining only to that service or item with your health plan for the purpose of payment or health care operation, unless DMH is otherwise required by law to disclose that PHI.

This request must be made in writing.

The above requests may be made at or submitted to any DMH facility or office.

Record Retention Your individual records will be retained a minimum of 20 years from the last date you receive services from a DMH inpatient facility and/or from DMH operated community services. After that time, your records may be destroyed.

Breach of PHI DMH will inform you if a breach of your unsecured PHI occurs.

Complaint If you believe that your privacy or privacy rights have been violated, or you want to file a complaint, you may contact: DMH Privacy Officer, Department of Mental Health, 25 Staniford Street, Boston, MA 02114, E-mail: DMHPrivacyOfficer@MassMail.State.MA.US, Phone: 617- 626-8160, Fax: 617-626-8242. A complaint must be made in writing.

You also may file a complaint with the Secretary of Health and Human Services, Office for Civil Rights, U.S. Department of Health and Human Services, JFK Federal Building, Room 1875, Boston, MA. 02203.

No one may retaliate against you for filing a complaint or for exercising your rights as described in this notice.

Privacy Contact Information If you want to obtain further information about DMH’s privacy practices, or if you want to exercise your rights, you may contact: DMH Privacy Officer, Department of Mental Health, 25 Staniford Street, Boston, MA 02114, E-mail: DMHPrivacyOfficer@MassMail.State.MA.US, Phone: 617-626-8160, Fax: 617-626-8131. A complaint must be made in writing.

You also may contact a DMH facility’s medical records office (for that facility’s records), a DMH program director (for that program’s records), your site office (for case management records), or the human rights officer at your facility or program, for more information or assistance.

DMH Contact Information If you want to obtain other information (non-privacy related) about DMH and its services you may contact: DMH Information, Department of Mental Health, 25 Staniford Street, Boston, MA 02114, E-mail: dmhinfo@state.ma.us, Phone: 800-221-0053, Fax: (617) 626-8131.

You also may contact your DMH program director, your site office, or the human rights officer at your facility or program, for more information or assistance.

mailto:DMHPrivacyOfficer@MassMail.State.MA.US mailto:DMHPrivacyOfficer@MassMail.State.MA.US mailto:dmhinfo@state.ma.us