CALL 1(844) 627-3268 NOW
COASTAL ADDICTION CENTER Confidentiality Policy and Procedure
Policy: COASTAL ADDICTION CENTER is governed by Federal, State, County and accreditation regulations that protect the confidentiality of our patients. We protect the privacy of individuals being treated at COASTAL ADDICTION CENTER in compliance with CFR 42 and HIPAA Regulations.
Client identifying information is defined as the name, address, social security number or other similar information by which the identify of a client can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information.
I. Telephone calls:
1. Callers requesting information about a current or former patient at COASTAL ADDICTION CENTER are to be informed that under Federal confidentiality law, we are unable to confirm whether or not an individual is or has ever been a patient at COASTAL ADDICTION CENTER without the appropriate signed releases.
2. You may inform the caller that he/she is welcome to leave their name and telephone number and, if the individual in question is a client, this information will be forwarded to the client only if there is a consent form for the caller signed by the client. The choice to contact the caller is the client’s, depending upon whether or not the client wishes to reveal that she is a client of COASTAL ADDICTION CENTER.
1. Staff members who are responsible for picking up mail delivered to COASTAL ADDICTION CENTER are not to pick up or accept patient mail that requires a signature. In such cases, the staff member must do the following:
a. Note the name of the sending party
b. Note the name of the individual the letter is being sent to and
2. The staff member is to the call the patient and informs he/she that there is a letter/parcel that requires a signature at the post office and inform them of who is sending the parcel/letter.
3. If the patient requests that COASTAL ADDICTION CENTER pick-up the parcel/letter, that patient must sign a release form, allowing COASTAL ADDICTION CENTER to make a disclosure to the Postal Service and the individual sending the letter.
All visitors/vendors must sign a Visitor’s/Vendors Log located in the case management office or other designated areas. Affixed to this book is to be a notice of confidentiality, visitor's responsibility regarding confidentiality of any patient they may see at COASTAL ADDICTION CENTER, and their obligation to follow the Federal Rules and Regulations.
For additional guidance on issues of confidentiality, please refer to your supervisor, review release forms.
Legal Issues and Confidentiality***Legal Reporting Requirements
1. Responding to Subpoenas, Search Warrants, and other Legal Actions
Individuals in treatment for alcohol and drug abuse have their privacy protected under Federal Law (United States Code, Title 42 §290ddB3 and ddE3) and the Federal Regulations that implement it (Title 42, Part 2 of the Code of Federal Regulations, a.k.a. 42 C.F.R. Part 2). It is extremely important that COASTAL ADDICTION CENTER employees understand and respond appropriately to all subpoenas, search warrants and other legal actions. No employee of COASTAL ADDICTION CENTER may release any information, verbally or in writing that identifies a client as a substance abuser or discloses information about her treatment unless these in consent signed by the patient authorizing the release of such information. The only exception to this is in the case of a medical emergency that poses an immediate threat to health and requires immediate medical intervention.
Definitions: There are generally three types of subpoenas. The subpoena is a court order issued by an attorney or government agency requiring that a person appear in and/or testifies in court or in front of an agency. The subpoena duces tecum is a court order that instructs a person to provide certain documents, such as medical or employee records, to a court, attorney's office or government agency. This subpoena may also demand the person accompany said documents and give testimony as a witness. The grand jury subpoena is a court order that indicates a criminal investigation is being conducted and the recipient is summons to appear as a witness or to testify.
Subpoenas are not the type of court order required by the confidentiality regulations, therefore COASTAL ADDICTION CENTER is prohibited from responding to them by disclosing information concerning current or former patients unless said patient has signed consent to authorize such a disclosure. Subpoenas that request patient records are to be directed to the Executive Director, those requesting employee files are directed to the Executive Director, and all others are to be given directly to the Executive Director, who will seek legal counsel to examine and advise a course of action. The procedures to be followed for release of this information are outlined in COASTAL ADDICTION CENTER’S policy regarding Consent to Release Form
2. Responding to Warrants, Court Orders and Audits
Search warrants may not be used to allow law enforcement officers to enter COASTAL ADDICTION CENTER’S facilities. This would breach the confidentiality regulations protecting all patients in the facility. However, arrest warrants do permit law enforcement officers to enter, but only to search for a particular patient who has committed or threatened a crime on the COASTAL ADDICTION CENTER premises or against COASTAL ADDICTION CENTER personnel. Unless the arrest warrant is accompanied by a proper court order, COASTAL ADDICTION CENTER need not cooperate with a search for a patient who has committed a crime elsewhere. If a law enforcement officer or government agent shows up at COASTAL ADDICTION CENTER with either an arrest warrant or search warrant, employees must contact the Executive Director, to ensure the protection of the staff and patients. If this occurs at a time when the Executive Director cannot be reached, personnel may contact the CEO.
Special Exception to the above rules governing warrants: If a patient in treatment is already aware she has a warrant and wishes to allow a law enforcement officer or government agent to come to COASTAL ADDICTION CENTER to serve them with it, staff may have the patient sign a consent form outlining this (refer to COASTAL ADDICTION CENTER’S policy regarding a Consent to Release Form on how to complete this form).
3. Court-Order Disclosures.
Courts, both federal and state, may issue an order compelling COASTAL ADDICTION CENTER to release information that would otherwise be forbidden. These orders may only be issued after the court follows certain procedures and COASTAL ADDICTION CENTER has the right to request this process be done prior to disclosing any information. Note: a subpoena, search warrant, or arrest warrant alone, even when signed by a judge, is NOT sufficient to permit or require COASTAL ADDICTION CENTER to make such a disclosure. First, a program or patient whose records are sought must be given notice of the application for the order and the opportunity to make an oral or written statement to the court regarding said application. Prior to the order being issued, there must be finding of "good cause" for the disclosure. Only that information which is essential for the purpose of the order may be released and only those persons who need the information may receive it. The procedures to be adhered to for release of this information, once proper procedures to obtain a court order have been followed, are outlined in COASTAL ADDICTION CENTER’S policy regarding Consent to Release Form.
Audits of COASTAL ADDICTION CENTER’S files may be deemed appropriate and necessary by a government agency, third party payer (i.e. insurance company), or peer review organization. These persons or agencies may review COASTAL ADDICTION CENTER records without patient consent as long as they have agreed in writing that they will not disclose patient identifying information, unless it is pursuant to a court order to investigate or prosecute COASTAL ADDICTION CENTER and not a patient.
- The process followed when confidentiality and security are violated
CONFIDENTIALITY, SECURITY AND INTEGRITY
The confidentiality, security and integrity of information is ensured through the observation and enforcement of several specific policies and procedures listed below. Specific security measures are used to protect the accessibility and availability of information to only those with authorized access are also noted below.
The type of information access that has been approved by the facility includes any computerized records that are safeguarded by passwords.
TYPE OF INFORMATION AUTHORIZED ACCESS
Medical Record Clinicians involved with the case Clinical staff
Clerical staff responsible for records Executive Director
Personnel Records Executive Director Owner
Credential Files Executive Director
Quality Controller Owner
Marketing Records Owner
Client Financial Records Finance Department Executive Director Owner
UR Records UR Staff
Executive Director Clinical Staff Insurance Billing Staff Owner
EOC Records Safety Officer and Delegates Maintenance staff
Quality Controller Governing Board
PI Team Reports Performance Improvement Team Owner
Infection Control Records PI Team
Infection Control Officer Quality Controller Safety Officer
Owner Medical Staff
Risk Management Records PI Team Owner
Governing Board Quality Controller
CONFIDENTIALITY AND SECURITY POLICIES
Electronic medical records are used. Any paper-based documents are scanned into the client’s medical record. Old files are kept in a locked and secure file drawer and department supervisors have access.
Improvements in information security and data integrity are made by monitoring developments in technology.
Original records are never removed from the facility, unless by court order. In that case the Administrator or designee takes the original record and a copy of the record to court. The copy will be left with the judge if so ordered.
Any copies of records no longer needed are shredded.
Records are protected from fire and water by filing them in locked file cabinets. Fire extinguishers are readily available.
Falsification of a medical record is monitored by the clinical staff and staff performing chart audits.
If confidentiality or security of data is violated it is reported to the appropriate department head who discusses the issue with the Executive Director and Owner. Any appropriate policy and procedure to protect against this type of violation is reviewed and revised as needed and the personnel violating the policy is immediately counseled and informed of the policy and procedure pertaining to the incident. Any future violations of the policy by this individual will lead to formal written disciplinary action. If numerous employees are involved and it is determined there is a lack of knowledge of the policies and procedures related to confidentiality and security, a staff in-service is provided.
UNIFORM DATA DEFINITIONS
Uniform data used in the system include:
- DO NOT USE Abbreviation List for all clinical departments that document in the medical record
- ICD9-CM Codes for medical records and finance department
- Uniform Billing (UB 92 requirements) and HCFA 1500 Billing Form for the finance department
The following information is provided to assist you in your counseling experience at Coastal Addiction Center.
Counseling and treatment is a personal and confidential relationship between a clinician and individual, group or family.
We work from a team approach at Coastal Addiction Center. Therefore, there may be times when it is necessary for us to consult with other professional staff either individually or at our clinical team meetings in an effort to provide you with the highest consideration and quality. Our clinicians are all Mastered prepared and professionally licensed, graduate student interns, or clinicians working toward certification in substance abuse counseling.
No information will be released from Coastal Addiction Center regarding counseling or consultation sessions without your expressed written consent. If you wish for information to be released to anyone, it will be necessary for you to complete a Release of Information form, stipulating the professional to whom the information is being sent. The law stipulates that in the event of imminent danger to yourself or others, we must breach confidentiality. We must also act in accordance with any applicable State laws regarding mandatory disclosure of child, elder, or other abuse.
[Coastal Addiction Center]
HIPAA - Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY
This notice is effective as of April 15, 2003
USES AND DISCLOSURE OF HEALTH INFORMATION
[Coastal Addiction Center] is committed to protecting the privacy of the personal and health information we collect
or create as part of providing health care services to our clients, known as “Protected Health Information” or
“PHI”. PHI typically includes your name, address, date of birth, billing arrangements, care, and other information
that relates to your health, health care provided to you, or payment for the health care provided to you. PHI
DOES NOT include information that is de-identified or cannot be linked to you.
This notice of Health Information Privacy Practices (the “Notice”) describes [Coastal Addiction Center]’s duties
with respect to the privacy of PHI, [Coastal Addiction Center]’s use of and disclosure of PHI, client rights and
contact information for comments, questions, and complaints.
[Coastal Addiction Center]’S PRIVACY PROCEDURES AND LEGAL OBLIGATIONS
[Coastal Addiction Center] obtains most of its PHI directly from you, through care applications, assessments, and
direct questions. We may collect additional personal information depending upon the nature of your needs and
consent to make additional referrals and inquiries. We may also obtain PHI from community health care
agencies, other governmental agencies or health care providers as we set up your service arrangements.
[Coastal Addiction Center] is required by law to provide you with this notice and to abide by the terms of the
Notice currently in effect. [Coastal Addiction Center] reserves the right to amend this Notice at any time to reflect
changes in our privacy practices. Any such changes will be applicable to and effective for all PHI that we
maintain including PHI we created or received prior to the effective date of the revised notice. Any revised notice
will be mailed to you or provided upon request.
[Coastal Addiction Center] is required by law to maintain the privacy of PHI. [Coastal Addiction Center] will
comply with federal law and will comply with any state law that further limits or restricts the uses and disclosures
discussed below. In order to comply with these state and federal laws, [Coastal Addiction Center] has adopted
policies and procedures that require its employees to obtain, maintain, use and disclose PHI in a manner that
protects client privacy.
USES AND DISCLOSURES WITH YOUR AUTHORIZATION
Except as outlined below, [Coastal Addiction Center / New Perspective Recovery] will not use or disclose your PHI without your written authorization. The authorization form is available from [Coastal Addiction Center] (at the address and phone number below). You have the right to revoke your authorization at any time, except to the
extent that [Coastal Addiction Center] has taken action in reliance on the authorization.
The law permits [Coastal Addiction Center] to use and disclose your PHI for the following reasons without your
For Your Treatment: We may use or disclose your PHI to physicians, psychologists, nurses and other authorized
healthcare professionals who need your PHI in order to conduct an examination, prescribe medication or
otherwise provide health care services to you.
To Obtain Payment: We may use or disclose your PHI to insurance companies, government agencies or health
plans to assist us in getting paid for our services. For example, we may release information such as dates of
treatment to an insurance company in order to obtain payment.
For Our Health Care Operations: We may use or disclose your PHI in the course of activities necessary to
support our health care operations such as performing quality checks on your employee services. We may also
disclose PHI to other persons not in [Coastal Addiction Center]'s workforce or to companies who help us perform
our health services (referred to as "Business Associates") we require these business associates to appropriately
protect the privacy of your information.
As Permitted or Required By The Law: In some cases, we are required by law to disclose PHI. Such as
disclosers may be required by statute, regulation court order, government agency, we reasonably believe an
individual to be a victim of abuse, neglect or domestic violence: for judicial and administrative proceedings and
For Public Health Activities: We may disclose your PHI for public health purposes such as reporting
communicable disease results to public health departments as required by law or when required for law
For Health Oversight Activities: We may disclose your PHI in connection with governmental oversight, such as
for licensure, auditing and for the administration of government benefits.
To Avert Serious Threat to Health and Safety: We may disclose PHI if we believe in good faith that doing so
will prevent or lessen a serious or imminent threat to the health and safety of a person or the public.
Disclosures of Health-Related Benefits or Services: Sometimes we may want to contact you regarding service
reminders, health-related products or services that may be of interest to you, such as health care providers or
settings of care or to tell you about other health-related products or services offered at [Coastal Addiction Center].
You have the right not to accept such information.
Incidental Uses and Disclosures: Incidental uses and disclosures of PHI are those that cannot be reasonably
prevented, are limited in nature and that occur as a by-product of a permitted use or disclosure. Such incidental
uses and disclosures are permitted as long as [Coastal Addiction Center] use reasonable safeguards and use or
disclose only the minimum amount of PHI necessary.
To Personal Representatives: We may disclose PHI to a person designated by you to act on your behalf and
make decisions about your care in accordance with state law. We will act according to your written instructions in
your chart and our ability to verify the identity of anyone claiming to be your personal representative.
To Family and Friends: We may disclose PHI to persons that you indicate are involved in your care or the
payment of care. These disclosures may occur when you are not present, as long as you agree and do not
express an objection. These disclosures may also occur if you are unavailable, incapacitated, or facing an
emergency medical situation and we determine that a limited disclosure may be in your best interest. We may
also disclose limited PHI to a public or private entity that is authorized to assist in disaster relief efforts in order for
that entity to locate a family member or other person that may be involved in caring for you. You have the right to
limit or stop these disclosures.
YOUR RIGHTS CONCERNING PRIVACY
Access to Certain Records: You have the right to inspect and copy your PHI in a designated record set except
where State law may prohibit client access. A designated record set contains medical and billing and case
management information. If we do not have your PHI record set but know who does, we will inform you how to
get it. If our PHI is a copy of information maintained by another health care provider, we may direct you to
request the PHI from them. If [Coastal Addiction Center] produces copies for you, we may charge you up to
$1.00 per page up to a maximum fee of $50.00. Should we deny your request for access to the information
contained in your designated record set, you have the right to ask for the denial to be reviewed by another
healthcare professional designated by [Coastal Addiction Center].
Amendments to Certain Records: You have the right to request certain amendments to your PHI if, for
example, you believe a mistake has been made or a vital piece of information is missing. [Coastal Addiction
Center] is not required to make the requested amendments and will inform you in writing of our response to your
Accounting of Disclosures: You have the right to receive an accounting of disclosures of your PHI that were
made by [Coastal Addiction Center] for a period of six (6) years prior to the date of your written request. This
accounting does not include for purposes of treatment, payment, health care operations or certain other excluded
purposes, but includes other types of disclosures, including disclosures for public health purposes or in response
to a subpoena or court order.
Restrictions: You have the right to request that we agree to restrictions on certain uses and disclosures of your
PHI, but we are not required to agree to your request. You cannot place limits on uses and disclosures that we
are legally required or allowed to make.
Revoke Authorizations: You have the right to revoke any authorizations you have provided, except to the extent
that [Coastal Addiction Center] has already relied upon the prior authorization.
Delivery by Alternate Means or Alternate Address: You have the right to request that we send your PHI by
alternative means or to an alternate address.
Complaints & How to contact us: If you believe your privacy rights have been violated, you have the right to file
a complaint by contacting [Coastal Addiction Center] at the address and/or phone number indicated below. You
also have the right to file a complaint with the Secretary of the United States Department of Health and Human
Services in Washington, D.C. [Coastal Addiction Center] will not retaliate against you for filing a complaint.
If you believe your privacy rights have been violated, you may make a complaint by contacting Lisa Osendorf,
HIPAA Privacy Officer at firstname.lastname@example.org or Adrian deBrey at email@example.com or
the Secretary for the Department of Health and Human Services. No individual will be retaliated against for filing a
The U.S.Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Please be aware that mail sent to the Washington D.C area offices takes an additional 3-4 days to process due to
changes in mail handling resulting from the Anthrax crisis of October 2001.