Comeback Care Privacy Notice
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
This notice describes the privacy practices of Comeback Care, its facilities, managers, and subsidiaries, and all associates who are providing you with quality behavioral healthcare services, under federal law. It is inclusive of inpatient, outpatient and virtual services offered at these facilities, individually and collectively. Protected Health Information (“PHI”) is information about you, which includes demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition; the provision of healthcare services; or the past, present, or future payment for the provision of healthcare services to you.
Our Privacy and Confidentiality Obligations
We are required by law to maintain the privacy and confidentiality of your PHI; provide you with this notice of our legal duties and privacy practices with respect to PHI; also, to notify you following a breach of unsecured PHI related to you. When we use or disclose this information, we are required to abide by the terms of this notice (or other notice in effect at the time of the use or disclosure). You may request a paper copy of this notice.
We reserve the right to change our privacy policy and practices and the terms of this Notice of Privacy Practices, consistent with applicable law and our current business processes, at any time. Any new Notice of Privacy Practices will be effective for all PHI that we maintain at that time. Notification of revisions of this Notice of Privacy Practices will be provided as follows:
- Upon request.
- Electronically via our website or via other electronic means; and
- As posted in our place of business.
We have a duty to respond to your requests (e.g., those corresponding to your rights) in a timely and appropriate manner. We support and value your right to privacy and are committed to maintaining reasonable and appropriate safeguards for your PHI.
42 CFR Part 2 protects your health information if you are applying for or receiving services (including diagnosis or treatment, or referral) for substance use disorder.
The confidentiality of alcohol and drug abuse patient records maintained by us is protected by Federal law and regulations. Generally, we may not say to a person outside the treatment center that you are a patient of the treatment center, or disclose any information identifying you as an alcohol or drug abuser unless:
- You consent in writing
- The disclosure is allowed by a court order
- The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation (as discussed below in “Uses and Disclosures”).
Violation of the Federal law and regulations by the treatment center is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations.
Federal law and regulations do not protect any information about a crime committed by you either at the treatment center or against any person who works for the treatment center or about any threat to commit such a crime (as discussed below in “Uses and Disclosures”).
Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under State law to appropriate State or local authorities (as discussed below in “Uses and Disclosures”).
Among Treatment Center Personnel
We may use or disclose your PHI for the purposes of health care operations that include internal administration, planning, and various activities that improve your client experience, quality, and effectiveness of care.
- Between the treatment center. For example, our staff, which may include doctors, nurses, and clinicians, will use your PHI to provide your treatment care. Treatment includes diagnosis, treatment, discharge planning, and other reasonable services.
- Billing Your PHI may be used in connection with billing statements we send you and in connection with tracking charges and credits to your account. Your PHI will be used to check for eligibility for insurance coverage and prepare claims for your insurance company where appropriate.
- Program Evaluation We may disclose information to qualified personnel for outcome evaluation, management audits, financial audits, or program evaluation; however, such personnel may not identify, directly or indirectly, any individual patient in any report of such audit or evaluation, or otherwise disclose patient identities in any manner.
- Conflict We may disclose your information as needed within Comeback Care to resolve any complaints or issues arising regarding your care.
- Business Associates We may also disclose your PHI to an agent or agency which provides services to Comeback Care under a qualified service organization agreement and/or business associate agreement, in which they agree to abide by applicable federal law and related regulations (42 CFR Part 2 and HIPAA).
- Communication Health care operations may also include use of your PHI for programs offered by Comeback Care, such as sending alumni invitations for events and workshops.
Secretary of Health and Human Services
We are required to disclose PHI to the Secretary of the U.S. Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA Privacy Rules.
Other Uses
Other allowable uses and disclosures without your authorization, aside from treatment and health care operations, include:
Appointments Contacting you with reminders for future appointments of your treatment.
Emergency Situations We may disclose your PHI to medical personnel. Incompetent and/or Deceased Patients. In such cases, authorization of a personal representative, guardian or other person authorized by applicable state law may be given in accordance with 42 CFR Part 2.
Reporting of Death We may disclose protected health information to a coroner, medical examiner or other authorized person under laws requiring the collection of death or other vital statistics, or which permit inquiry into the cause of death.
Court Order We may disclose your PHI in response to a court order that meets the requirements of federal regulations, 42 CFR Part 2 concerning Confidentiality of Substance Use Disorder Patient Records. Note also that if your records are not actually “patient records” within the meaning of 42 CFR Part 2 (e.g., if your records are created because of your participation in the family program or another non-treatment setting), your records may not be subject to the protections of 42 CFR Part 2.
Crimes on Premises We may disclose your PHI to the police or other law enforcement officials if you commit a crime on premises or against program personnel or threaten to commit such a crime.
Child Abuse We may disclose your PHI for the purpose of reporting child abuse, neglect, or prenatal exposure to controlled substances, including alcohol, to public health authorities or other government authorities authorized by law to receive such reports.
Threats Where the program learns that a patient has made a specific threat of serious physical harm to another specific person or the public, and disclosure is otherwise required under statute and/or common law, the program will carefully consider appropriate options that would permit disclosure.
Audit and Evaluation Activities
We may disclose protected health information to those who perform audit or evaluation activities for certain health oversight agencies, e.g., state licensure or certification agencies, the Joint Commission on Accreditation of Healthcare Organizations, which oversees the health care system and ensures compliance with regulations and standards, or those providing financial assistance to the program.
Research We may use or disclose PHI without your consent or authorization if our research privacy board approves a waiver of authorization for disclosure.
Communications We may contact you with information about Comeback Care health-related services and products that may be beneficial to you. Such communications are a part of Health care operations, and examples of these communications are invitations to continuing care programs, alumni events and catalogs of recovery and self-help materials such as books, videos, and other items.
If you are not applying for or receiving services for substance use disorder, the rules governing the use and disclosure of PHI are different from and less restrictive than the rules governing information involving substance use disorder diagnosis, treatment, and referral.
The next section lists the additional allowable disclosures that may be made without your authorization if you are not applying for or receiving services for substance use disorder. (This list does NOT apply to those persons applying for or receiving services for substance use disorder):
When required by law. We may disclose your PHI as required by state or federal law.
Health or safety. We may disclose your PHI to avert or lessen a serious threat of harm to you, to others, or to the public.
Investigation of Abuse. We may disclose PHI to a person legally authorized to investigate a report of abuse or neglect.
Public health and health oversight activities. We may disclose your PHI for public health purposes and health oversight purposes including licensing, auditing or accrediting agencies authorized or allowed by law to collect such information, including, for example, when we are required to collect, report, or disclose information about disease, injury, vital statistics for public health purposes or other information for investigation, audit or other health oversight purposes.
Law enforcement activities. We may disclose PHI to law enforcement officials in response to a valid court order or warrant or as otherwise required or permitted by law.
Legally authorized representative. We may disclose your health information to a person appointed by a court to represent or administer your interests.
Court Orders. We may disclose your health information pursuant to a valid court or administrative order, or in some cases, in response to a valid subpoena or discovery request.
Secretary of Health and Human Services. We must disclose your health information to the United States Department of Health and Human Services when requested to enforce the privacy laws.
Your Individual Rights
Right to Receive Confidential Communications. Normally we will communicate with you through the phone number and /or address you provide. You may request, and we will accommodate, any reasonable, written request for you to receive your PHI by alternative means of communication or at alternative locations.
Right to Request Restrictions. At your request, we will not disclose health information to your health plan if the disclosure is for payment of a health care item or service for which you have paid Comeback Care out of pocket in full. You may request additional restrictions on our use and disclosure of PHI for treatment, payment, and health care operations. While we will consider requests for additional restrictions carefully, we are not required to agree to a requested restriction. If you wish to request additional restrictions and you are currently receiving services, please contact your counselor.
Once you are no longer receiving services, contact the Health Information Department in writing. We will send you a written response.
Right to Access, inspect, and copy. You may request access to your medical record maintained by us to inspect and request copies of the records. Under limited circumstances, we may deny you access to a portion of your records. If you desire access to your records and you are currently receiving services, please ask your counselor for the records. Once you are no longer receiving services, contact the Health Information Department.
Right of request amendments. You have the right to request that we amend PHI maintained in your clinical file or billing records. If you desire to amend your records and you are currently receiving services, please contact your counselor. Once you are no longer receiving services, contact the Health Information Department. Under certain circumstances, Comeback Care has the right to deny your request to amend your records and will notify you of this denial as provided in the HIPAA regulations. If your requested amendment to your records is accepted, a copy of your amendment will become a permanent part of the medical record. When we “amend,” a record, we may append information to the original record, as opposed to physically removing or changing the original record. If your requested amendment is denied, you will be informed of your right to have a brief statement of disagreement placed in your medical record.
Upon request, you may obtain a list of instances that we have disclosed your PHI other than when you gave written authorization OR those related to your treatment and payment for services, or our health care operations. The accounting will apply only to covered disclosures prior to the date of your request provided such period does not exceed six years. If you request an accounting more than once during a twelve (12) month period, there will be a charge. You will be told the cost prior to the request being filled.
You will be notified in the event we discover a breach has occurred such that your PHI may have been compromised. A risk analysis will be conducted to determine the probability that PHI has been compromised. Notification will be made no more than 60 days after the discovery of the breach, unless it is determined by a law enforcement agency that the notification should be delayed.
Upon request, you may obtain a paper copy of this notice.
For Further Information and Complaints.
If you desire further information about your privacy and confidentiality rights, you may contact the Comeback Care business development office at (410) 862-1501. You may call this number if you are concerned that we have violated your privacy rights, if you disagree with a decision that we made about access to your PHI, or if you wish to complain about our breach notification process.
Right to Voice Concerns
You may also file a written complaint with the Secretary of the United States Department of Health and Human Services. Upon request, we will provide you with the correct address. We will not retaliate against you if you file a complaint.
Violation of federal law and regulations on Confidentiality of Substance Use Disorder Patient Records is a crime and suspected violations of 42 CFR Part 2 may be reported to the United States Attorney in the district where the violation occurs. Upon request, we will provide you with the appropriate agency contact information.
Effective Date and Duration of This Notice
Effective Date. This notice is effective on January 23, 2023.
Right to Change Terms of This Notice. We may change the terms of this notice at any time. If we change this notice, we may make the new notice terms effective to all PHI that we maintain, including any information created or received prior to issuing the new notice. If we change this notice, we will post the new notice in public access areas at our service sites and on our Internet site at www.comebackcare.com
You may also obtain any new notice by contacting the Comeback Care Privacy Office.