8 - CONFIDENTIALITY,

AND RELEASE OF INFORMATION

Policy
All clients enrolled at Recovery Works are accorded confidentiality as to their identity and their client records by federal law. All staff members are required to adhere to these rules and may be dismissed for allowing a breach of a client's right to confidentiality.
Records of the identity, diagnosis, prognosis, or treatment of any Covered Patient relating to a substance use disorder which are maintained in connection with a Covered Program, or which are received from a Covered Program will be confidential and may be disclosed only as expressly permitted pursuant to this Policy. Notwithstanding any provision in the Company's policies to the contrary, for records maintained by or received from a Covered Program identifying Covered Patients as having a substance use disorder, the records may only be disclosed to the extent specifically permitted pursuant to 42 CFR Part 2.
Definitions
Affiliate means any person or entity Controlling, Controlled by or under common Control with another person or entity.
Control means the direct or indirect power to govern the management and policies of an entity; or the power or authority through a management agreement or otherwise to approve an entity's transactions (includes Controlled, Controlling).
Covered Information means any information, whether recorded or not, created by, received, or acquired by a Covered Program relating to a Covered Patient (e.g., Diagnosis, Treatment and referral for Treatment information, billing information, emails, voice mails, and texts). For the purpose of this Policy, Covered Information includes both paper and electronic records. Covered Information includes, without limitation, medical records maintained by a Covered Program or obtained from a Covered Program identifying an individual as a Covered Patient.
Covered Patient(s) means any individual who has applied for or been given Diagnosis, Treatment, or referral for Treatment for a Substance Use Disorder at a Covered Program. The term Covered Patient includes any individual who, after arrest on a criminal charge, is identified as an individual with a Substance Use Disorder in order to determine that individual's eligibility to participate in a Covered Program. This definition includes both current and former patients. The special restrictions of this Policy apply to the use and Disclosure of information identifying an individual as a Covered Patient.
Covered Program means and includes: (a) an individual or entity (other than a general medical facility) who holds itself out as providing, and provides, Substance Use Disorder Diagnosis, Treatment, or referral for Treatment; or (b) an identified unit within a general medical facility that holds itself out as providing, and provides, Substance Use Disorder Diagnosis, Treatment, or referral for Treatment; or (c) medical personnel or other staff in a general medical facility whose primary function is the provision of Substance Use Disorder Diagnosis, Treatment, or referral for Treatment and who are identified as such providers. Covered Programs include, but are not limited to, those Treatment or rehabilitation programs, employee assistance programs, programs within general hospitals, and private practitioners who hold themselves out as providing, and provide Substance Use Disorder Diagnosis, Treatment, or referral for Treatment who are treated as receiving direct or indirect federal assistance through Medicare participation, tax-exemption or other criteria as set forth in 42 CFR § 2.12.
Diagnosis means any reference to an individual's Substance Use Disorder or to a condition which is identified as having been caused by that Substance Use Disorder which is made for the purpose of Treatment or referral for Treatment.
Disclose or Disclosure means to communicate any information identifying a patient as being or having been diagnosed with a Substance Use Disorder, having or having had a Substance Use Disorder, or being or having been referred for Treatment of a Substance Use Disorder either directly, by reference to publicly available information, or through verification of such identification by another person.
General Designation Disclosure means a Disclosure made pursuant to a consent or authorization for Disclosure, where the consent or authorization identifies the recipient of the Covered Information with a general designation, rather than by the name of the entity or individual receiving the Covered Information. Disclosures to healthcare providers pursuant to Attachment B, Consent for Disclosure of Information for Treatment and Billing/Payment, where the name of the healthcare provider receiving the information is not listed, will be considered a General Designation Disclosure. Disclosures to Qualified Service Organizations generally will not be considered General Designation Disclosures. Disclosures made to an entity or individual specifically identified by name on a consent for Disclosure are not considered General Designation Disclosures.
Maintenance Treatment means long-term pharmacotherapy for individuals with Substance Use Disorders that reduces the pathological pursuit of reward and/or relief and supports remission of Substance Use Disorder-related symptoms.
Minor means a minor as defined by state law.
Patient Identifying Information means the name, address, social security number, fingerprints, photograph, or similar information by which the identity of a Covered Patient can be determined with reasonable accuracy either directly or by reference to other information. The term does not include a number assigned to a Covered Patient by a Covered Program, for internal use only by the Covered Program, if that number does not consist of or contain numbers (such as a social security, or driver's license number) that could be used to identify a Covered Patient with reasonable accuracy from sources external to the Covered Program.
Program Director means the individual designated as the "Program Director" for the relevant Covered Program. For purposes of this policy, a Program Director may be the Chief Executive Officer of a free-standing behavioral health hospital, a Director of an inpatient behavioral health unit, or a Director or Manager of an outpatient behavioral health program.
Qualified Service Organization means an individual or entity who: (a) provides services to a Covered Program, such as data processing, bill collecting, dosage preparation, laboratory analyses, or legal, accounting, population health management, medical staffing, or other professional services, or services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy, and (b)has entered into a written agreement with a Covered Program under which that individual or entity: (info) acknowledges that in receiving, storing, processing, or otherwise dealing with any patient records from the Covered Program, it is fully bound by the regulations in this part; and (ii) if necessary, will resist in judicial proceedings any efforts to obtain access to Patient Identifying Information related to Substance Use Disorder Diagnosis, Treatment, or referral for Treatment except as permitted by 42 CFR Part 2. A business associate agreement that includes the terms referenced above through execution of the Substance Use Disorder Patient Information Addendum or other written agreement approved by the Privacy Official may satisfy the requirements of subsection (b) above with respect to Qualified Service Organizations.
Special A/E Personnel means a person who: (a) performs an audit or evaluation on behalf of: (info) any federal, state, or local government agency which provides financial assistance (including, without limitation, Medicare reimbursement or other financial assistance) to the Covered Program or is authorized by law to regulate its activities; or (ii) any individual or entity who provides financial assistance to the Covered Program, which is a third party payer covering patients in the Covered Program, or which is a quality improvement organization performing a utilization or quality control review; or (b) is determined by the Program Director (in consultation with the Privacy Official) to be qualified to conduct the audit or evaluation.
Substance Use Disorder means a cluster of cognitive, behavioral, and physiological symptoms indicating that the individual continues using the substance despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal. For the purposes of this Policy, Substance Use Disorder does not include tobacco or caffeine use.
Third-party Payer means an individual or entity who pays and/or agrees to pay for Diagnosis or Treatment furnished to a patient on the basis of a contractual relationship with the patient or a member of the patient's family or on the basis of the patient's eligibility for federal, state, or local governmental benefits.
Treating Provider Relationship means that, regardless of whether there has been an actual in-person encounter: (a) a patient is, agrees to, or is legally required to be diagnosed, evaluated, and/or treated, or agrees to accept consultation, for any condition by an individual or entity, and; (b) the individual or entity undertakes or agrees to undertake Diagnosis, evaluation, and/or Treatment of the patient, or consultation with the patient, for any condition.
Treatment means the care of a patient suffering from a Substance Use Disorder, a condition which is identified as having been caused by the Substance Use Disorder, or both, in order to reduce or eliminate the adverse effects upon the patient.
Withdrawal Management means the use of pharmacotherapies to treat or attenuate the problematic signs and symptoms arising when heavy and/or prolonged substance use is reduced or discontinued.
PROCEDURE:

  1. Notice to Patients. At the time of admission to a Covered Program or, in the case that a patient does not have capacity upon admission to understand his or her medical status, as soon thereafter as the patient attains such capacity, each Covered Program shall (a) communicate to each patient that federal law and regulations protect the confidentiality of Substance Use Disorder patient records; and (b) give to each patient a summary in writing of the federal law and regulations. Refer to Attachment A, Sample Notice of Confidentiality of Substance Use Disorder Patient Records.
  2. Identifying Patients. Company Affiliates and their respective departments will acknowledge the presence of an identified patient in a facility or component of a facility which is publicly identified as a "Covered Program" only if the patient's written authorization is obtained or if an authorizing court order is entered, or other specific terms of this Policy permit a Disclosure of the information. Except as set forth below and in Sections 23 and 24, the patient's written authorization must be obtained on the Authorization Form located on the last page of the Company policy Authorization for Uses and Disclosures of Protected Health Information, IP.PRI.010. Special terms apply to authorizations for disclosures to health information exchanges and other authorizations using general designations (as described in Section 22(d)(iv) below) to reference the recipients of Patient Identifying Information.
  3. Communications Within a Program or Between a Program and An Entity Having Direct Administrative Control Over That Program. Covered Programs may Disclose Covered Information between or among personnel having a need for the information in connection with their duties that arise out of the Diagnosis, Treatment, or referral for Treatment of Substance Use Disorders, if communications are (a) within the Treatment program, or (b) between a Covered Program and an entity that has direct administrative management of the Covered Program.
  4. Communications Within a Program or Between a Program and An Entity Having Direct Administrative Control Over That Program. Covered Programs may Disclose Covered Information between or among personnel having a need for the information in connection with their duties that arise out of the Diagnosis, Treatment, or referral for Treatment of Substance Use Disorders, if communications are (a) within the Treatment program, or (b) between a Covered Program and an entity that has direct administrative management of the Covered Program.
  5. Qualified Service Organizations. Covered Programs may Disclose Covered Information to a Qualified Service Organization as necessary for the Qualified Service Organization to provide services to the Covered Program.


  1. FDA Standards. Covered Programs may Disclose Covered Information to medical personnel of the Food and Drug Administration (FDA) who assert a reason to believe that the health of any individual may be threatened by an error in the manufacture, labeling, or sale of a product under FDA jurisdiction, and that the information will be used for the exclusive purpose of notifying patients or their physicians of potential dangers. The Privacy Official shall be consulted prior to any Disclosure of information pursuant to this provision. Immediately following any Disclosure pursuant to this provision, the Covered Program shall document the Disclosure in the patient's records, setting forth in writing: (1) the name of the medical personnel to whom Disclosure was made and their affiliation with the FDA; (2) the name of the individual making the Disclosure; (3) the date and time of the Disclosure; and (4) The nature of the error.
  2. Crime on Premises/Against Personnel. In the event of a crime or a threat to commit a crime on the premises of a Company Affiliate or its respective departments, or against personnel of the Covered Program, Disclosure of Covered Information to law enforcement is permitted to the extent the information: (a) is directly related to a patient's commission of a crime on the premises of the Covered Program or against personnel of the Covered Program or to a threat to commit such a crime; and (b) is limited to the circumstances of the incident, including the patient status of the individual committing or threatening to commit the crime, that individual's name and address, and that individual's last known whereabouts. The Privacy Official shall be consulted prior to any Disclosure of information pursuant to this provision.
  3. Child Abuse. Covered Programs may report incidents of suspected child abuse and neglect as required by and in accordance with state law. To the extent that state law mandates that a Covered Program provide relevant Covered Information to state or local governmental authorities, Covered Information may be provided. However, the restrictions under 42 CFR Part 2 continue to apply to the original patient records maintained by the Covered Program including their Disclosure and use for civil or criminal proceedings which may arise out of the report of suspected child abuse and neglect. Accordingly, if, after a report is filed with relevant Covered Information, a subpoena for Covered Information is subsequently issued in connection with civil or criminal proceedings which arise from the report of suspected child abuse and neglect, the subpoena should be addressed in accordance with Section 15 of this Policy. The Privacy Official shall be consulted prior to any Disclosure of information pursuant to this provision. Questions regarding state law and the extent of Covered Information subject to Disclosure under state law relating to suspected child abuse and neglect shall be referred to the Privacy Official, who may consult with the Facility's assigned Operations Counsel.
  4. Medical Emergency. Covered Programs may Disclose Covered Information to medical personnel to the extent necessary to meet a bona fide medical emergency in which the patient's prior informed consent cannot be obtained. Immediately following Disclosure, the Disclosure must be documented in writing in the patient's records, setting forth (a) the name of the medical personnel to whom Disclosure was made and their affiliation with any health care facility, (b) the name of the individual making the Disclosure, (c) the date and time of Disclosure, and (d) the nature of the emergency.
  5. Research. Company Affiliates or their respective departments may Disclose Covered Information to qualified personnel for the purpose of conducting scientific research, if the Program Director (in consultation with the Privacy Official) makes a determination that:
  6. The recipient is a HIPAA-covered entity or business associate, and has obtained and documented authorization from the patient, or a waiver or alteration of authorization, consistent with the HIPAA Privacy Rule at 45 CFR 164.508 or 164.512(info), as applicable; or

(b) The recipient is subject to the HHS regulations regarding the protection of human subjects (45 CFR part 46), and has either provided documentation that the researcher is in compliance with the requirements of the HHS regulations, including the requirements related to informed consent, or a has provided a waiver of consent (45 CFR 46.111 and 46.116) or that the research qualifies for exemption under the HHS regulations (45 CFR 46.101(b) and any successor regulations; or
(c) If the recipient is both a HIPAA covered entity or business associate and is subject to the HHS regulations regarding the protection of human subjects, the recipient must meet the requirements of subsection (a) and (b) above.
For any Disclosures pursuant to this Section 10, the recipient (info) is fully bound by the regulations under 42 CFR Part 2 and, if necessary, must resist in judicial proceedings any efforts to obtain access to patient records except as permitted by the regulations in this part; (ii) must not re-disclose Patient Identifying Information except back to the individual or entity from whom that Patient Identifying Information was obtained or as otherwise permitted by law; (iii) may include Covered Information in research reports only in aggregate form in which Patient Identifying Information has been rendered non-identifiable such that the information cannot be re-identified and serve as an unauthorized means to identify a patient, directly or indirectly, as having or having had a Substance Use Disorder; (iv) must maintain and destroy Patient Identifying Information in accordance with the security policies and procedures established by the recipient in accordance with 42 CFR § 2.16; and (v) must retain records in compliance with applicable federal, state, and local record retention laws.
Because a limited data set (as described under 45 CFR §164.514(e)) may include Patient Identifying Information, unless otherwise directed by the Privacy Official, limited data sets with Covered Information will not be disclosed for research purposes unless the requirements of this Section 10 are satisfied.
Any individual or entity conducting scientific research using Patient Identifying Information obtained under this Section 10 that requests linkages to data sets from data repositories holding Patient Identifying Information must:
(a) Have the request reviewed and approved by an Institutional Review Board (IRB) registered with the Department of Health and Human Services, Office for Human Research Protections in accordance with 45 CFR part 46 to ensure that patient privacy is considered and the need for identifiable data is justified. Upon request, the researcher may be required to provide evidence of the IRB approval of the research project that contains the data linkage component.
(b) Ensure that Patient Identifying Information obtained under this Section 10 is not provided to law enforcement agencies or officials.
In addition to the foregoing, any Disclosures of Covered Information for research purposes must meet all requirements of other Company policies relating to the Disclosure of protected health information for research, and must meet all applicable requirements of other Company policies relating to the conduct of or participation in research. The Privacy Official shall be consulted prior to any Disclosure of information pursuant to this provision

  1. Management. Company Affiliates or their respective departments may Disclose Covered Information to qualified personnel for the purpose of conducting management audits, financial audits, or Covered Program evaluation, but such personnel may not identify, directly or indirectly, any individual patient in any report of such audit or evaluation, or otherwise Disclose patient identities in any manner. The Privacy Official shall be consulted prior to any Disclosure of information pursuant to this provision. Uses and Disclosures of Covered Information for audit and evaluation activities described under Section 12 or 13 of this Policy shall comply with the standards described in Section 12 or 13 below, as applicable.
  2. Special Audit and Evaluation Activities/No Records Copied or Removed. If Covered Information is neither downloaded, copied or removed from the premises of the Covered Program nor forwarded electronically to another electronic system or device, Covered Information may be Disclosed in the course of a review of records on the premises of a Covered Program to any Special A/E Personnel. Special A/E Personnel receiving the Covered Information under this provision must agree in writing not to Disclose any Covered Information to any third party, except as described in Section 14 below, and must agree to use the Covered Information only to carry out the audit or evaluation purpose or to investigate or prosecute criminal or other activities, as authorized by an appropriate court order. The Privacy Official shall be consulted prior to any Disclosure of information pursuant to this provision.
  3. Special Audit and Evaluation Activities/Copies or Records Removed. Records containing Covered Information may be copied or removed from the premises of the Covered Program, or downloaded or forwarded to another electronic system or device from the Covered Program's electronic records by Special A/E Personnel (meeting the criteria of subsection (a) of the definition of Special A/E Personnel above) who agree in writing to:
  4. maintain and destroy the Patient Identifying Information a manner consistent with the policies and procedures established under 42 CFR §2.16, which policies and procedures must address: (info) paper records, including standards for: transferring and removing such records; destroying such records, including sanitizing the hard copy media associated with the paper printouts, to render the Patient Identifying Information non-retrievable; maintaining such records in a secure room, locked file cabinet, safe, or other similar container, or storage facility when not in use; using and accessing workstations, secure rooms, locked file cabinets, safes, or other similar containers, and storage facilities that use or store such information; and rendering Patient Identifying Information non-identifiable in a manner that creates a very low risk of re-identification (e.g., removing direct identifiers); and (ii) electronic records, including standards for: creating, receiving, maintaining, and transmitting such records; destroying such records, including sanitizing the electronic media on which such records are stored, to render the Patient Identifying Information non-retrievable; using and accessing electronic records or other electronic media containing Patient Identifying Information; and rendering the Patient Identifying Information non-identifiable in a manner that creates a very low risk of re-identification (e.g., removing direct identifiers).
  5. retain records in compliance with applicable federal, state and local retention laws;
  6. not Disclose any Covered Information to any third party except as described in Section 14 below; and
  7. use the Covered Information only to carry out the audit or evaluation purpose or to investigate or prosecute criminal or other activities, as authorized by an appropriate court order.

The Privacy Official shall be consulted prior to any Disclosure of information pursuant to this provision.

  1. Court Orders. Company Affiliates or their respective departments may Disclose Covered Information if authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor. Information covered by this Policy may not be Disclosed based upon a subpoena alone. Where a subpoena is received that would otherwise require Disclosure identifying an individual as a Covered Patient, the recipient will, consistent with Company policies, provide a timely written response by referring the relevant party to 42 CFR Part 2, and providing any other records that may be lawfully provided without violation of 42 CFR Part 2. As noted above, a party requesting information pursuant to a subpoena may be referred to 42 CFR Part 2, but may not be told affirmatively that the regulations restrict the Disclosure of the records of an identified patient. The Privacy Official shall be consulted prior to any Disclosure of information pursuant to this provision.
  2. Third Party Payers. For information covered by this Policy, written authorization must be obtained prior to release of information to third party payers. For any period for which the Program Director determines that a patient, other than a Minor or one who has been adjudicated incompetent, suffers from a medical condition that prevents knowing or effective action on his or her own behalf, the Program Director may exercise the right of the patient to consent to a Disclosure for the sole purpose of obtaining payment for services from a third party payer. At the time of admission or as soon thereafter as possible, each Covered Program should seek to obtain written consent/authorization for Disclosures for billing and payment purposes. Disclosures to agents of Third Party Payers (which may include agents engaged by Third Party Payers for audit purposes) may be permitted where Attachment B, Consent for Disclosure of Information for Treatment and Billing/Payment, has been executed, but the Third Party Payer should provide written documentation of the agency relationship in advance of sharing of Covered Information. Refer to Attachment B, Consent for Disclosure of Information for Treatment and Billing/Payment.
  3. Multiple Enrollments. Company Affiliates or their respective departments may make certain Disclosures of Covered Information for purposes of preventing multiple enrollments in Withdrawal Management and Maintenance Treatment programs, and may make certain Disclosures to the criminal justice system where the patient was required to obtain Treatment at the facility/department as a condition of the patient's disposition in a criminal proceeding, parole or release from custody. The Privacy Official shall be consulted prior to any Disclosure of information pursuant to this provision.
  4. Minors. Pursuant to 42 CFR Part 2, where a Minor acting alone has the legal capacity under state law to apply for and obtain Substance Use Disorder Treatment, any written authorization for Disclosure of Covered Information may be given only by the Minor patient. This restriction includes, but is not limited to, any Disclosure of Patient Identifying Information to the parent or guardian of a Minor patient for the purpose of obtaining financial reimbursement. Where state law requires consent of a parent, guardian, or other person for a Minor to obtain Substance Use Disorder Treatment, any written consent/authorization for Disclosure of Covered Information must be given by both the Minor and his or her parent, guardian, or other person authorized under state law to act in the Minor's behalf. Where state law requires parental consent to Treatment the fact of a Minor's application for Treatment may be communicated to the Minor's parent, guardian, or other person authorized under state law to act in the Minor's behalf only if: (a) the Minor has given written consent/authorization to the Disclosure or (b) the Minor lacks the capacity to make a rational choice regarding such consent as judged by the Program Director (after consultation with the Privacy Official).

Facts relevant to reducing a substantial threat to the life or physical wellbeing of the applicant or any other individual may be Disclosed to the parent, guardian, or other person authorized under state law to act in the Minor's behalf if the Program Director (after consultation with the Privacy Official) judges that:
(info) a Minor lacks capacity because of extreme youth or mental or physical condition to make a rational decision on whether to consent to a Disclosure to his or her parent, guardian, or other person authorized under state law to act in the Minor's behalf, and
(ii) the Minor's situation poses a substantial threat to the life or physical wellbeing of the Minor or any other individual which may be reduced by communicating relevant facts to the Minor's parent, guardian, or other person authorized under state law to act in the Minor's behalf.
Questions regarding state law standards for consent to Treatment and the authority of individuals to act on behalf of a Minor under state law should be referred to the facility's assigned Operations Counsel.
19.Incompetent Adult Patients. In the case of a patient who has been determined by a court to lack the capacity, for any reason other than insufficient age, to manage his or her own affairs, any authorization which is required under this Policy may be given by the guardian or other person authorized under state law to act in the patient's behalf with respect to medical decisions. Questions regarding the status of guardians and/or other persons authorized under state law to act should be referred to the facility's assigned Operations Counsel.
20.Deceased Patients. Company Affiliates or their respective departments may Disclose Covered Information relating to the cause of death of a patient to the extent required by laws relating to the collection of death statistics/information or other vital statistics or permitting inquiry into the cause of death. Any other Disclosure of information identifying a deceased patient as having a Substance Use Disorder is subject to this Policy and if a written authorization to the Disclosure is required, that authorization may be given by an executor, administrator, or other personal representative appointed under applicable state law. If there is no such appointment, the authorization may be provided by the patient's spouse or, if none, by other family member authorized under state law, subject to the Company's other policies relating to Disclosure of protected health information. Questions regarding the status or authority of an individual as executor, administrator or other individual under state law should be referred to the facility's assigned Operations Counsel.

  1. Notice to Accompany Disclosure. Each Disclosure made with the patient's written consent must be accompanied by the following written statement:

This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR part 2). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see § 2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at §§ 2.12(c)(5) and 2.65.
22.Consent/Authorization. Except as set forth above, Disclosures of Covered Information require appropriate written consent/authorization. A written consent/authorization to a Disclosure under this Policy may be paper or electronic and must include:
(a)The name of the patient.
(b)The specific name(s) or general designation(s) of the Covered Program(s), entity(ies), or individual(s) permitted to make the Disclosure.
(c)How much and what kind of information is to be Disclosed, including an explicit description of the Substance Use Disorder information that may be Disclosed.
(d)(info) The name(s) of the individual(s) to whom a Disclosure is to be made; or
(ii) If the recipient entity has a Treating Provider Relationship with the patient whose information is being Disclosed, such as a hospital, a health care clinic, or a private practice, the consent/authorization must include the name of that entity; or
(iii) If the recipient entity does not have a Treating Provider Relationship with the patient whose information is being Disclosed and is a Third-party Payer, the consent/authorization must include the name of the entity; or
(iv) If the recipient entity does not have a Treating Provider Relationship with the patient whose information is being Disclosed and is not a Third-party Payer, such as an entity that facilitates the exchange of health information or a research institution, then the consent/authorization must include the names of the entities, and either (a) the names of individual participants; or (b) the names of entity participants that have a Treating Provider Relationship with the patient whose information is being Disclosed; or (c) a general designation of an individual or entity participants or class of participants that must be limited to a participants who have a Treating Provider Relationship with the patient whose information is being Disclosed. When using a general designation, a statement must be included on the consent form that the patient (or other individual authorized to sign in lieu of the patient), confirms their understanding that, upon their request and consistent with this part, they must be provided a list of entities to which their information has been Disclosed pursuant to the general designation. See Section 25 below.

  1. The purpose of Disclosure (and the Disclosure must be limited to that information which is necessary to carry out the stated purpose).
  2. A statement that the consent/authorization is subject to revocation at any time except to the extent that the Covered Program or other lawful holder of Patient Identifying Information that is permitted to make the Disclosure has already acted in reliance on it. Acting in reliance includes the provision of Treatment services in reliance on a valid consent to Disclose information to a third- party payer.
  3. The date, event, or condition upon which the consent/authorization will expire if not revoked before. This date, event, or condition must ensure that the consent/authorization will last no longer than reasonably necessary to serve the purpose for which it is provided.
  4. The signature of the patient and, when required for a patient who is a Minor, the signature of an individual authorized to sign the consent/authorization as described above; or, when required for a patient who is incompetent or deceased, the signature of an individual authorized to sign for the incompetent or deceased patient as described above. Electronic signatures are permitted to the extent that they are not prohibited by any applicable law.
  5. The date on which the consent is signed.

For uses and Disclosures that require authorization under HIPAA, the consent/authorization must also meet all requirements for a valid authorization under the Company's HIPAA policies and procedures.

  1. Consent for Disclosures to Healthcare Providers for Treatment. While the regulations under 42 CFR Part 2 include provisions addressing uses of Covered Information within a Covered Program and Disclosures in medical emergencies, subject to the terms and requirements above, many Disclosures of Covered Information to healthcare providers outside of the Covered Program, even for Treatment purposes, will require appropriate consent. At the time of admission or as soon thereafter as possible, each Covered Program should seek to obtain written consent/authorization for Disclosures for Treatment purposes. Refer to Attachment B, Consent for Use and Disclosure of Information for Treatment and Billing/Payment.
  2. Family Members/Friends/Others Involved in Patient's Care. The regulations under 42 CFR Part 2 do not include any exceptions specifically for Disclosures of Covered Information to family members, close friends or others identified by the Covered Patient. Accordingly, unless otherwise expressly permitted by this Policy, Covered Information should not be Disclosed to family members, friends or others who might otherwise be considered involved in a patient's care. For example, even if a Covered Patient has provided a password or has provided verbal consent to a Disclosure to a spouse, except as otherwise expressly permitted by this Policy (e.g., provisions relating to incapacitated adult patients, deceased patients, etc.), Covered Information should not be Disclosed to the spouse unless an appropriate consent/authorization meeting the standards set forth below has been executed naming the spouse. As family members, friends and/or others identified by the Covered Patient may be involved in therapy sessions and planning for post-discharge care, among other activities, at the time of admission or as soon thereafter as possible, each Covered Program should seek to obtain written consent/authorization for Disclosures to appropriate family members, friends and/or others identified by the Covered Patient who may need Covered Information in connection with care. Refer to Attachment C, Consent For Disclosure to Family/Friends.


  1. List of Disclosures. Upon request, Covered Patients who have consented to Disclose their Patient Identifying Information using a general designation (as described under Section 22 of this Policy) must be provided a list of entities to which their information has been Disclosed pursuant to the general designation. Patient requests for lists of General Designation Disclosures under this Section 25: (a) must be made in writing; and (b) are limited to General Designation Disclosures made within the past two years prior to the request. If a request for a list of General Designation Disclosures is received, Covered Programs will: (info) respond in 30 or fewer days of receipt of the written request; and (ii) for each General Designation Disclosure made within the two years prior to the request, provide the name(s) of the entity(ies) to which the General Designation Disclosure was made, the date of the General Designation Disclosure, and a brief description of the Patient Identifying Information Disclosed.

Requests for lists of General Designation Disclosures pursuant to this Section 25 should be forwarded promptly to the Privacy Official. The Privacy Official will coordinate with the Health Information Management department to obtain and provide the list of General Designation Disclosures. Only General Designation Disclosures must be identified on the list under this Section 25 and other Disclosures need not be listed. The rights of a Covered Patient under this Section 25 are in addition to any rights to an accounting of Disclosures under HIPAA.

  1. Security Precautions. Appropriate security will be maintained with respect to Covered Information, consistent with the security standards, policies and procedures of the Company. Security measures will reasonably protect against unauthorized uses and Disclosures of Patient Identifying Information and protect against reasonably anticipated threats or hazards to the security of Patient Identifying Information. These formal policies and procedures address:

(a)Paper records, including:
(info) Transferring and removing such records;
(ii) Destroying such records, including sanitizing the hard copy media associated with the paper printouts, to render the Patient Identifying Information non-retrievable;
(iii) Maintaining such records in a secure room, locked file cabinet, safe, or other similar container, or storage facility when not in use;
(iv) Using and accessing workstations, secure rooms, locked file cabinets, safes, or other similar containers, and storage facilities that use or store such information; and
(v) Rendering Patient Identifying Information non-identifiable in a manner that creates a very low risk of re-identification (e.g., removing direct identifiers).
(b)Electronic records, including:
(info) Creating, receiving, maintaining, and transmitting such records;
(ii) Destroying such records, including sanitizing the electronic media on which such records are stored, to render the Patient Identifying Information non-retrievable;
(iii) Using and accessing electronic records or other electronic media containing Patient Identifying Information; and
(iv) Rendering the Patient Identifying Information non-identifiable in a manner that creates a very low risk of re-identification (e.g., removing direct identifiers).

  1. Disposition of Records by Discontinued Covered Programs. If a Covered Program discontinues operations, or if taken over or acquired by another Covered Program, records containing Patient Identifying Information will be managed in accordance with 42 CFR § 2.19. The Privacy Official shall be consulted prior to any disposition of record by a discontinued Covered Program.

State Law. In the event that state law is more protective of the Patient Identifying Information than this policy, then state law will control. Questions regarding this Policy should be directed to the Corp Substance Use Records Help mailbox and/or to the facility's assigned Operations Counsel, and questions about state law impacts on this policy should be directed to the facility's assigned Operations Counsel.
References
1.Confidentiality of Substance Use Disorder Patient Records, 42 C.F.R. Part 2
2.Health Insurance Portability and Accountability Act (HIPAA), Standards for Privacy of Individually Identifiable Health Information (45 CFR Parts 160 and 164)














Attachment A
Confidentiality of Substance Use Disorder Patient Records
The confidentiality of Substance Use Disorder patient records maintained by this program is protected by federal law and regulations. Generally, the program may not say to a person outside the program that a patient attends the program, or disclose any information identifying a patient as having a substance use disorder unless:
(1) The patient or an authorized representative consents in writing;
(2) The disclosure is allowed by a court order; or
(3) The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation.
Violation of the federal law and regulations by a program is a crime. Suspected violations may be reported, consistent with federal regulations, to: Executive Office for United States Attorneys, United States Department of Justice, 950 Pennsylvania Avenue, NW, Room 2242, Washington, DC 20530-0001 or to the Substance Abuse and Mental Health Services Administration (SAMHSA) Center for Substance Abuse Treatment (CSAT), 5600 Fishers Lane, Rockville, MD 20857.
Federal law and regulations do not protect any information about a crime committed by a patient either at the program or against any person who works for the program or about any threat to commit such a crime.
Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities.
See 42 U.S.C. 290dd–3 and 42 U.S.C. 290ee–3 for federal laws and 42 CFR part 2 for federal regulations.






Attachment B
CONSENT FOR DISCLOSURE OF INFORMATION FOR TREATMENT AND BILLING/PAYMENT
Patient Name Date of Birth
I, the undersigned, hereby agree as follows:

  1. I have received from ____________ (the "Program") notice that federal law and regulations protect the confidentiality of substance use disorder patient records, and have received a written summary of the federal law and regulations protecting those records;
  2. For purposes of facilitating treatment and medical care of the Patient named above by ____________________ (the "Hospital"), healthcare providers furnishing services at the Hospital and members of the medical staff of the Hospital who may be involved in my treatment from time to time and other local providers who may be involved in my care, as listed: _______________________________________________________________ (collectively "Providers"), I consent to the Program disclosing the Treatment Records (as hereinafter described) to the Hospital and all past, present and future Providers. Treatment Records will include all records maintained by the Program relating to the Patient, including all admission forms and information, medication information, medical history information, physician orders, clinical testing information and other information, excluding only the following: ____________________________________________________________________ (list any items in your records with the Program that you do not wish to have shared with Providers for the Patient's treatment, or write "NONE" if you consent to all of the Patient's records with the Program being shared with the Hospital and Providers as necessary for the Patient's treatment);
  3. For purposes of facilitating billing and collection by the Program for treatment provided and for payment activities, I consent to the Program disclosing the Billing Information (as hereinafter described) to the individual(s) and entities listed below, as well as all insurance companies and third party payers identified on admission documents or similar materials for the Patient, and other individuals or entities previously, currently or subsequently identified as responsible or potentially responsible for payment for the Patient's care (the individuals and entities listed below and/or described above are hereinafter referred to collectively as the "Payers"):______________________________________________________________

______________________________________________________________________

  1. "Billing Information" will include all records and information maintained by the Program relating to the Patient, including, without limitation, admission information, medication information, medical history information, physician orders, clinical testing information and other information, excluding only the following: _________________________________ (list any items in your records with the Program that you do not wish to have shared with the Payers, or write "NONE" if you consent to all of the Patient's records with the Program being shared with the Payers as determined by the Program to be appropriate for billing, collection or payment activities);
  2. This consent will expire on the following date, event or condition if not revoked before then: __________________________________________________ (list the date, event or condition upon which you wish for this consent to expire; if no date, event or condition is listed, this consent will expire on the earlier of (info) ten (10) years from the date of signature below, or (ii) (a) with respect to use and disclosures for treatment, the last date on which the Treatment Records are reasonably necessary for facilitating the Patient's treatment and medical care by the Hospital and Providers), and (b) with respect to disclosures for billing, collection and payment, the last date on which the Billing Information is reasonably necessary for facilitating billing, collection and payment activities for the Patient's treatment and medical care);
  3. Where this consent references disclosure of information to an entity, I consent to disclosure to all employees, agents and representatives who may request or require the relevant information for the purposes permitted above;
  4. I understand that, following my written request to the Program and consistent with 42 CFR Part 2, I will be provided with a list of entities to which my information has been disclosed during the two year period prior to the request pursuant to any general designation in this consent;
  5. This consent is subject to revocation at any time except to the extent that the Program has already acted in reliance on it.


NOTE: If you do not consent to disclosure of your information to Payers, the Program will not be able to bill your insurance company and you will be personally responsible for the full amount of all charges for treatment.

Date:
Signature of Patient/Patient's Representative



Print Name of Patient's Representative (if applicable) Relationship to Patient





Attachment C
CONSENT FOR DISCLOSURE TO FAMILY/FRIENDS
Patient Name Date of Birth
I, the undersigned, hereby agree as follows:

  1. I have received from ____________ (the "Program") notice that federal law and regulations protect the confidentiality of substance use disorder patient records, and have received a written summary of the federal law and regulations protecting those records;
  2. For purposes of facilitating treatment and care of the Patient, including, without limitation, for purposes of therapy sessions, post-discharge care and other reasonable purposes, I consent to the Program disclosing the Covered Information (as hereinafter described) to the following individual(s) (the "Identified Person(s)"):_____________________________________________________________

______________________________________________________________________

  1. "Covered Information" will include all records and information maintained by the Program relating to the Patient, including, without limitation, admission information, medication information, medical history information, physician orders, clinical testing information and other information, excluding only the following: ____________________________________________________________________ (list any items in your records with the Program that you do not wish to have shared with the Identified Person(s), or write "NONE" if you consent to all of the Patient's records with the Program being shared with the Identified Person(s) as determined by the Program to be appropriate);
  2. This consent will expire on the following date, event or condition if not revoked before then: __________________________________________________ (list the date, event or condition upon which you wish for this consent to expire; if no date, event or condition is listed, this consent will expire on the earlier of (info) ten (10) years from the date of signature below, or (ii) the last date on which the Covered Information is reasonably necessary for facilitating the Patient's treatment and medical care);
  3. This consent is subject to revocation at any time except to the extent that the Program has already acted in reliance on it.
  4. I acknowledge that I may be required to sign another authorization form in future related to the disclosure of copies of medical records to the Identified Persons.


Date:
Signature of Patient/Patient's Representative

Print Name of Patient's Representative (if applicable) Relationship to Patient