Privacy Policy (English)

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.  If you have any questions about this Notice, please contact our Privacy Officer at (508) 792-5400. 

I. INTRODUCTION

Spectrum Health Systems, Inc. programs and facilities, and services including New England Recovery Centers will be referred to in this Notice of Privacy Practices (“Notice”) as “Spectrum.” This includes programs in both Massachusetts and Virginia and covers Outpatient Treatment, Inpatient/Residential Treatment, Pre-release Programming, Programs for Incarcerated Individuals, Community Partnership Services, etc.

Spectrum is required by law to protect the confidentiality of your PHI under the rules set forth by local, state, and federal law including the Health Information Portability Accountability Act of 1996 (HIPAA) and 42 CFR. Part 2.  In certain circumstances, pursuant to this Notice, patient authorization, or applicable laws and regulations, PHI can be used by Spectrum or “shared” (further referred to as “disclosed”) to other parties.

The information below will describe the ways and reasons in which Spectrum may use and disclose your PHI and provide examples to help you better understand your rights in each situation.

II. USES AND DISCLOSURES THAT REQUIRE YOUR AUTHORIZATION

Spectrum may not disclose your PHI without your written authorization in most circumstances. You may give permission for Spectrum personnel to disclose your information by filling out the Authorization for Release of Information form (also known as an ROI).  You may be as broad or specific as to the type of information, the date range of the information, and the manner in which you wish to permit us to share that information (written, e-mail, phone call, etc.).  Spectrum personnel are trained to support and coach you as to filling these ROIs out in full, but you are ultimately responsible for identifying the entities and information you wish to have shared. Spectrum will never release information in regard to genetic information, HIV/AIDS status, or records regarding venereal diseases without your explicit written permission.

You may revoke any authorization, in writing, except to the extent that Spectrum has already taken action upon the authorization. If you are receiving care and wish to revoke any authorization, you may speak to any Spectrum employee to initiate the revocation.

Please be aware that a court with appropriate jurisdiction or other authorized third party could request or compel you to sign an authorization as a condition to participating in court-ordered services at Spectrum. For instance, you may have requirements through legal entities such as DCF or Probation that require Spectrum to share information with them, Spectrum cannot do so without your written authorization in most circumstances. Your willingness to comply with the court may impact the ability Spectrum has to help you meet their expectations.

Whenever your PHI is disclosed with or without authorization, Spectrum personnel will always practice the “Minimum Necessary” rule which requires personnel to take reasonable steps to limit the disclosure to the minimum amount necessary to accomplish the intended purpose.

III. USES AND DISCLOSURES THAT MAY BE USED WITHOUT YOUR AUTHORIZATION

For Treatment, Payment, and Operations

Spectrum may disclose PHI for purposes of treatment, payment and healthcare operations without your consent, as follows:

1. For Treatment: Spectrum will use and disclose your PHI with your authorization to provide and/or coordinate your healthcare and any related services.  For Example: Spectrum may need to disclose information to an external medical provider, mental health professional, or other member of your care team who is responsible for your care. Declining permission to allow us to communicate this to your other providers may create barriers and wait periods to get you access to any further treatment you may need.

2. For Payment: Spectrum may use or disclose your PHI with your authorization so that the treatment and services you receive are billed to and payment is collected from your health plan or other third-party payer. For example, Spectrum may disclose your PHI to permit your health plan to take certain actions before your health plan approves or pays for your services. These actions may include:

a. Making a determination of eligibility or coverage for health insurance;
b. Reviewing your services to determine if they were medically necessary;
c. Reviewing your services if they were appropriately authorized or certified in advance of your care; or
d. Reviewing your services for purposes of utilization review, to ensure the appropriateness of your care, or to justify the changes for your care.

3. For Healthcare Operations: Spectrum may use and/or disclose your PHI with your authorization for health care operations. These uses and disclosures are necessary to run our organization and make sure that you receive quality care. These activities may include, by way of example, quality assessment and improvement, reviewing the performance or qualifications of our clinicians, training student interns in clinical activities, licensing and accreditation, business planning and development, and general administrative activities.

Appointment Reminders or Treatment Alternatives

We may use and disclose your PHI to contact you as a reminder that you have an appointment for a home visit. We may use and disclose your PHI to advise you or recommend possible service options or alternatives that may be of interest to you.

Fundraising

Neither Spectrum Health Systems nor New England Recovery Centers engage with patients, past or present, for the purposes of fundraising.

Spectrum may also use or disclose your PHI without obtaining your written authorization for the following purposes:

1. As Required by Law and Law Enforcement Entities: Spectrum may use or disclose PHI when required by law or ordered to in a judicial or administrative proceeding, in response to a court order signed by a judge. In the event that there was a crime on our property, including driving under the influence and child endangerment/suspected abuse, Spectrum may share information regarding the perpetrator of the crime including name, description, and camera footage, if applicable.

2. For Public Health Activities and Risks: Spectrum may disclose PHI to government officials in charge of collecting information about preventing and controlling disease, reactions to medications or product defects or problems, or to notify a person who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease or condition.

3. Coroners and Medical Examiners: Spectrum may disclose PHI to coroners and/or medical examiners for the purpose of determining a cause of death, or otherwise as necessary to enable these parties to carry out their duties consistent with applicable law.

4. Organ, Eye, and Tissue Donation: Spectrum may release PHI to organ procurement organizations to facilitate organ, eye, and tissue donation and transplantation.

5. To Report a Serious Threat to Health and/or Safety: Spectrum may disclose PHI to report a serious threat to health and safety to yourself, others, or general public. This includes suspected child abuse and/or neglect and/or reported specific plans to harm yourself or others.

6. The Department of Corrections: If you are an inmate of a correctional institution or under the custody of a law enforcement official, Spectrum may disclose health information about you to the correctional institution.

7. Medical Emergencies: Spectrum may use and disclose PHI in emergency situations, such as to an EMT or ER staff that is attending to your safety and medical needs to the extent required to provide you emergency care.

8. Lawsuits and Disputes: If you are involved in a lawsuit or a dispute with Spectrum Health Systems, Spectrum may disclose health information about you in response to a court or administrative order.

9. Military and Veterans: Spectrum may use or disclose PHI of military personnel and veterans as required by military or veterans’ authorities. Spectrum may also disclose your information for the purpose of determining your eligibility for benefits provided by the Department of Veterans Affairs. Finally, if you are a member of a foreign military service, Spectrum may disclose your information to that foreign military authority.

10. Specialized Government Functions: Spectrum may disclose PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities, and for the provision of protective services to the President or other authorized persons or foreign heads of state or to conduct special investigations.

11. Disclosures to You or for HIPAA Compliance Investigations: Spectrum may disclose your PHI to you or to your personal representative and are required to do so in certain circumstances described below in connection with your rights of access to your PHI and to an accounting of certain disclosures of your PHI. Facility must disclose your PHI to the Secretary of the U.S. Department of Health and Human Services (the “Secretary”) when requested by the Secretary in order to investigate compliance with privacy regulations issued under the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

12. Worker’s Compensation: Spectrum may disclose PHI to comply with workers’ compensation or other similar laws that provide benefits for work-related injuries or illnesses.

All of the potential disclosures in the aforementioned scenarios will be specific to PHI as defined in the HIPAA laws using the Minimum Necessary Rule. Any disclosures made within the bounds of these scenarios will not include information on the treatment of substance use disorders.

IV. USES AND DISCLOSURES THAT DO NOT REQUIRE AUTHORIZATION BUT THAT YOU MAY LIMIT THE INFORMATION DISCLOSED

Spectrum may use or disclose your PHI with consideration of limitations under your direction for the following:

1. Persons Involved in Your Care: Spectrum may provide health information about you to someone who helps pay for your care. Spectrum may also use or disclose your health information to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition or death. Spectrum may also use or disclose your health information to an entity assisting in disaster relief efforts and to coordinate uses and disclosures for this purpose to family or other individuals involved in your health care.

2. Incapacitation: In limited circumstances, Spectrum may disclose health information about you to a friend or family member who is involved in your care.  If you are physically present and have the capacity to make health care decisions, your health information may only be disclosed with your agreement to persons you designate to be involved in your care.

V.  CONFIDENTIALITY OF SUBSTANCE USE DISORDER (SUD) RECORDS

Some of your health information may be protected by federal law under 42 CFR Part 2, which provides additional privacy protections for records related to substance use disorder (SUD) treatment (“SUD Information”). These protections apply in addition to HIPAA.

We will only use and disclose your SUD information as described in this section or with your written consent.

1. Permitted Uses and Disclosures of SUD Information Without Consent
   • To communicate among our clinicians and staff who have a need for the information in connection with their duties to provide diagnosis, treatment, or referral for treatment when the communications are (i) within the Spectrum program or (ii) related to administration of the Spectrum program.
   • To qualified service organizations providing services on our behalf who agree in writing to protect the SUD Information in the same way that we are required to protect the SUD Information.
   • To law enforcement agencies or officials if you commit, or threaten to commit, a crime in our facilities or against our personnel.
   • To report suspected child abuse and neglect consistent with Massachusetts law.
   • To other medical personnel in a medical emergency under certain conditions.
   • For research purposes consistent with approval of the Institutional Review Board (“IRB”)
   • To qualified personnel for audit or program evaluation purposes who have agreed to protect the SUD Information.
   • To a public health authority, if the SUD Information has been de-identified.
2. Permitted Uses and Disclosures of SUD Information that Require Consent
   • For treatment, payment, and health care operations purposes. You may provide us with a single consent for all future uses or disclosures for treatment, payment, and healthcare operations purposes in order to ensure you receive the highest level of coordinated care. Once your SUD Information is disclosed to a HIPAA covered entity (such as another health care provider or a health insurance company) or a business associate (companies that provide services on behalf of HIPAA covered entities), the recipient may disclose your information for treatment, payment and healthcare operations purposes to the extent permitted by HIPAA. See examples of disclosures for treatment, payment and healthcare operations in Section II above.
   • To a central registry or to any withdrawal management or maintenance treatment program not more than 200 miles away for the purpose of preventing multiple enrollments with certain limitations.
   • Certain information regarding medications prescribed or dispensed to the state prescription drug monitoring program if required by applicable state law.
   • Certain information to those persons within the criminal justice system who have made participation in the SUD Clinic as a condition of the disposition of any criminal proceedings against the patient or of the patient’s parole or other release from custode with certain limitations.
3. Additional Provisions Regarding SUD Information
   • SUD Information, or testimony that describes the SUD Information, will not be used or disclosed by us in any civil, criminal, administrative, or legislative proceedings against you, unless authorized by your consent or by a court order after notice and an opportunity to be heard is provided and the court order is accompanied by a subpoena or other legal requirement compelling disclosure in compliance with the requirement so 42 C.F.R Part 2.
   • SUD Information will not be used or disclosed for fundraising purposes unless you are provided with clear and conspicuous notice and opportunity to elect not to receive any fundraising communications.
   • Unless otherwise restricted in this Section or as modified below, all other provisions of this Notice, including, but not limited to the rights described in Section X below, apply to SUD Information.

VI. MINORS

Pursuant to 42 CFR § 2.14, a minor’s parent or guardian may never consent to the disclosure of that minor’s substance abuse treatment information. Spectrum must obtain the consent from the minor receiving the treatment in order to disclose information to the parents or guardian or to another third party.

VII. YOUR INDIVIDUAL RIGHTS:

In regard to Privacy Practices, you have:

• The Right to Receive Confidential Information: Spectrum will typically communicate with you by phone. You have the right to request receipt of your PHI by alternative means of communication or at alternative locations (personal e-mail, work address, work phone, etc.). Spectrum will accommodate any reasonable request put in writing.

• The Right to Request Restrictions: Spectrum will not disclose health information to your health plan if the disclosure if for payment of a service for which you have paid Spectrum out of your pocket in full. You may also request restrictions on our use and disclosure of PHI for treatment, payment, and health care operations. While we will consider requests for additional restrictions carefully, Spectrum is not required to agree to a requested restriction. If you wish to request additional restrictions and you are currently receiving services, please contact a Spectrum Employee.

• The Right to Inspect and Copy Your Health Information: You may request access to the record of services that Spectrum maintains in order to inspect and/or request copies of its contents. Under limited circumstances, Spectrum may deny access to a portion of your records. If you wish to access your records and are a current or former patient, you can ask any Spectrum employee for a copy of your records.

• The Right to Amend Your Records: You have the right to request that we amend PHI maintained in your clinical file or billing records. All active patients wishing to amend their record by contacting a Spectrum employee. Once you have been discharged from treatment, you may need to contact the Regional Program Director of the program/programs of which you were a patient. Under certain circumstances, Spectrum has the right to deny your request to amend your records and will notify you of this denial as provided in the HIPAA regulations. If your requested amendment to your records is accepted, a copy of your amendment will become a permanent part of the medical record. When we “amend,” a record, we may append information to the original record, as opposed to physically removing or changing the original record. If your requested amendment is denied, you will be informed of your right to have a brief statement of disagreement placed in your medical record.

• The Right to Receive and Accounting of Disclosures: You may obtain a list of instances in which Spectrum has disclosed your PHI. The accounting will apply only to covered disclosures prior to the date of your request provided such period does not exceed six years for PHI or three years for SUD records. If you request an account more than once during a twelve (12) month period, there may be a charge. You will be told the cost prior to the request being filled.

• The Right to Receive Notification of a Breach: You will be notified should Spectrum discover a breach of your confidentiality has occurred and your information has been compromised. A risk analysis will be conducted to determine the probability that protected health information has been compromised.  Notification will be made no more than 60 days after the discovery of the breach unless it is determined by a law enforcement agency that the notification should be delayed.

• The Right to Receive a Paper Copy of This Notice: Upon request, you may obtain a paper copy of this notice.

VIII. FOR FURTHER INFORMATION AND COMPLAINTS:

For more information regarding your rights to privacy and confidentiality, you may contact Spectrum Health Systems at 508-792-5400 or 149 Oak St., Westborough, MA, 01581. If you believe that Spectrum or Spectrum personnel have violated your privacy rights, you can contact Spectrum Health Systems at the aforementioned or you can call Spectrum Health Systems’ Confidential Corporate Compliance Hotline at 1-866-355-9693. You may also call this number if you disagree with a decision that Spectrum has made about access to your information, or to complain about our breach notification process.

You also have the right to file a written complaint with the Secretary of the United States Health and Human Services. Upon request, Spectrum personnel will provide you with the correct address. Spectrum will not retaliate against any individual that files a complaint.

VIII. RIGHT TO CHANGE TERMS OF THIS NOTICE:

Spectrum may change the terms of this Notice at any time. If Spectrum changes this Notice, it may apply to all PHI and/or SUD records that Spectrum maintains, including information created or received prior to issuing the new Notice. Should this Notice be changed, a revised Notice will be posted visibly in all Spectrum programs or facilities that house Spectrum programming. Spectrum will also keep a copy of this Notice posted on the company website: www.SpectrumHealthSystems.org. Spectrum will offer copies of the updated Notice to any stakeholder that makes a request to a Spectrum employee.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.