Community Initiatives HIPAA Notice of Privacy Practices

We typically use or share your PHI in the following ways.

Treating you

We can use your PHI and share it with other professionals who are treating you.

Running our organization

We can use and share your PHI to run the health care components of Community Initiatives, which engage in charitable and/or educational activities, improve your care, and contact you when necessary.

1. For health care operations
   We may use and disclose your PHI for purposes like quality assessment and improvement, training and evaluation of health care professionals, licensing, accreditation, and determining costs of providing health care (like premiums and payments).
2. To Business Associates
   We may contract with business associates to act on our behalf, like for payment and health care operations. Business Associates must agree to safeguard your PHI under Business Associate Agreements.
3. For identity verification
   We may verify your identity using your PHI as necessary, and in compliance with the law.
4. During communications with family and others when you are present
    A family member or other person involved in your care may be present when we are discussing your PHI with you (like if they accompany you to an appointment). If you don’t wish to discuss your PHI with them present, please tell us and we either won’t discuss your PHI, or will ask the person to leave.
5. For communications with family and others when you are not present
   It may become necessary to disclose your PHI to a family member (or someone else involved in your care).  This can happen when there is an emergency, you are not present, or you lack the decision-making capacity to agree or object (like if you are incapacitated). If that happens, we will use our professional judgment to determine if disclosing your PHI is in your best interest. Regardless, we will limit the disclosure to PHI that is directly relevant to the situation. For a common example, someone might need to pick up a prescription for you.
6. For disclosures to parents as personal representatives of minors
   Usually, we are allowed to disclose your minor child’s PHI to you. However, we are sometimes permitted (or required) by law to deny access to your minor child’s PHI. Examples include (i) when a minor who is 12 or older seeks care for a communicable disease or condition, and (ii) when minors have adult rights to make their own health care decisions (e.g. marriage or emancipation).

Billing for services

We can use and share your PHI to bill and get payment from health plans or other entities.  For instance, a Project may need to bill Medi-Cal (or your insurance provider) for services.  If you receive care from an outside provider through us, they may bill us first. Then, we use and disclose your PHI to determine how much, if any, of the bill we are responsible for paying.

How else can we use or share your PHI?

We are allowed or required to share your PHI in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your PHI for these purposes. For more information on how this sharing works, see: http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.

1. Help with public health and safety issues

   We can share PHI about you for certain situations such as:

   • Preventing disease.
   • Helping with product recalls.
   • Reporting adverse reactions to medications.
   • Reporting suspected abuse, neglect, or domestic violence: We may disclose PHI to the appropriate authority to report suspected child abuse or neglect or to identify suspected victims of abuse, neglect, or domestic violence
   • Preventing or reducing a serious threat to anyone’s health or safety.
   • Disclosure in case of disaster relief: We may disclose your name, city of residence, age, gender, and general condition to a public or private disaster relief organization to assist disaster relief efforts, unless you object at the time.
2. Doing research
   As part of Community Initiatives’ charitable and/or educational activities, Projects may engage in research. Research of all kinds may involve the use or disclosure of your PHI. For instance, your PHI can generally be used or disclosed for research without your permission with the approval of an Institutional Review Board. An Institutional Review Board is a committee that is responsible for reviewing and approving human subjects research to protect the safety of the individuals and the confidentiality of their PHI.
3. Comply with the law
   We will share PHI about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
4. Respond to organ and tissue donation requests
   We can share PHI about you with organ procurement organizations.
5. Work with a medical examiner or funeral director
   We can share PHI with a coroner, medical examiner, or funeral director when an individual dies.
6. Address workers’ compensation, law enforcement, and other government requests
   We can use or share PHI about you:
   • For workers’ compensation claims
   • For law enforcement purposes or with a law enforcement official, for example, to respond to a search warrant, report a crime on our premises or the premises of a Project, or help identify or locate someone.
   • With health oversight agencies for activities authorized by law
   • For special government functions such as military, national security, and presidential protective services
7. Lawsuits and other legal disputes
   We may use and disclose PHI in responding to a court or administrative order, a subpoena, or a discovery request. We may also use and disclose PHI to the extent permitted by law without your authorization, for example, to defend a lawsuit or arbitration.

De-Identification

We, or a business associate with whom we have contracted, may use PHI to de-identify it in accordance with HIPAA standards and may further disclose the de-identified data to third parties in connection with our operations. Data that has been de-identified no longer constitutes PHI.

Authorization for Use and Disclosures

ALL OTHER USES AND DISCLOSURES OF YOUR PHI REQUIRE YOUR PRIOR WRITTEN AUTHORIZATION.

Except for those uses and disclosures described above, Community Initiatives will not use or disclose your PHI without your written authorization. Where such authorization is required, we will provide you with written HIPAA authorization forms for your review. Some examples of situations in which we may request your authorization for use or disclosure of PHI include:

• Marketing: Our Projects may ask for your authorization in order to provide you with information about that Project’s products and services that you may be interested in purchasing or using. Marketing does not include any in-person communications you may have with your providers about products or services.
• Sale of PHI: We may only sell your PHI if we received your prior written authorization to do so.
• Psychotherapy Notes: On rare occasions, our Projects may ask for your authorization to use and disclose “psychotherapy notes”. Federal privacy law defines “psychotherapy notes” very specifically to mean notes made by a mental health professional recording conversations during private or group counseling sessions that are maintained separately from the rest of your medical record.

Where your authorization is required and you authorize us to use or disclose your PHI for some purpose, you may revoke that authorization by notifying us in writing at any time using the contact information of our Privacy Officer found in this Notice of Privacy Practices. Please note that any such revocation will not apply to any authorized use or disclosure of your PHI that took place before we received your revocation.