We may use or disclose your health information in one of the following ways:

(1) to you or your legal representative (to the extent permitted in this privacy notice);

(2) for treatment, payment or health care operation purposes;

(3) pursuant to your verbal agreement to discuss your health condition with family or friends who are involved in your care;

(4) as permitted by law;

(5) as required by law;

(6) incidental uses and disclosures that may occur as a by-product of a permissible use or disclosure; and

(7) pursuant to your written authorization for any and all other uses and disclosures of your health information.

The following describes the different ways that we may use or disclose your health information. Where appropriate, we have included examples of the different types of uses or disclosures. While not every conceivable use or disclosure is identified, we have included all of the categories in which we may make such uses or disclosures.

A. Uses for treatment, payment and health care operations.

We may use or disclose your health information for purposes of treatment, payment or health care operations.

1. Treatment. We may use your health information to provide you with services. We may disclose your health information to staff members, volunteers and service delivery personnel who are involved in providing you services. For example, your health information will be shared among members of your service management team, as necessary, to provide you services or with pharmacy staff to the extent needed to order prescriptions. In addition to treatment provided directly by our staff, treatment includes the coordination or management of health care and related services by us with other health care providers, which may include the coordination or management of health care by us with a third party, consultation by our staff and another health care provider, such as a specialist, or the referral of you for health care to another provider.

i. Appointment reminders. We may use or disclose your health information for purposes of contacting you to remind you of an appointment.

ii. Treatment alternatives, Health-related benefits and services. We may use or disclose your health information for purposes of contacting you to inform you of service alternatives or health-related benefits and services that may be of interest to you.

2. Payment. We may use or disclose your health information so that we may bill and collect payment from you, an insurance company, or another third party for the services you receive at our agencies. For example, we may need to give information to your health plan, Medicaid or a state agency regarding the services you received from our agencies so that we will be reimbursed for the services provided by our agencies. We may also use or disclose your health information to another health care provider who has provided services, treatment or supplies indirectly to you through us in order for them to bill or collect payment for their services or supplies. For example, we have arrangements with various suppliers whereby they provide medical equipment and supplies to you through us and they bill third party payers (including Medicaid) directly for the services and supplies provided. Under such circumstances, we are permitted to provide the health information necessary for them to seek payment for the services and supplies, which they provided for your care.

3. Health care operations. We may use or disclose your health information to perform certain functions within our agencies. These uses or disclosures are necessary to operate our agencies and to make sure that our clients receive quality care. For example, we may use your health information to review our services and to evaluate the performance of our staff in caring for you. We may combine health information about many of our clients to determine whether certain services are effective or whether additional services should be provided. We may remove information that identifies you from this set of health information so that others may use the information to study health care and health care delivery without learning the specific identities of our clients. We may disclose to another health care provider or health plan subject to federal privacy regulations your health information for that provider or health plan to use for certain of its health care operations (limited to items 1 and 2 below), provided both our agencies and such provider or health plan has or had a relationship with you and the information disclosed pertains to that relationship.

Health care operations mean the following activities:

1. Conducting quality assessment and improvement activities;

2. Reviewing the competency and qualification of health care professionals, evaluating practitioner and provider performance, conducting training programs for students, trainees or practitioners, training of non-health care professionals, accreditation, certification, licensing or credentialing activities;

3. Conducting or arranging for medical review, legal services, auditing function, including fraud and abuse detection and compliance programs;

4. Business planning and development, such as conducting cost management and planning related analysis relating to managing and operating the facility;

5. Business management and general administrative activities including but not limited to management activities relating to implementation of and compliance with privacy requirements, customer service, resolution of internal grievances;

6. The sale, transfer, merger or consolidation of all or part of the facility;

7. Creating de-identified health information or a limited data set and fundraising for the covered entity; and

8. Marketing for which an individual authorization is not required.

i. Fundraising activities. We may contact you to raise funds for our use. We may, without your written authorization, use or disclose limited health information to a professional fundraiser or related foundation for purposes of fundraising for our benefit. The limited health information that we may use or disclose to a professional fundraiser or related foundation is demographic information relating to you and dates of health care provided to you by us. We cannot use or disclose any other form of health information to a professional fundraiser or related foundation without your written authorization. If you do not want our agencies to contact you for these fundraising purposes, you must notify the Catholic Charities’ Agency Privacy Officer at the address of the Agency set forth at the beginning of this Notice.

ii. Marketing. With certain limited exceptions, your written authorization is required for us to engage in marketing activities. The exceptions for which we may use or disclose health information for marketing purposes without your written authorization are:

(a) communications made by us to describe the services we provide;

(b) communications made by us in connection with services provided to you by us;

(c) communications made by us for case management or care coordination for you or to direct or recommend alternative treatments, therapies, health care providers or settings of care to you;

(d) a face-to-face communication made by a member of our staff to you; or

(e) the provision by us to you of a promotional gift of nominal value.

B. Uses or disclosures made pursuant to your verbal agreement.

We may use or disclose your health information, pursuant to your verbal agreement, for purposes of releasing information to persons involved in your care as described below.

1. Uses and disclosures to individuals involved in your care or for notification purposes. We may disclose to a family member, other relative, or a close personal friend, or any other person identified by you, health information directly relevant to such person’s involvement with your care or who helps pay for your care. We may also use and disclose health information to notify or to assist in the notification of a family member, a personal representative of you or another person responsible for your care of your location, general condition, or death. If you are present at the time of such disclosure or otherwise available prior to such disclosure and you have the capacity to make decisions, we may only make such use or disclosure of your health information under this section if we obtain your verbal agreement or we provide you with an opportunity to object to the disclosure and you do not express an objection or we reasonably infer from the surrounding circumstances and based on our professional judgment that you do not object to the disclosure. If you are not present for or there is no opportunity for you to agree or object to the use or disclosure or you do not have the capacity to make decisions, we may make the use or disclosure under this section if we determine, based on our professional judgment, that the disclosure is in your best interests. In addition, we may use or disclose health information to a public or private entity authorized by law or organized to assist in disaster relief efforts, for the purpose of coordinating with such organization, for purposes of notifying your family or friends involved in your care about your condition, status or location. Any use or disclosure in connection with disaster relief purposes will comply with the requirements of this section except if we determine, based on the exercise of our professional judgment, that these requirements interfere with the organization's ability to respond to the emergency situation.

C. Uses or disclosures permitted by law

Certain state and federal laws and regulations either require or permit us to make certain uses or disclosures of your health information without your permission. These uses or disclosures are generally made to meet public health reporting obligations or to ensure the health and safety of the public at large. The uses or disclosures which we may make pursuant to these laws and regulations include the following:

1. Business Associates. Sometimes we engage other individuals or organizations to perform certain functions and activities on our behalf. These individuals and organizations are our business associates. We may use and disclose to a business associate or we may allow a business associate to create or receive health information on its behalf for our use without your authorization. However, we are required to obtain a written assurance from our business associates that they will use and disclose your health information only as permitted by law. We may engage business associates for purposes of claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing and practice management. In addition, we may engage business associates to perform legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services to or for our benefit.

2. Legal Representative. We may use or disclose health information to your legal representative. A legal representative is an individual under law who has the authority to act on your behalf in making health care decisions. A legal representative includes a health care agent authorized pursuant to a written health care proxy or a court appointed guardian with authority to make health care decisions for you. Under certain circumstances, we may elect not to use or disclose information to your personal representative if:

   (a)  We reasonably believe that you have been or may have been subject to domestic violence, abuse or neglect by such individual or treating the individual as your personal representative could endanger you; and

(b)  If in the exercise of our professional judgment, we decide it is not in your best interests to treat the individual as your personal representative.

Whistleblowers and Work Force Member Crime Victims. Our employees or business associates may disclose health information if, in good faith, they believe that we have engaged in conduct that is unlawful or otherwise violates professional or clinical standards or that the care, services or conditions provided by us endangers one or more of our clients, employees or the public, provided that such disclosure by our employees or business associates is to a health oversight agency or public health authority or to an attorney retained by such individual(s) for purposes of determining their legal options with regard to our conduct described in this section. In addition, our employees may disclose health information about you to a law enforcement official if you are the suspected perpetrator of a crime, provided that the information disclosed relates to:

(a)  your name and address;

(b)  your date of birth and place of birth;

(c)  your social security number;

(d)  blood type and RH factor;

(e)  type of injury;

(f)  date and time of treatment;

(g)  date and time of death, if applicable;

(h)  a description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair, scars and tattoos.

Public health activities. We may use or disclose your health information to public health authorities or governmental authorities that are authorized by law to receive and collect health information for the purpose of preventing or controlling disease, injury or disability. In connection with FDA regulated products and activities we may use or disclose your health information to individuals or organizations under the jurisdiction of the FDA, such as product manufacturers. If we use or disclose your health information to report a suspected or actual abuse, neglect or domestic violence involving you, we will promptly inform you of such report except where we believe, in the exercise of our professional judgment, that informing you would place you at risk of serious harm or we would be informing your personal representative and we reasonably believe that your personal representative is responsible for the abuse, neglect or other injury and we determine, in the exercise of our professional judgment, that such disclosure would not be in your best interest. Such activities that we may use or disclose your health information include, but are not limited to:

(a) To report births and deaths;

(b) To report suspected or actual abuse, neglect, or domestic violence involving a child or an adult;

(c) To report adverse reactions to medications or problems with health care products;

(d) To notify individuals of product recalls; and

(e) To notify an individual who may have been exposed to a disease or may be at risk for spreading or contracting a disease or condition.

Health oversight activities. We may use or disclose your health information to a health oversight agency that is authorized by law to conduct health oversight activities. These oversight activities may include audits, investigations, inspections, or licensure and certification surveys. These activities are necessary for the government to monitor the persons or organizations that provide services to individuals and to ensure compliance with applicable state and federal laws and regulations.

Judicial or administrative proceedings. We may use or disclose your health information to courts or administrative agencies charged with the authority to hear and resolve lawsuits or disputes. We may disclose your health information pursuant to a court order, a subpoena, a discovery request, or other lawful process issued by or on behalf of the other person involved in the dispute, but only if efforts have been made to (i) notify you of the request for disclosure or (ii) obtain an order protecting your health information.

Worker’s compensation. We may use or disclose your health information to worker’s compensation programs when your health condition arises out of a work-related illness or injury.

Law Enforcement official. We may use or disclose your health information in response to a request received from a law enforcement official for the following purposes:

(a) In response to a court order, subpoena, warrant, summons or similar lawful process;

(b) To identify or locate a suspect, fugitive, material witness, or missing person;

(c) Regarding a victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;

(d) To report a death that we believe may be the result of criminal conduct;

(e) To report criminal conduct at our facility;

(f) In emergency situations, to report a crime, the location of the crime and possible victims, or the identity, description, or location of the individual who committed the crime.

Coroners, medical examiners, or funeral directors. We may use or disclose your health information to a coroner or medical examiner for the purpose of identifying a deceased individual or to determine the cause of death. We also may use or disclose your health information to a funeral director for the purpose of carrying out his/her necessary activities.

Organ procurement organizations or tissue banks. If you are an organ donor, we may use or disclose your health information to organizations that handle organ procurement, transplantation, or tissue banking for the purpose of facilitating organ or tissue donation or transplantation.

Research. We may use or disclose your health information for research purposes under certain limited circumstances. Because all research projects are subject to a special approval process, we will not use or disclose your health information for research purposes until the particular research project for which your health information may be used or disclosed has been approved through this special approval process. However, we may use or disclose your health information to individuals preparing to conduct the research project in order to assist them in identifying residents with specific health care needs who may qualify to participate in the research project. Any use or disclosure of your health information which may be done for the purpose of identifying qualified participants will be conducted onsite at agencies. In most instances, we will ask for your specific permission to use or disclose your health information if the researcher will have access to your name, address or other identifying information.

To avert a serious threat to health or safety. We may use or disclose your health information when necessary to prevent or lessen a serious and imminent threat to the health or safety of you or other individuals. Any such use or disclosure would be made solely to the individual(s) or organization(s) that have the ability and/or authority to assist in preventing the threat.

Military and veterans. If you are a member of the armed forces, we may use or disclose your health information as required by military command authorities.

National security and intelligence activities. We may use or disclose your health information to authorized federal officials for purposes of intelligence, counterintelligence, and other national security activities, as authorized by law.

Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may use or disclose your health information to the correctional institution or to the law enforcement official as may be necessary (i) for the institution to provide you with health care; (ii) to protect the health or safety of you or another person; or (iii) for the safety and security of the correctional institution.

III. Uses or disclosures made pursuant to your written authorization.

EXCEPT FOR USES AND DISCLOSURES FOR PURPOSES OF TREATMENT, PAYMENT OR HEALTH CARE OPERATIONS AND FOR PURPOSES WHICH ARE PERMITTED OR REQUIRED BY LAW AS IDENTIFIED ABOVE, WE MAY ONLY USE OR DISCLOSE YOUR HEALTH INFORMATION PURSUANT TO YOUR WRITTEN AUTHORIZATION. You have the right to revoke a written authorization at any time as long as your revocation is provided to us in writing. If you revoke your written authorization, we will no longer use or disclose your health information for the purposes identified in the authorization. You understand that we are unable to retrieve any disclosures that we may have made pursuant to your authorization prior to its revocation. Examples of uses or disclosures that may require your written authorization include the following:

(a) A request to provide certain health information to a pharmaceutical company for purposes of marketing;

(b) A request to provide your health information to an attorney for use in a civil litigation claim; or

(c) A request to provide your health information for purposes of including you on a mailing list.

We may not condition the provision of services to you on the provision of an authorization, except under limited circumstances.

IV. Your rights regarding your health information.

You have the following rights regarding your health information that we create and/or maintain:

A.   Right to inspect and copy. You have the right to inspect and copy health information that may be used to make decisions about your care. Generally, this includes medical and billing records, but does not include psychotherapy notes, information compiled in reasonable anticipation of or for use in a criminal, civil or administrative action or proceeding or if prohibited by law under the clinical laboratory improvement amendments of 1988.

To inspect and copy your health information, you must submit your request in writing to the Catholic Charities’ Agency Privacy Officer at the address of the Agency set forth at the beginning of this Notice. If you request a copy of the information, we may charge a fee for the costs of copying, mailing, or other supplies associated with your request.

We may deny your request to inspect and copy your health information in certain limited circumstances. If you are denied access to your health information, except in circumstances where the denial is non-reviewable, you may request that the denial be reviewed. Another professional selected by our agency will review your request and the denial. The person conducting the review will not be the person who initially denied your request. We will comply with the outcome of this review.

Non-reviewable denials occur when:

1. The protected health information is specifically exempted from access (psychotherapy notes, compiled information for use in a criminal, civil or administrative action or proceedings and prohibited by law under clinical laboratory improvement amendments of 1988);

2. When acting under the direction of a correctional institution, the provider denies an inmate’s request to obtain a copy of protected health information if obtaining such copy would jeopardize the health, safety, security, custody or rehabilitation of the individual or of other inmates, or the safety of any officer, employee or other person at the correctional institution or responsible for the transporting of inmates;

3. During the course of research that includes treatment, a health care provider may temporarily suspend access to protected health information while the research is in progress, provided the individual has agreed to denial of access when consenting to participate in the research that includes the treatment, and the health care provider has informed the individual that the right of access will be reinstated upon completion of the research;

4. Where the protected health information is contained in records that are subject to the Federal Privacy Act; and

5. Where the protected health information was obtained from someone other than the health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.

B. Right to request an amendment. If you feel that the health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for our agencies.

To request an amendment, your request must be made in writing and submitted to the Catholic Charities’ Agency Privacy Officer at the address of the Agency set forth at the beginning of this Notice. In addition, you must provide us with a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

1. was not created by us, unless the person or entity that created the information is no longer available to make the amendment;

2. is not part of the health information kept by or for our agencies;

3. is not part of the information which you would be permitted to inspect and copy; or

4. is accurate and complete.

We will provide you with written notice of either our acceptance of your request for amendment or of our denial of your request for amendment. If we accept the amendment, we will request from you the identification of and your agreement to have us notify relevant persons with which the amended health information needs to be shared. Such relevant persons include persons that you have identified as having received health information about you and needing the amendment and persons, including our business associates, that we know have your health information that is the subject of the amendment and that may have relied or could foreseeably rely on such information to your detriment.

C. Right to an accounting of disclosures. You have the right to request an accounting of the disclosures that we have made of your health information. Disclosures not subject to the accounting requirements, besides disclosures for treatment, payment and health care operations include:

(a) disclosures to you;

(b) incidental disclosures as a by-product of a permitted use or disclosure;

(c) pursuant to an authorization;

(d) to persons involved in the individual’s care or other notification purposes (see Section II(B));

(e) for national security or intelligence purposes;

(f) for correctional institutions or law enforcement officials under certain circumstances set forth at Section 164.5 1(k)(5); or

(g) as part of a limited data set.

To request an accounting of disclosures, you must submit your request in writing to the Catholic Charities’ Agency Privacy Officer at the address of the Agency set forth at the beginning of this Notice. Your request must state a time period which may not be longer than six (6) years prior to the date of your request and may not include dates before April 14, 2003. Your request should indicate in what form you want to receive the accounting (for example, on paper or via electronic means). The first accounting that you request within a twelve (12)-month period will be free. For additional accountings, we may charge you for the costs of providing the accounting. We will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.

D. Right to request restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the health information we disclose about you to someone, such as a family member or friend, who is involved in your care or in the payment of your care or for notification purposes as set forth at Section II(B). For example, you could ask that we not use or disclose information regarding a particular service that you received.

We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide emergency treatment to you and, where such emergency treatment is provided by a health care provider other than us, we will request such other provider not to further use or disclose the information.

To request restrictions, you must make your request in writing to Catholic Charities’ Agency Privacy Officer at the address of the Agency set forth at the beginning of this Notice. In your request, you must tell us (a) what information you want to limit; (b) whether you want to limit our use, disclosure or both; and (c) to whom you want the limits to apply (for example, disclosures to a family member).

We may terminate this agreement with regard to a restriction on the use or disclosures of protected health information. We may terminate this agreement with regard to restrictions if you agree to or request the termination in writing, you orally agree to the termination and the oral agreement is documented or we inform you that we are terminating the agreement and that such termination is only effective with respect to protected health information created or received after we inform you.

E. Right to request confidential communications. You have the right to request that we communicate with you about services provided to you in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing to the Catholic Charities’ Agency Privacy Officer at the address of the Agency set forth at the beginning of this Notice. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

F. Right to a paper copy of this notice. You have the right to receive a paper copy of this notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. To obtain a paper copy of this notice, contact the Catholic Charities’ Agency Privacy Officer at the address of the Agency set forth at the beginning of this Notice.

V. Complaints

If you believe that your privacy rights have been violated, you may file a complaint in writing with our agency or with the Office of Civil Rights in the US Department of Health and Human Services. To file a complaint with our agency, please contact the Catholic Charities’ Agency Privacy Officer at the address of the Agency set forth at the beginning of this Notice. If there are remaining questions or concerns after you receive the Agency’s response to your complaint, you may contact the Catholic Charities' Chief Privacy Officer at 40 N. Main Avenue, Albany, NY 12203, (518) 453-6550.

WE WILL NOT RETALIATE AGAINST YOU IF YOU FILE A COMPLAINT.

VI. Changes to this Notice

We will promptly revise and distribute this Notice whenever there is a material change to the uses or disclosures, your individual rights, our legal duties, or other privacy practices stated in this notice. We reserve the right to change this Notice and to make the revised or new Notice provisions effective for all personal health information already received and maintained by the agencies as well as for all personal health information we receive in the future. We will post a copy of the current Notice in our agencies' lobbies and on the Catholic Charities web site (www.ccrcda.org). In addition, we will make the revised or new Notice available upon request to clients and others on or after the effective date of the revision.

top ^