Privacy of Consumer Records – Consumer records and files shall be the property of UAC (Utah Addiction Centers) and shall be secure against loss, tampering, or unauthorized use. Confidentiality of consumer records will be ensured by restricting their availability only to those employees, agents or agencies of the program. UAC cannot guarantee confidentiality once information leaves the Center.
I. Federal Confidentiality Laws
The program is restricted in its capability to disclose privileged and protected information. This privacy of information is for current and closed records as stated in the Code of Federal Regulations 42 CFR Part 2 and the federal Health Insurance Portability and Accountability Act (HIPPA). The UAC makes every attempt to keep protected information from possible misuse. Written permission or a legal court order is required before release of records.
II. Client Confidentiality
Although unlikely, UAC will notify the client, if for any reason, the security of PHI is breached. Staff are prohibited from disclosing the admission, presence, or any other protected information regarding a client in the program.
- Media Waiver – UAC will not videotape or record a client without first obtaining the client’s written informed consent and approval from the owners of UAC.
- Access to Consumer Records – The program shall maintain confidentiality for all clients’ case records. Employees of the program shall not discuss or knowingly permit the disclosures of any information concerning the client or his/her family, directly or indirectly, to any unauthorized person. The client and any persons that the client authorizes may have access to the consumer records; however, a signed release must be completed by the client and documented with the consumer file.
- Revocation of Consent – Anytime a client chooses to revoke consent, they should be encouraged to inform the entity being revoked by telephone or in writing that they are choosing to revoke the said consent. Revocation of consent may be grounds for ‘unsatisfactory discharge’ based on clinical decision.
- Right to Request Restrictions – The client has the right to request restrictions on certain uses and disclosures of protected health information. However, UAC is not required to agree to a restriction.
- Right to Inspect and Copy – Clients have the right to inspect or obtain a copy of their mental health and billing records used to make decisions about them for as long as the PHI is maintained in the record. UAC may deny your access to PHI under certain circumstances, but in some cases you may have this decision reviewed. Upon request, UAC will discuss details of the request and denial process. There may be a fee for copying requested records.
- Right to Amend – Clients have the right to request an amendment of PHI as long as the PHI is maintained in the record. UAC may deny this request. Upon request, UAC will discuss with details of the amendment process.
- Right to an Accounting – Clients have the right to receive an accounting of disclosures of PHI for which they have neither provided consent nor authorization. Upon request, UAC will discuss details of the accounting process.
- Right to a Paper Copy – Clients have the right to obtain a paper copy of notices even if they previously agreed to receive notices electronically.
- Right to Notice with Respect to PHI – UAC is required by law to maintain the privacy of PHI and to provide clients with a notice of legal duties and privacy practices with respect to PHI.
- Protected Confidentiality – Is protected even if the request is made by someone who:
- Already has the information;
- Has other means of obtaining it;
- Has official status; and/or
- Is authorized by State law.
III. Exceptions to Client Confidentiality
- Signed consent form with proper format;
- Internal program communication;
- Client crimes on program premises;
- Research, audit, or evaluation;
- Qualified Service Organization Agreements (QSOA);
- Communications that safeguard client-identifying information;
- Serious Threat to Health or Safety – UAC may disclose confidential mental health information to any person without authorization if the person disclosing information reasonably believes that disclosure will avoid or minimize imminent danger to health or safety of self, or the health or safety of another individual;
- Court-Ordered Disclosures – If a client is involved in a court proceeding and a request is made for information about professional services provided at the UAC and/or the records thereof, such information is privileged under state law, and UAC will not release information without the written authorization of the client or their legal representative, or a subpoena of which the client has been properly notified and failed to inform UAC of opposition to the subpoena or court order. The privilege does not apply when the client is being evaluated for a third party or where the evaluation is court ordered. The client will be informed in advance if this is the case. UAC will seek legal counsel to prevent the release of court-ordered records, but may still be required to release the records. Records that must be released may no longer be “confidential;”
- Lawsuits – Consumers should be aware that if they take legislative action against the UAC, the owners, or clinicians for a personal injury, a portion of their record may become public information thus they may lose their right to confidentiality.
- Health Oversight – If the Utah State Department of Health subpoenas a member of UAC treatment team as part of its investigations, hearings or proceedings relating to the discipline, issuance or denial of licensure of state licensed mental health professionals, UAC must comply with its orders. This could include disclosing relevant mental health information;
- Worker’sCompensation – If a client files a worker’s compensation claim, with certain exceptions, UAC must make available, at any stage of the proceedings, all mental health information in UAC possession relevant to that particular injury in the opinion of the Utah Department of Labor and Industries, to an employer, representative, and the Department of Labor and Industries upon request;
- Abuse and Neglect Reporting
- Child Abuise – If staff has reasonable cause to believe that a child has suffered abuse or neglect, they are required by law to report it to the proper law enforcement agency or the Utah Department of Social and Health Services.
- Adult and Domestic Abuse – If staff have reasonable cause to believe that abandonment, abuse, financial exploitation, neglect, or sexual or physical assault of a vulnerable adult has occurred, they must immediately report the abuse to the proper law enforcement agency or the Utah Department of Social and Health Services.
IV. Privacy and Insurance Companies
Consumers that choose to use insurance as a means to cover treatment costs sign a release giving the insurance company rights to access their protected medical records. If the insurance company asks for more detailed information than usual, UAC will attempt to consult with the consumer first. If the consumer opts not to provide their insurance carrier with information, they will be required to assume all financial responsibility for treatment costs not paid by their insurance;
- Disclosures for Treatment, Payment, and Health Care Operations – UAC may use or disclose protected health information (PHI), for treatment, payment, and health care operations purposes with consent from the consumer. If UAC is asked for information for purposes outside of treatment, payment, and health care operations, UAC will obtain an authorization from the client before releasing this information. To help clarify these terms. The following are terms related to health care:
- “PHI” or Patient Health Information – refers to information in the consumer health record that could identify the client.
- “Treatment” – is when UAC provides, coordinates, or manages health care and other services related to the client’s health care. An example of treatment would be when UAC consults with another health care provider, such as a family physician or another mental health professional.
- “Payment” – is when UAC obtains reimbursement for health care services. Examples of payment are when UAC disclose PHI to a health insurer to obtain reimbursement for the client’s health care or to determine eligibility or coverage.
- “Health Care Operations” – are activities that relate to the performance and operation of the UAC. Examples of health care operations are quality assessment and improvement activities, business-related matters such as audits and administrative services, and case management and care coordination. “Use” applies only to activities within UAC such as sharing, employing, applying, utilizing, examining, and analyzing information that identifies a client.
- “Disclosure” – applies to activities outside of UAC such as releasing, transferring, or providing access to information about a client to other parties.
- “Authorization” – is written permission above and beyond the general consent that permits only specific disclosures. Uses and Disclosures Requiring Authorization. UAC may use or disclose PHI for purposes outside of treatment, payment, and health care operations when appropriate authorization is obtained.
- “Psychotherapy notes” – are notes UAC has made about conversation during a private, group, joint, or family counseling session. UAC may keep these separate from the rest of your medical record. These notes are given a greater degree of protection than PHI. Written authorization is required prior to releasing psychotherapy notes. The client may revoke all such authorizations (of PHI or psychotherapy notes) at any time, provided each revocation is in writing.
- The client may not revoke an authorization to the extent that (1) UAC has previously acted in reliance on that authorization; or (2) if the authorization was obtained as a condition of obtaining insurance coverage, and the law provides the insurer the right to contest the claim under the policy.