disclosures
Disclosures menu
Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. WHO WE ARE
DAP Health is a federally qualified health center (FQHC) providing HIV specialty care and primary care services to adults and children who reside in the Riverside and San Diego counties and surrounding communities. This notice describes the privacy practices of DAP Health and of our clinicians, nurses, care managers, and other personnel. This notice applies to all services provided to you at any of our facilities.
II. WHY YOU NEED THIS NOTICE
DAP Health is committed to maintaining the privacy of your Protected Health Information (PHI). Your PHI includes medical information about you, such as the following: name, address, health history, symptoms, diagnoses, and past, current, and future care and services you have received from us. In general, DAP Health needs this information to provide you with the appropriate level of care, to coordinate services, and to comply with certain legal obligations. DAP Health is required by law to provide you with this notice of our legal duties and privacy practices regarding your PHI.
The Health Insurance Portability and Accountability Act (HIPAA) of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, places certain obligations upon us regarding your PHI, and requires that DAP Health keep confidential any medical information that identifies you. Any time DAP Health is permitted to or required to share your PHI with others, DAP Health will provide only the minimum amount of data necessary to respond to the need or request, unless otherwise permitted by law.
II. WHY YOU NEED THIS NOTICE
DAP Health is committed to maintaining the privacy of your Protected Health Information (PHI). Your PHI includes medical information about you, such as the following: name, address, health history, symptoms, diagnoses, and past, current, and future care and services you have received from us. In general, DAP Health needs this information to provide you with the appropriate level of care, to coordinate services, and to comply with certain legal obligations. DAP Health is required by law to provide you with this notice of our legal duties and privacy practices regarding your PHI.
The Health Insurance Portability and Accountability Act (HIPAA) of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, places certain obligations upon us regarding your PHI, and requires that DAP Health keep confidential any medical information that identifies you. Any time DAP Health is permitted to or required to share your PHI with others, DAP Health will provide only the minimum amount of data necessary to respond to the need or request, unless otherwise permitted by law.
III. USES AND DISCLOSURES OF YOUR PHI THAT DO NOT REQUIRE YOUR AUTHORIZATION
DAP Health is permitted by law to use and disclose your PHI without your written or other form of authorization under certain circumstances as described below. This means DAP Health does not have to ask you before using or disclosing your PHI to provide you with treatment, seek payment for our services, or for health care operations.
- Treatment, Payment, and Health Care Operations.
- Treatment – DAP Health may use and disclose your PHI to provide you with medical treatment or related health care services. Your PHI may be used or disclosed to our clinicians, nurses, employees, pharmacists, and other personnel who may be involved in your care. Your PHI may also be disclosed to individuals outside our facility, such as family members, friends, caregivers, clergy, nursing homes, and other health care clinicians who may be involved in your care (if you complete an Authorization for Release of Health Information form).
- Payment – DAP Health may use and disclose your PHI for our clinicians and other health care professionals to obtain payment for the medical treatment or health care services they provide you. This means DAP Health may provide your health plan or HMO with information regarding treatment you receive from us, such as X-Rays or examinations, so that DAP Health may properly be paid for such services. DAP Health may also contact your health plan or HMO about future treatment or services you may be provided to obtain approval or to find out if your health plan or HMO will pay for them.
- Health Care Operations – DAP Health may use and disclose your PHI for our internal health care operations, such as administration, planning, quality improvement, and other activities that help us provide you with quality care. For example, your PHI may be used to help us evaluate our clinicians, nurses, and employees, or to help us provide them with education and training. Your PHI may also be disclosed to and used by our administrative staff to help us coordinate your care and respond to any concerns you may have.
- Other Health Care Clinicians – DAP Health may disclose your PHI to other health care professionals where it may be required by them to treat you, to obtain payment for the services they provide you with, or for their own health care operations. Your pharmacy may release your PHI to a pharmacy benefit management organization to check your eligibility, approval, and formulary information for your prescriber.
- Organized Health Care Arrangement – DAP Health is part of an organized health care arrangement, including participants in OCHIN, Inc. A current list of OCHIN participants is available at ochin.org. As a business associate of DAP Health, OCHIN supplies information technology and related services to DAP Health and other OCHIN participants. OCHIN also engages in quality assessment and improvement activities on behalf of its participants. For example, OCHIN coordinates clinical review activities on behalf of participating organizations to establish best practice standards and assess clinical benefits derived from electronic health record systems. OCHIN also helps participants work collaboratively to improve the management of internal and external patient referrals. Your personal health information may be shared by DAP Health with other OCHIN participants or a health information exchange only when necessary for medical treatment or for the health care operations purposes of the organized health care arrangement. Health care arrangement can include, among other things, geocoding your residence location to improve the clinical benefits you receive.
Personal health information may include past, present, and future medical information and information outlined in the privacy rules. The information, to the extent disclosed, will be disclosed consistent with the privacy rules or any other applicable law, as amended. You have the right to change your mind and withdraw consent, however, the information may have already been provided as allowed by you. This consent will remain in effect until it is revoked by you in writing. If requested, you will be provided with a list of entities to which your information has been disclosed.
- Health Information Exchange Participation – DAP Health may use or disclose your PHI in connection with an electronic health information exchange (referred to hereafter as HIE) that DAP Health may participate in for your treatment, and to evaluate and improve the quality of medical care provided to all our patients. Other health care clinicians who participate in the HIE, such as clinicians, hospitals, and other health care facilities, may also have access to your information in the HIE for similar purposes, to the extent permitted by law. You have the right to opt out of, or decline to participate in, the HIE, and DAP Health will provide you with this right at the earliest opportunity. If you choose to opt out of the HIE, DAP Health will not use or disclose any of your information in connection with the HIE.
- Telehealth/Telemedicine – To better serve the needs of people in the community, health care services are now available by interactive video communications using My Chart Virtual Visit. This may help evaluate, diagnose, manage, and treat many health care problems. This process is referred to as “virtual visit,” “telemedicine,” or “telehealth.” This means you can log on to MyChart from home and may be evaluated and treated by a health care provider or specialist from another location, such as the clinic. This may be different from the type of consultation with which you are familiar.
- Health Oversight Activities – DAP Health may disclose your PHI to a health oversight agency for oversight activities authorized by law, including audits; administrative, civil, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight. For example, DAP Health may disclose your PHI to the Center for Medicare and Medicaid Services to assist with audits or investigations designed for ensuring compliance with government health care programs such as Medicare or Medicaid.
- Disclosures to Relatives, Close Friends, Caregivers – DAP Health may disclose your PHI to family members and relatives, close friends, caregivers, or other individuals you may identify, as long as DAP Health:
- Obtains your agreement in writing with a signature on an authorization for release of health information form.
- Provides you the opportunity to object to the disclosure, and you do not object.
- DAP Health reasonably infers that you would not object to the disclosure.
If you are not present or, due to your incapacity or an emergency, you are unable to agree to or object to a use or disclosure, DAP Health may exercise its professional judgment to determine whether such use or disclosure would be in your best interest. For situations in which DAP Health would disclose information to a family member, other relatives, or a close friend, DAP Health would disclose only information DAP Health staff believes is directly relevant to that person’s involvement with your care, or payment related to your care. DAP Health will also disclose your PHI to notify, or assist with notifying, such persons of your location, general condition, or death. You may at any time request that DAP Health NOT disclose your PHI to any of these individuals.
- Public Health Activities – DAP Health may disclose your PHI for certain public health activities, as required by law, including:
- To report health information to public health authorities for the purpose of preventing or controlling disease, injury, or disability.
- To report certain immunization information, where required by law, such as to the state immunization registry or to your child’s school.
- To report births and deaths.
- To report child abuse to public health authorities or other government authorities authorized by law to receive such reports.
- To report information about products and services under the authority of the U.S. Food and Drug Administration, such as reactions to medications.
- To notify you and other patients of recalls of any product or medication that may affect you.
- To alert a person who may have been exposed to a communicable disease or who may otherwise be at risk of contracting or spreading a disease or condition.
- To report information to your employer, as required under laws addressing work-related illnesses and injuries or workplace medical surveillance.
- Victims of Abuse, Neglect, Domestic Violence – In cases where DAP Health has reason to believe you are or may be a victim of abuse, neglect, or domestic violence, DAP Health may disclose your PHI to the proper governmental authority, including social or protective service agencies that are authorized by law to receive such reports.
- Judicial and Administrative Proceedings – DAP Health may disclose your PHI pursuant to a court order, subpoena, or other lawful process in a judicial or administrative proceeding. For example, DAP Health may disclose your PHI in a lawsuit you have initiated against another for compensation or damage for personal injuries you received, or DAP Health may disclose your PHI to that person or their insurance carrier.
- Law Enforcement Officials – DAP Health may disclose your PHI to police or other law enforcement officials as may be required or permitted by law or pursuant to a court order, subpoena, or other lawful process. For example, DAP Health may disclose your PHI to police to identify a suspect, fugitive, material witness, or missing person. DAP Health may also disclose your PHI to police where it may concern a death DAP Health believes is a result of criminal conduct, or due to criminal conduct within our premises. DAP Health may also disclose your PHI where it would be necessary in an emergency to report a crime, identify a victim of a crime, or identify or locate the person who may have committed a crime.
- Decedents – DAP Health may disclose your health information to medical coroners for purposes of identifying or determining cause of death, or to funeral directors for them to carry out their duties as permitted or required by law. DAP Health may make relevant disclosures to the deceased’s family and friends under the same circumstances such disclosures were permitted when the patient was alive – that is, when these individuals were involved in providing care or payment for care and the clinician is unaware of any expressed preference to the contrary.
- Workers Compensation – DAP Health may use or disclose your PHI to the extent necessary to comply with state law for workers’ compensation or other similar programs. For example, regarding a work-related injury you received.
- Research – DAP Health will ask for your written authorization for any use or disclosure of your PHI for research purposes. However, DAP Health may use or disclose your PHI under certain circumstances without your written authorization where our research board has waived the authorization requirement.
- Fundraising Communications – DAP Health may disclose to our fundraising staff certain demographic information about you, and certain other limited information. You have a right to opt out of receiving these communications and may do so at any time, via the electronic opt out notice in the communication.
- Health or Safety – DAP Health may use or disclose your PHI where necessary to prevent or lessen the threat of imminent, serious physical violence against you or another identifiable individual, or a threat to the public.
- Military and Veterans – For members of the armed forces and veterans, DAP Health may disclose your PHI as may be required by military command authorities. If you are a foreign military personnel member, your PHI may also be released to appropriate foreign military authority.
- Specialized Government Functions – DAP Health may disclose your PHI to governmental units with special functions under certain circumstances. For example, your PHI may be disclosed to any of the U.S. armed forces or the U.S. Department of State.
- National Security and Intelligence Activities – DAP Health may disclose your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
- Protective Services for the President and Others – DAP Health may disclose your PHI to authorized federal officials for purposes of providing protection to the president of the United States, other authorized persons, or foreign heads of state, or for purposes of conducting special investigations.
-
Inmates – If you are an inmate in a correctional institution, or otherwise in the custody of law enforcement, DAP Health may disclose your PHI to the correctional institution or law enforcement official(s) where necessary:
- For the institution to provide health care.
- To protect your health and safety or the health and safety of others.
- For the safety and security of the correctional institution.
- Organ and Tissue Procurement – In the event you are an organ donor, DAP Health may disclose your PHI to organizations that facilitate or procure organs, tissue, or eye donations or transplantation.
- As Required by Law – DAP Health may use or disclose your PHI in any other circumstances, other than those listed above, where DAP Health would be required by state or federal law or regulation to do so.
-
Reproductive Health Information – If a request for PHI for reproductive health information (e.g., abortion or contraceptive access) is made to DAP Health for health oversight activities, law enforcement, or legal proceedings, we do not require patient authorization but will require a signed attestation from the requesting party confirming that the information will not be used for a prohibited purpose.
DAP Health places strict limitations on reproductive health disclosures. We will not use or disclose your protected health information (PHI) to law enforcement, courts, or other third parties:- To investigate or impose liability on individuals, health care providers, or others for seeking, obtaining, providing, or facilitating reproductive health care that is lawful in the state where it was provided.
- For criminal, civil, or administrative proceedings related to reproductive health care that is lawful under the circumstances.
- To identify or track individuals based on their reproductive health care choices.
IV. USES AND DISCLOSURES OF YOUR PHI THAT REQUIRE YOUR WRITTEN AUTHORIZATION
In general, DAP Health will need your specific written authorization on our HIPAA authorization form to use or disclose your PHI for any purpose other than those listed above in Section III. For example, for us to send your information to your life insurance company, you would need to sign our HIPAA authorization form and tell us what information you want to send. DAP Health would also need you to indicate on the HIPAA authorization form that DAP Health may send you marketing materials.
DAP will seek your specific written authorization for at least the following information unless the use or disclosure would be otherwise permitted or required by law:
- Sexually Transmitted Infection Information – DAP Health must obtain your specific written authorization prior to disclosing any information that would identify you as having or being suspected of having a sexually transmitted disease. DAP Health may use and disclose information related to sexually transmitted diseases without obtaining your authorization only when permitted by law, including, for example, any disclosure of such information to your clinician.
- Drug and Alcohol Information – DAP Health must obtain your specific written authorization prior to disclosing information related to drug and alcohol treatment or rehabilitation under certain circumstances, such as where you received drug or alcohol treatment at a federally funded treatment facility or program.
-
Behavioral Health Information
- Patients Seeing a Mental Health Clinician – For psychotherapy and psychiatric medication management patients, current law allows your mental health clinician to share information to coordinate your care with other clinicians within DAP Health, such as your primary care clinician. Mental health diagnoses, including diagnoses of substance use disorders, are available to other DAP Health clinicians to ensure your continuity of care.
-
Exceptions to Confidentiality for Mental Health Clinicians
- When a person is gravely disabled and is in danger of serious physical harm resulting from failure to provide for oneself essential human needs of health and safety, staff can disclose essential information necessary for care.
- Where there is reasonable suspicion of danger to self, others, or others’ personal or private property.
- Where a member of your family informs your clinician that you are seriously intending to harm another.
- When you are seeking psychological services to enable yourself or someone else to commit a crime.
- When there is reasonable suspicion of child abuse or neglect.
- When there is reasonable suspicion of elder abuse.
- Where else allowed or mandated by law.
- Patients Seeing a Chemical Dependency Clinician – For patients seeing a clinician who specializes in chemical dependency treatment, your written authorization is required before any information about your treatment with that clinician can be disclosed. If we believe it is important to share your information with another clinician, such as your psychotherapist, your psychiatrist, or your primary care clinician, we will request that you sign a time-limited authorization to share that information. You may revoke that authorization at any time. Authorizations may last one year and need to be reauthorized subsequently.
-
Exceptions to Confidentiality for Chemical Dependency Clinicians
- Where there is a medical emergency and where the information is essential to the patient’s safety.
- Where there is reasonable suspicion of a crime occurring on program premises or against program personnel.
- Where there is reasonable suspicion of child abuse or neglect.
- Where there is a court order that complies with the standards for disclosure of chemical dependency information.
- For administrative oversight, approved research, audits, or program evaluation.
- Where else allowed or mandated by law.
- Genetic Information – DAP Health must obtain your specific written authorization prior to using or disclosing your genetic information for treatment, payment, or health care operations purposes. DAP Health may use or disclose your genetic information, or the genetic information of your child, without your written authorization only where it would be permitted by law, including, for example, the following: disclosure pursuant to newborn screening requirements established by state or federal law; disclosure authorized by order of a court of competent jurisdiction; and disclosure for the purpose of identifying bodies.
- Information Related to Emancipated Treatment of a Minor – If you are a minor who sought emancipated treatment from us, such as treatment related to your pregnancy or treatment related to your child, or for a sexually transmitted disease, DAP Health must obtain your specific written authorization prior to disclosing any of your PHI related to such treatment to another person, including your parent(s) or guardian(s), unless otherwise permitted or required by law.
- Marketing Activities – DAP Health must obtain your specific written authorization to use any of your PHI to provide you with marketing materials by mail, email, or telephone. However, DAP Health may provide you with marketing materials face to face without obtaining authorization, in addition to communicating with you about services or products that relate to your treatment, case management or care coordination, and alternative treatments, therapies, clinicians, or care settings. For certain additional activities in which DAP Health would receive remuneration, directly or indirectly, from a third party in exchange for your PHI, DAP Health must obtain your specific written authorization prior to doing so. However, DAP Health would not require your authorization for activities that include treatment, public health or research purposes, grants, or federal programs. If you do provide us with your written authorization, you have a right to revoke your authorization at any time. If you wish to revoke your authorization, please contact our Health Information Management Department.
V. YOUR RIGHTS REGARDING YOUR PHI
- Right to Inspect/Copy PHI – You have the right to inspect and request copies of your PHI. For copies of PHI that DAP Health maintains in any electronic designated record set, you may request a copy of such PHI in a reasonable electronic format. DAP Health is obligated to provide you with access to your PHI in the form and format requested, if it is readily producible in such form or format; or, if not, in a readable hard/printed copy form or such other form and format as agreed to by you and DAP Health. However, under limited circumstances, you may be denied access to a portion of your records. For example, if your clinician (or other licensed health care professional) believes certain information contained within your medical record could be harmful to you, DAP Health would not release that information to you. DAP Health may charge you a reasonable fee for (1) the amount of our reasonable labor costs for copying the requested PHI (whether in paper or electronic form) and (2) supplies to create the paper copy or electronic media (if you request that the electronic copy be provided on portable media).
- Right to Accounting of Disclosures – You may request an accounting of certain disclosures DAP Health made of your PHI within six (6) years prior to your request. Regarding certain disclosures DAP Health has made of your PHI from an electronic designated record set, you may request an accounting within three (3) years prior to the date of your request. The first accounting you request within twelve (12) months is free. Any subsequently requested accountings may result in a reasonable charge for the accounting statement. DAP Health will respond to your request in writing within thirty (30) days of receipt.
-
Right to Request Additional Restrictions – You have the right to request restrictions be placed on our use and disclosure of your PHI, such as:
- For treatment, payment, and health care operations.
- To individuals involved in your care or payment related to your care.
- To notify or assist individuals to locate you or obtain information about your condition.
- Right to Confidential Communications – You have the right to make a reasonable written request to receive your PHI by alternative and reasonable means of communication or at alternative reasonable locations.
-
Right to Request Amendment – You may request that DAP Health amend or change your PHI by contacting our Health Information Management department. DAP Health will comply with your request unless:
- DAP Health believes the information is accurate and complete.
- DAP Health maintains the information you have asked us to change but did not create or author it. For example, your medical records were provided to us by another health care clinician and DAP Health incorporated this information into your medical record that DAP Health maintains.
- The information is not part of the designated record set or otherwise unavailable for inspection.
- Right to Revoke Authorization – You may at any time revoke your authorization, whether it was given verbally or in writing. You must revoke your authorization in writing by contacting DAP’s Health Information Management department. Any revocation will be granted except to the extent DAP Health may have taken action in reliance upon your authorization.
- Right to Notice of Breach – DAP Health takes very seriously the confidentiality of our patients’ information, and is required by law to protect the privacy and security of your PHI through appropriate safeguards. As required by law, DAP Health will notify you in the event a breach occurs involving, or potentially involving, your unsecured PHI, and inform you of what steps you may need to take to protect yourself.
- Right to Receive Paper Copy of this Notice – You may at any time request a paper copy of this notice, even if you previously agreed to receive this notice by email or other electronic format. Please contact our Health Information Management department to obtain a copy of this notice.
VI. INFORMATION REGARDING THE LENGTH AND DURATION OF THIS NOTICE
This notice is effective as of March 6, 2014. DAP Health may change this notice at any time. Changes to this notice will apply to all PHI DAP Health maintains. However, if DAP Health does change this notice, DAP Health will only make changes to the extent permitted by law. DAP Health will also make any revised notice available to you by posting it in a place where all individuals seeking services from us will be able to read the notice, as well as on our website at daphealth.org. In addition to reviewing the notice on our website, you may obtain a printed copy of the notice from our Health Information Management department.
VII. COMPLAINTS/ADDITIONAL INFORMATION
If you feel that your privacy rights may have been compromised, or if you have any additional questions regarding this notice, you may contact us with any concerns or for additional information regarding our privacy practices by contacting DAP Health’s privacy officer in writing, as follows:
You may also contact the secretary of the Department of Health and Human Services, specifically, the Office of Civil Rights of the U.S. Department of Health and Human Services. If you wish to file a written complaint with the Office of Civil Rights, please contact DAP Health’s privacy officer so that they can provide you with their contact information. DAP Health will not retaliate against you if you file a complaint with us or the Office of Civil Rights.