THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

Effective Date: January 2023

The Community Mental Health Partnership of Southeast Michigan (CMHPSM) is part of a region that includes the following organizations:

• Lenawee County Community Mental Health Authority
• Livingston County Mental Health Authority
• Monroe Community Mental Health Authority
• Washtenaw County Community Mental Health

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

The privacy practices in this notice apply to all staff, students and volunteers and to all contract providers in our region. CMHPSM and its providers are required under the Federal Health Insurance Portability and Accountability Act (HIPAA) of 1996, to protect your privacy, follow the privacy practices described in this Notice, and give you a copy of this Notice.

OUR PLEDGE REGARDING PROTECTED HEALTH INFORMATION

We understand that health information about you is personal. We are committed to protecting it. When you contact or receive services from an agency within our provider network, a record is typically created. We create this record to provide you with quality care and to comply with certain legal and payment requirements. This record contains “demographic information” such as; name, telephone number, social security number, birth date, and health insurance information. This record also contains other information related to your services such as; any health problems you may have, your plan of care, and information about your treatment, including diagnosis, goals for treatment, progress, etc. We refer to this information as “Protected Health Information” or “PHI.”, and it is used for many purposes.

This notice will tell you about the ways in which physical and behavioral health information about you may be used and disclosed. It tells you what our responsibilities are and what your rights are regarding the use and disclosure of your health information.

We are required by law to:

• make sure that PHI that identifies you is kept private,
• notify you if there is a breach of your PHI,
• give you this notice or our legal duties and privacy policies concerning your PHI and
• follow the terms of the notice that are currently in effect.

General Information About Privacy

Community Mental Health Partnership of Southeast Michigan and its providers, who are a part of our region, are able to share health information about you for the purpose of healthcare coordination without a release. Under the rules of HIPAA and the Michigan Mental Health Code, CMHPSM can also use and disclose protected health information, with certain limits and protections, for treatment, payment and health care operations without a release. If you give us permission to disclose your medical record, or parts of it, you may change your mind about this at any time and cancel (revoke) your permission, but you must let us know this in writing, either by signing a revocation form or giving us a signed written statement that cancels your permission. If you revoke your authorization, this will only apply to future disclosures and not ones that have already been disclosed.

CMHPSM and its providers do not release any information regarding substance use disorder treatment records or HIV/AIDS status without your signed permission, unless required to do so by law. Disclosures regarding these areas are subject to additional federal and state laws. Substance use treatment records are specifically protected under Federal Law 42 CFR Part 2.

There are additional laws that may further protect your private information such as the Michigan Mental Health Code.

In the event that a breach of your PHI is discovered, you will be notified as required by law. A breach occurs when your PHI has been used or disclosed in ways not permitted by law.

HOW WE MAY USE AND DISCLOSE MEDICAL INFORMATION ABOUT YOU WITHOUT YOUR AUTHORIZATION

The following categories describe different ways that we may use and disclose mental health and/or medical information.

For Treatment. We may use and disclose information about you to coordinate, provide and manage your health care and any other related services. This may include coordination of management with another person, like a doctor or therapist. Information about you may be shared with staff, students or volunteers, and with contract providers or regional staff who may be involved in your or your family’s treatment. For example, a staff person may need to review your record in order to respond to your emergency. We may also use your health information to remind you about an appointment or to provide information about treatment options or other health-related benefits and services that may be of interest to you.

For Payment. We may use and disclose information about you so that the treatment and services you receive may be billed to and payment may be collected from you, an insurance company or a third party. For example, we may need to give your health plan information about the treatment you receive so that your health plan will pay us or reimburse you for treatment. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.

For Health Care Operations. We may use and disclose information about you in order to maintain or improve services. These uses and disclosures are necessary to make sure that all our consumers receive quality care. For example, we may use information to review our treatment and services and to evaluate the performance of our staff. We may also combine information about many consumers to decide what additional services should be offered, what services are not needed and whether certain new treatments are effective. We may also disclose information to clinicians, doctors, nurses, students and other personnel who work for the agency for review and learning purposes.

Business Associates. There are some services provided in our organization through contracts with business associates. For example, the nurse may have to send your blood to a laboratory for testing prior to giving you a medication. The lab is not a part of the agency, but we will have a business relationship with the lab. When any services are contracted, we may disclose your health information so they may perform the job we’ve asked them to do and bill you or your health plan. To protect your health information, however, we require the business associate to appropriately safeguard your information.

Coordination of Care. Your health information may be used and disclosed, as needed, to coordinate and manage your mental health and related services by one or more providers involved in your treatment. For example, a staff of community mental health may provide information about you when submitting referrals to providers related to your services.

Research. Under certain circumstances, CMHPSM may disclose your health information to researchers in ways usually related to public health and research only if their research proposal includes protocols to hide your identify and to ensure the privacy of your health information. The research project and its procedures must be approved by a CMHPSM review board where we must meet many more conditions under the law before we can use your information for those purposes. For more information on this, go to the following website: http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.

CMHPSM has a research policy that can be accessed at the following location:

Food and Drug Administration (FDA). We may disclose to the FDA health information relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.

As Required by Law: We are sometimes required to disclose some of your information without your signed authorization if state or federal laws say we must do so. Such disclosures are usually related to one of the following:

• Medical Emergency. In the event of a medical emergency, we may not be able to give you a copy of this Privacy Notice until after you receive care.
• Public Health Activities. To a public health authority that is required by law to receive the information in order to prevent, control or report disease, injury, disability, or death.
• Medical Examiner. To help identify a deceased person or to determine the cause of death.
• Abuse or Neglect. To alert state or local authorities if we believe you or another person are a victim of child or adult abuse, neglect, or domestic violence.
• Serious Threat to Health or Safety. To give information about you to alert authorities or medical personnel to prevent a serious threat to your health and safety or that of another person or of the public.
• Health Oversight. To comply with health oversight agencies for things like audits, civil or administrative reviews, proceedings, inspections, investigations, licensing activities or to prove we are complying with federal privacy laws or other healthcare oversight activity.
• Judicial or Administrative Proceedings. To respond to a court or administrative order, or a subpoena or for risk management purposes.
• Law Enforcement. To disclose your health information in connection with a criminal investigation by a federal, state or local law enforcement agency or disclose it to authorized federal officials who provide protective services for the President or other persons or report crime on agency premises.
• Organizations Involved in Your Care. If you are a Medicaid enrollee, we may disclose PHI about you to another service provider involved in your care. This would include healthcare data available to providers through the state database.
• Research. We may disclose your health information to researchers only if their research proposal includes protocols to hide your identity and to ensure the privacy of your health information. The research project and its procedures must be approved by a CMHPSM review board.
• Business Associates. There are some services provided in our organization through contracts with business associates. To protect your health information, however, we require these business associates to appropriately safeguard your information.
• Food and Drug Administration (FDA). We may disclose to the FDA health information relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.
• Special Situations. As law requires, we may disclose health information to funeral directors, coroners and medical examiners, as required by military command authorities, and for national security activities. Your mental health services information will be disclosed only as allowed by law.

MEDICAL INFORMATION THAT CAN ONLY BE SHARED WITH YOUR AUTHORIZATION

There is information about your physical and behavioral health that we can only share about you if you have given us your consent in writing to share it, and we can only share the types of information you have given us permission to share.

You can cancel this permission in writing at any time by contacting your local agency or customer services staff.

• Individuals Involved in Your Life. We may disclose PHI about you to a family member or other persons you designate if you give permission to do so.
• For Health Information Exchanges (HIE). Along with other healthcare providers in our area, we may participate in a health information exchange. An HIE is a community-wide information system used by participating healthcare providers to share health information about you for treatment coordination purposes. Should you require treatment from a participating healthcare provider who does not have your medical records or health information, that healthcare provider can use the system to gather needed health information to treat you. For example, he or she may be able to get laboratory or other test results that have already been performed or find out about the treatment that you have already received. We will include your PHI in this system only if you give us special written permission to do so. You can cancel this permission at any time by contacting your case manager or local customer services staff.
• Psychotherapy Notes. We may disclose psychotherapy notes only with your permission unless an exception applies. For example, we may disclose these notes without your permission if required or permitted by law for reasons such as preventing or lessening an imminent threat to someone’s health and safety, a state or federal audit of our organization, to defend a legal action brought by you.
• Marketing. CMHPSM is not allowed and does not participate in marketing practices. Marketing does not include our communication to you about our own products and services, or communication described above about allowable disclosures for treatment or case management purposes. If CMHPSM is ever allowed and decides to participate in marketing practices, we only if you give us special written permission to do so. You can cancel this permission at any time by contacting your case manager or local customer services staff.
• Sale of PHI. CMHPSM is not allowed and will not sell your protected health information (PHI). If CMHPSM is ever allowed and decides to participate in such selling practices, we only if you give us special written permission to do so. You can cancel this permission at any time by contacting your case manager or local customer services staff.

YOUR RIGHTS REGARDING YOUR PHYSICAL/BEHAVIORAL HEALTH INFORMATION

You have the following rights regarding physical and behavioral health information we maintain about you:

Right to Inspect and Copy. You have the right to inspect and receive a copy of information from your record that may be used to make decisions about your care. You have the right to request that the copy be provided in an electronic form or format. If the form and format you request are not readily producible, we will work with you to provide it in a reasonable electronic form or format. Usually, this includes medical and billing records, but may not include psychotherapy notes.

To review and have a copy of information from your record you must submit your request in writing. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.

We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed by contacting your case manager or local customer services staff. The person conducting the review will not be the person who denied your request and we will comply with the outcome of the review.

Right to Amend Your Record. If you believe that your personal health information or treatment record is incorrect or that an important part of it is missing, you have the right to ask us to amend your treatment record including adding your own statement in you record. You must submit your request and your reason for the request in writing.

Right to an Accounting of Disclosures. You have the right to request an “accounting of disclosures.” This is a list of the disclosures that we made, other than those covered in this notice, of information about you.

To request this list of accounting of disclosures, you must submit your request in writing. Your request must state a time period which may not be longer than six years prior to the date of your request. Your request should indicate in what form you want the list (for example, on paper or electronically). Disclosures you authorized in writing, routine internal disclosures such as those made to staff when providing you services, and/or disclosures made in connection with payment are examples of disclosures not included in the accounting. The accounting will give the date of the disclosure, the purpose for which your PHI was disclosed, and a description of the information disclosed. If there is a fee for the accounting, you will be informed what the fee is before the accounting is done.

Right to Request Restrictions. You have the right to ask that your protected health information not be shared or request a restriction or limitation on the information we use or disclose about you. We are not required to agree to your request, but if we do agree to it, we will honor your request unless the information is needed to provide treatment to you or required by law.

If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will agree unless a law requires us to share that information.

Right to Request Confidential Communications. You have the right to request that we communicate with you in a certain way or at a certain location to keep your confidentiality. For example, you can ask that we contact you only at work or only by mail. To request confidential communications, you must make your request in writing. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to Request Someone to Act on Your Behalf. You have the right to choose someone to act on your behalf. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can act on your rights and make choices about your health information just as you would. We will make sure the person has this authority and can legally act for you before we respond to any such request.

Receiving Notice of Privacy Practices. You have the right to agree to receive this notice electronically or a paper copy. If you choose to receive this notice electronically you are still entitled to a paper copy. You can request either option from your case manager or your local customer services staff at your agency.

CHANGES TO THIS NOTICE

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. When we change this notice, the revised notice will be posted at all agency locations and on CMHPSM and CMHSP websites. This notice will contain, on the first page, on the top left side, the effective date. In addition, when you begin treatment or receive your annual information with your plan of service, we will offer you a copy of the current notice in effect and how you can access it or request more copies.

If the CMHPSM or any of the CMHSPs do not post this Notice of Privacy Practice on its website, you will be given information about what changes occurred with this notice and how to get a copy of the revised notice, within 60 days of when the changes were completed.

COMPLAINTS ABOUT PRIVACY PRACTICES

If you believe your rights have been violated, you may contact your local agency, CMHPSM, or the U.S. Department of Health and Human Services Office of Civil Rights.

Your services cannot and will not be affected in any way if you file a complaint.

To file a complaint with you can call or write:

Local Agency Information
Monroe Community Mental Health Authority
1001 S. Raisinville Road
Monroe, MI 48161
734-243-7340

CMHPSM Attention: Privacy Officer
3005 Boardwalk Dr., Suite #200
Ann Arbor, MI 48108
Local Telephone: 1-734-344-6079
Toll Free Telephone: 1-855-571-0021
Fax Number: 1-734-222-3844

To file a complaint with the Health and Human Services Office of Civil Rights you can call, write, fax, or submit through their website complaint portal:

U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Bldg.
Washington, D.C. 20201
1-877-696-6775
Toll Free Call Center: 1-800-368-1019
TTD Number: 1-800-537-7697
Email: OCRComplaint@hhs.gov
Complaint Portal: https://ocrportal.hhs.gov/ocr/cp/complaint_frontpage.jsf

For more information see the HHS OCR website: https://www.hhs.gov/hipaa/filing-a-complaint/complaint-process/index.html