Notice of Privacy Practices (HIPAA)

This notice describes how health information about you may be used and disclosed, your rights with respect to your health information, how you can get access to your health information, and how to file a complaint concerning a violation of the privacy or security of your health information or of your rights concerning your information. You have a right to a copy of this notice (in paper or electronic form) and to discuss it with THE PRIVACY OFFICER if you have any questions.  Please review it carefully.

This Notice of Privacy Practices (“Notice”) describes how Bournewood Health Systems (“Bournewood”, “we”, or “us”) may use and disclose your protected health information (“PHI”) and to notify you of your rights with respect to your PHI in the possession of Bournewood. PHI is health information about you which someone may use to identify you and which we keep or transmit in electronic, oral, or written form.  This includes information such as your name, contact information, past, present or future physical or mental health or medical condition, and related health care services.

This Notice applies to all the PHI that we generate and to substance use treatment-related records under 42 U.S.C. §290dd-2 and 42 C.F.R. Part 2 (“Part 2”) that we receive or maintain. We also follow the confidentiality protections of Part 2 for such records.  To the extent applicable state law is even more stringent than Part 2 on how we may use or disclose your health information, we will comply with the more stringent state law.

We are legally required to maintain the privacy and security of your PHI under the Health Insurance Portability and Accountability Act (“HIPAA”) and other federal and state laws.  We also follow state privacy laws, including when they are stricter or more protective of your PHI than federal law.  We are also required to abide by the terms of this Notice and to provide you a copy of it.  We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

We will limit the disclosure of information subject to this Notice to that information which is necessary to carry out the purpose of the use or disclosure. We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind

USES AND DISCLOSURE OF PHI

The law permits or requires us to use or disclose your PHI for various reasons, which we explain in this Notice. We have included some examples, but we have not listed every permissible use or disclosure. When using or disclosing PHI or requesting your PHI from another source, we will make reasonable efforts to limit our use, disclosure, or request about your PHI to the minimum we need to accomplish our intended purpose.

Uses and Disclosure of PHI for Treatment, Payment, and Health Care Operations

Treatment: We may use and disclose your PHI in the course of providing, coordinating, or managing your health care and any related services. This includes use and disclosure between doctors, nurses, technicians, medical students, or hospital personnel involved in your care.  For example, we might disclose your PHI to a physician to whom you have been referred to ensure that the physician has the necessary information to diagnose or treat you.

In addition, we may disclose your PHI from time-to-time to another physician or health care provider who, at the request of your physician, becomes involved in your care by providing assistance with your health care diagnosis or treatment to your physician.

Billing and payment: We may use or disclose your PHI, as needed, to bill and obtain payment for your health care services. This may include certain activities that your health insurance plan may undertake before it approves or pays for the health care services we recommend for you such as; making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity, and undertaking utilization review activities. For example, obtaining approval for a hospital stay may require that your relevant PHI be disclosed to the health plan to obtain approval for the hospital admission.

Running our organization: We may use or disclose, as needed, your PHI to run our practice, improve your care, and contact you when necessary. These activities include, but are not limited to, quality improvement activities, employee review activities, training of students, licensing, marketing and conducting or arranging for other business activities. For example, we may disclose your protected health information to students that see patients at the hospital. 

We may share your PHI with third party “business associates” that perform various activities (e.g., billing, transcription services) for the practice. Whenever an arrangement between our hospital and a business associate involves the use or disclosure of your PHI, we will have a written contract that contains terms that will protect the privacy of your protected health information.

Other Uses and Disclosures That May Be Made WITHOUT Your Consent, Authorization, or Opportunity to Object

In addition to using or disclosing PHI for treatment, payment and health care operations, Bournewood may use and disclose PHI without your written consent, authorization, or providing you an opportunity to object under the following circumstances as permitted or required by applicable law. However, laws governing sensitive information (including behavioral health information, substance use disorder information, and HIV status) may limit these disclosures.

Required By Law: We may use or disclose your PHI to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, as required by law, of any such uses or disclosures.

Public Health: We may disclose your PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive that information. The disclosure will be made for the purpose of controlling disease, injury or disability. 

Communicable Diseases: We may disclose your PHI, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.

Health Oversight: We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.

Abuse or Neglect: We may disclose your PHI to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your protected health information if we believe that you have been a victim of abuse, neglect or domestic violence to that governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of federal and state laws.

Food and Drug Administration: We may disclose your PHI to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, track products; to enable product recalls; to make repairs or replacements, or to conduct post marketing surveillance, as required.

Legal Proceedings: We may disclose PHI in the course of any judicial or administrative proceedings, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), in certain conditions in response to a subpoena, discovery request or other lawful process.

Law Enforcement: We may also disclose PHI, so long as applicable legal requirements are met, for law enforcement purposes. These law enforcement purposes include, for example, legal processes and otherwise required by law, limited information requests for identification and location purposes, pertaining to victims of a crime, suspicion that death has occurred as a result of criminal conduct, in the event that a crime occurs on the premises of Bournewood, and medical emergency (not on Bournewood’s premises) and it is likely that a crime has occurred.

Coroners, Funeral Directors, and Organ Donation: We may disclose PHI to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose PHI to a funeral director, as authorized by law, in order to permit the funeral director to carry out their duties. We may disclose such information in reasonable anticipation of death. PHI may be used and disclosed for cadaveric organ, eye or tissue donation purposes.

Research: We may disclose your PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.

Criminal Activity: Consistent with applicable federal and state laws, we may disclose your PHI, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.

Workers’ Compensation: Your PHI may be disclosed by us as authorized to comply with workers’ compensation laws and other similar legally established programs.

Inmates: We may use or disclose your PHI if you are an inmate of a correctional facility and your physician created or received your PHI in the course of providing care to you.

Required Uses and Disclosures: Under the law, we must make disclosures to you and when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with privacy regulations under HIPAA.

Uses and Disclosures to Which you May Object

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, please contact us and we will make reasonable efforts to follow your instructions.

Others Involved in Your Healthcare: Unless you object, we may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person’s involvement in your health care. We may share your PHI with these persons if you are present or available before we share your PHI with them and you do not object to our sharing your PHI with them, or we reasonably infer that you would not object to this. If you are not present or unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based upon our professional judgment. This could include sharing information with a family member, personal representative or any other person that is responsible for your care of your location, general condition or death. 

Patient Directories: Unless you object, we may include your information in a patient directory.  

Emergencies: We may use or disclose your PHI in an emergency treatment situation. If this happens, your physician shall try to obtain your consent as soon as reasonably practicable after delivery of treatment. 

Disaster Relief: We may use or disclose your PHI to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care.

Communication Barriers: We may use and disclose your PHI if your physician or another physician in the hospital attempts to obtain your consent from you but is unable to do so due to substantial communication barriers and the physician determines, using professional judgment, that you intend to consent to use or disclosure under the circumstances.

Fundraising: We may use or disclose your PHI to contact you for fundraising purposes.  You have the right to opt-out of receiving such fundraising communications.  

Other Uses and Disclosures of PHI for Which Authorization is Required

Other types of uses and disclosures of your PHI not described above will be made only with your written authorization/consent, which you have the right to revoke in writing. However, revocation does not apply to PHI or substance use disorder records that have already been used or disclosed with your permission. In addition, we are required to obtain your specific authorization/consent for the following purposes: (i) most uses and disclosures of psychotherapy notes; (ii) use and disclosure of PHI which result in our receiving financial payment from a third party whose product or services is being marketed (except compensation that merely covers our cost of reminding you to take and refill your medication or otherwise communicate about a drug or biologic that is currently prescribed to you); or (iii) disclosures that constitute a sale of PHI.

Use and Disclosure of Substance Use Disorder Records Subject to Part 2: Federal law provides heightened confidentiality of substance use disorder (“SUD”) patient records and places additional restrictions on the use or disclosure of such PHI. A SUD is a cluster of cognitive, behavioral, and physiological symptoms indicating that the individual continues using the substance (such as drugs or alcohol, but not including tobacco or caffeine) despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal. To the extent Bournewood offers a program covered by such laws, it complies with the federal Confidentiality of Substance Use Disorder Patient Records laws and regulations that protect information regarding SUD diagnosis, treatment and referral for treatment. See 42 U.S.C 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for Federal regulations. Additionally, if Bournewood receives records containing information regarding SUDs, these records may also be protected by Part 2. Where Part 2 is applicable, Bournewood will not disclose your SUD records, that you are enrolled in a Part 2 program, or any other information that would identify you as having or having had a SUD to any other program (collectively “SUD Records”) except in compliance with this Section.

We will obtain your written consent to use and disclose your SUD Records unless we are permitted to use and disclose SUD Records without your written consent consistent with Part 2. The following categories describe the ways that we may use and disclose your SUD Records without your written consent under Part 2.

Medical Emergencies. We may disclose your SUD Records to medical personnel to the extent necessary to meet a bona fide medical emergency in which your prior written consent cannot be obtained or in which we are closed and unable to provide services or obtain your prior written consent during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time as we resume operations. We will obtain your authorization prior to disclosing your information for non-emergency treatment. Facility may also disclose your SUD Records to medical personnel of the Food and Drug Administration (FDA) who assert a reason to believe that your health may be threatened by an error in the manufacturer, labeling, or sale of a product under the FDA jurisdiction, and that your SUD Records will be used for the exclusive purpose of notifying you or your physicians of potential danger.
Scientific Research. Under certain circumstances, we may use and disclose your SUD Records without your consent for research purposes. Generally, we would first obtain your written consent; however, in certain circumstances, we may be permitted to use or disclose your SUD Records for research purposes without your consent to the extent permitted by HIPAA, FDA and HHS regulations related to human subject research where a waiver of consent has been granted.
Management and Financial Audits and Program Evaluation. Under certain circumstances, we may use or disclose your SUD Records for purposes of the performance of certain program financial and management audits and evaluations. For example, we may disclose your identifying information to any federal, state, or local government agency that provides financial assistance to the Part 2 program or is authorized by law to regulate the activities of Part 2 program. We may also use or disclose your identifying information to qualified personnel who are performing audit or evaluation functions on behalf of any person that provides financial assistance to the Part 2 program, which is a third-party payer or health plan covering you in your treatment, or which is a quality improvement organization (QIO), performing QIO review, the contractors, subcontractors, or legal representatives of such person or QIO, or an entity with direct administrative control over our program.
Public Health. We may disclose to a public health authority your SUD Records for public health purposes. However, the contents of the information from the SUD Records disclosed will be de-identified in accordance with the requirements of the HIPAA regulations, such that there will be no reasonable basis to believe that the information can be used to identify you.
Fundraising. Consistent with provisions elsewhere in this Notice, we may also use or disclose your SUD Records for fundraising purposes.

Uses and Disclosures with the Patient Consent. We may use and disclose your records when you give your consent that specifically meets the requirements of the Part 2.

Designated person or entities. We may use and disclose your SUD Records in accordance with your consent to any person or category of persons identified or generally designated in your consent. For example, if you provide written consent naming your spouse or a healthcare provider, we will share your health information with them as outlined in your consent.
Single Consent for Treatment, Payment or Healthcare Operations. We may also use and disclose your SUD Records when the consent provided is a single consent for all future uses and disclosures for treatment, payment, and healthcare operations, as permitted by the HIPAA regulations, until such time you revoke such consent in writing.
Central Registry or Withdrawal Management Program. We may disclose with your written consent your SUD Records to a central registry or to any withdrawal management or treatment program for the purposes of preventing multiple enrollments. For instance, if you consent to participating in a drug treatment program, we can disclose your information to the related program to coordinate care and avoid duplicate enrollment.
Criminal Justice System. We may disclose information from your SUD Records to those persons within the criminal justice system who have made your participation in the SUD program a condition of the disposition of any criminal proceeding against you. Your written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which consent was given. For example, if you consent, we can inform a court-appointed officer about your treatment status as part of legal agreement or sentencing conditions.
PDMPs. We may report any medication prescribed or dispensed by us to the applicable state prescription drug monitoring program if required by applicable state law. We will first obtain your consent to a disclosure of SUD Records to a prescription drug monitoring program prior to reporting of such information.

Other Uses and Disclosures.

Any SUD Record, or testimony relating the content of such SUD Records, shall not be used or disclosed in a civil, administrative, criminal, or legislative proceeding against you unless you provide specific written consent (separate from any other consent), or a court issues an appropriate order. Your SUD Records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you, Bournewood, or other holder of the SUD Record in accordance with Part 2. A court order authorizing use or disclosure of SUD Records must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the SUD Records may be used or disclosed. You may revoke your authorization at any time, but it will not affect information that we already used and disclosed. 
Part 2 does not protect information about a crime committed on Bournewood’s premises or against any Bournewood personnel or about any threat to commit such crime. Part 2 also does not prohibit the disclosure of information by Bournewood to report suspected child abuse or neglect under state law to appropriate state or local authorities. The restrictions on use and disclosure in Part 2 do not apply to communications of SUD Records between or among personnel having a need for them in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of patients with substance use disorders if the communications are within the program (or with an entity that has direct administrative control over the program) and to communications of SUD Records to a qualified service organization if needed by the qualified service organization to provide services to or on behalf of Bournewood (similar to provisions herein regarding Business Associates). To the extent applicable state law is even more stringent than Part 2 on how we may use or disclose your health information, we will comply with the more stringent state law.
Please note that if SUD Records are disclosed to us or our business associates pursuant to your written consent for treatment, payment, and healthcare operations, we or our business associates may further use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding PHI.

YOUR RIGHTS

Following is a statement of your rights with respect to your PHI and SUD Records and a brief description of how you may exercise these rights.

Get a copy of your PHI. 

You may inspect and obtain a paper or electronic copy of the PHI that we maintain about you. We may deny your request for access in certain limited circumstances allowed by law, including, for example, psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding, and PHI that is subject to law that prohibits access to PHI. Depending on the circumstances, a decision to deny access may be reviewed. Please contact the Director of Medical Records, if you have questions about access to your medical record.

We may charge a reasonable, cost-based fee for the costs of copying, mailing, or other supplies associated with your request as allowed by Massachusetts law. 

Bournewood maintains medical records for at least 20 years after the patient’s discharge or after final treatment, as required by state law; a copy of the hospital’s medical record retention policy is available upon request. 

Ask us to limit what we share.  

You can ask us not to use or share certain PHI for the purposes of treatment, payment or our operations. You may also request that any part of your health information not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice.  We may require that you submit this request in writing.  Your request must state the specific restriction requested and to whom you want the restriction to apply.

We are not required to agree to the restriction that you may request. We may say “no” to your request if it would affect your care.  But, we will agree not to disclose information to a health plan for purposes of payment or health care operations if the requested restriction concerns a health care item or service for which you or another person, other than the health plan, paid in full out-of-pocket, unless it is otherwise required by law. 

Request confidential communications.

You can ask us to communicate with you about health matters in a certain way or at a certain location.  We will accommodate reasonable requests. We may also condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. We will not request an explanation from you as to the basis for the request. Please make this request in writing to our privacy officer.

Ask us to correct your medical record.

You can ask us to correct or amend your PHI that we maintain about you that you think is incorrect or inaccurate. We may deny your request for an amendment if you ask us to amend PHI that is not part of our record, that we did not create, that is not part of a designated record set, or that is accurate and complete.  If we deny your request, we will tell you why in writing.  If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal. Please contact our privacy officer to determine if you have questions about amending your medical record.

Get a list of those with whom we’ve shared your PHI.

You can request an accounting of certain PHI disclosures that we have made during the six (6) years prior to your request for such disclosure.  This right applies to disclosures for purposes other than treatment, payment, healthcare operations, and certain other disclosures, such as any you asked us to make. We will provide one accounting a year for free, but may charge a reasonable, cost-based fee if you request another accounting within 12 months. 

If you are requesting an accounting of disclosures of SUD Records made pursuant to your written consent in the 3 years prior to the date of the request (or a shorter time period chosen by you), we will provide such accounting consistent with these HIPAA requirements and Part 2. When regulations are effective requiring such accountings pursuant to HIPAA and Part 2, we will provide a patient with an accounting of disclosures of records for treatment, payment, and health care operations only where such disclosures are made through an electronic health record and during only the 3 years prior to the date on which the accounting is requested.

Get a paper copy of this Notice.

You can request a paper copy  of this Notice at any time, even if you have agreed to receive the notice electronically. 

Choose someone to act for you.

If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI.

Make a complaint. 

You can complain to us or to the Secretary of Health and Human Services if you feel we have violated your rights.  We will not retaliate against you for filing a complaint. 

You can submit a complaint with us by contacting our privacy office at 617-676-3355 for further information about the complaint process.

You may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints.

For more information see: www.hhs.gov/ocr/privacy/hipaa/

understanding/consumers/noticepp.html.

Contact

If you have any questions about this Notice, please contact our privacy officer: 

Bournewood Health Systems

300 South St. Brookline, MA 02467

Changes to this Notice: We may change the terms of this Notice, at any time. The revised Notice will be effective for all information that we maintain at that time. The revised Notice will be available on request, in our office, and on our website.