Notice of Privacy Practices (HIPAA)

This notice describes how health information about you may be used and disclosed, your rights with respect to your health information, how you can get access to your health information, and how to file a complaint concerning a violation of the privacy or security of your health information or of your rights concerning your information. You have a right to a copy of this notice (in paper or electronic form) and to discuss it with THE PRIVACY OFFICER if you have any questions. Please review it carefully.

This Notice of Privacy Practices (“Notice”) describes how Bournewood Health Systems  (“Bournewood”, “we”, or “us”) may use and disclose your protected health information  (“PHI”) and to notify you of your rights with respect to your PHI in the possession of  Bournewood. PHI is health information about you which someone may use to identify  you and which we keep or transmit in electronic, oral, or written form. This includes  information such as your name, contact information, past, present or future physical or  mental health or medical condition, and related health care services. 

This Notice applies to all the PHI that we generate and to substance use treatment-related  records under 42 U.S.C. §290dd-2 and 42 C.F.R. Part 2 (“Part 2”) that we receive or  maintain. We also follow the confidentiality protections of Part 2 for such records. To  the extent applicable state law is even more stringent than Part 2 on how we may use or  disclose your health information, we will comply with the more stringent state law. 

We are legally required to maintain the privacy and security of your PHI under the Health  Insurance Portability and Accountability Act (“HIPAA”) and other federal and state laws.  We also follow state privacy laws, including when they are stricter or more protective of  your PHI than federal law. We are also required to abide by the terms of this Notice and  to provide you a copy of it. We will let you know promptly if a breach occurs that may  have compromised the privacy or security of your information. 

We will limit the disclosure of information subject to this Notice to that information  which is necessary to carry out the purpose of the use or disclosure. We will not use or  share your information other than as described here unless you tell us we can in writing.  If you tell us we can, you may change your mind at any time. Let us know in writing if  you change your mind 

USES AND DISCLOSURE OF PHI 

The law permits or requires us to use or disclose your PHI for various reasons, which we  explain in this Notice. We have included some examples, but we have not listed every  permissible use or disclosure. When using or disclosing PHI or requesting your PHI from  another source, we will make reasonable efforts to limit our use, disclosure, or request  about your PHI to the minimum we need to accomplish our intended purpose. 

Uses and Disclosure of PHI for Treatment, Payment, and Health Care Operations 

Treatment: We may use and disclose your PHI in the course of providing, coordinating,  or managing your health care and any related services. This includes use and disclosure between doctors, nurses, technicians, medical students, or hospital personnel involved in  your care. For example, we might disclose your PHI to a physician to whom you have  been referred to ensure that the physician has the necessary information to diagnose or  treat you. 

In addition, we may disclose your PHI from time-to-time to another physician or health  care provider who, at the request of your physician, becomes involved in your care by  providing assistance with your health care diagnosis or treatment to your physician. 

Billing and payment: We may use or disclose your PHI, as needed, to bill and obtain  payment for your health care services. This may include certain activities that your health  insurance plan may undertake before it approves or pays for the health care services we  recommend for you such as; making a determination of eligibility or coverage for  insurance benefits, reviewing services provided to you for medical necessity, and  undertaking utilization review activities. For example, obtaining approval for a hospital  stay may require that your relevant PHI be disclosed to the health plan to obtain approval  for the hospital admission. 

Running our organization: We may use or disclose, as needed, your PHI to run our  practice, improve your care, and contact you when necessary. These activities include,  but are not limited to, quality improvement activities, employee review activities, training  of students, licensing, marketing and conducting or arranging for other business  activities. For example, we may disclose your protected health information to students  that see patients at the hospital.  

We may share your PHI with third party “business associates” that perform various  activities (e.g., billing, transcription services) for the practice. Whenever an arrangement  between our hospital and a business associate involves the use or disclosure of your PHI,  we will have a written contract that contains terms that will protect the privacy of your  protected health information. 

Other Uses and Disclosures That May Be Made WITHOUT Your Consent,  Authorization, or Opportunity to Object 

In addition to using or disclosing PHI for treatment, payment and health care operations,  Bournewood may use and disclose PHI without your written consent, authorization, or  providing you an opportunity to object under the following circumstances as permitted or  required by applicable law. However, laws governing sensitive information (including  behavioral health information, substance use disorder information, and HIV status) may  limit these disclosures. 

Required By Law: We may use or disclose your PHI to the extent that the use or  disclosure is required by law. The use or disclosure will be made in compliance with the  law and will be limited to the relevant requirements of the law. You will be notified, as  required by law, of any such uses or disclosures.

Public Health: We may disclose your PHI for public health activities and purposes to a  public health authority that is permitted by law to collect or receive that information. The  disclosure will be made for the purpose of controlling disease, injury or disability.  

Communicable Diseases: We may disclose your PHI, if authorized by law, to a person  who may have been exposed to a communicable disease or may otherwise be at risk of  contracting or spreading the disease or condition. 

Health Oversight: We may disclose your PHI to a health oversight agency for activities  authorized by law, such as audits, investigations, and inspections. Oversight agencies  seeking this information include government agencies that oversee the health care  system, government benefit programs, other government regulatory programs and civil  rights laws. 

Abuse or Neglect: We may disclose your PHI to a public health authority that is  authorized by law to receive reports of child abuse or neglect. In addition, we may  disclose your protected health information if we believe that you have been a victim of  abuse, neglect or domestic violence to that governmental entity or agency authorized to  receive such information. In this case, the disclosure will be made consistent with the  requirements of federal and state laws. 

Food and Drug Administration: We may disclose your PHI to a person or company  required by the Food and Drug Administration to report adverse events, product defects  or problems, biologic product deviations, track products; to enable product recalls; to  make repairs or replacements, or to conduct post marketing surveillance, as required. 

Legal Proceedings: We may disclose PHI in the course of any judicial or administrative  proceedings, in response to an order of a court or administrative tribunal (to the extent  such disclosure is expressly authorized), in certain conditions in response to a subpoena,  discovery request or other lawful process. 

Law Enforcement: We may also disclose PHI, so long as applicable legal requirements  are met, for law enforcement purposes. These law enforcement purposes include, for  example, legal processes and otherwise required by law, limited information requests for  identification and location purposes, pertaining to victims of a crime, suspicion that death  has occurred as a result of criminal conduct, in the event that a crime occurs on the  premises of Bournewood, and medical emergency (not on Bournewood’s premises) and it  is likely that a crime has occurred. 

Coroners, Funeral Directors, and Organ Donation: We may disclose PHI to a coroner  or medical examiner for identification purposes, determining cause of death or for the  coroner or medical examiner to perform other duties authorized by law. We may also  disclose PHI to a funeral director, as authorized by law, in order to permit the funeral  director to carry out their duties. We may disclose such information in reasonable  anticipation of death. PHI may be used and disclosed for cadaveric organ, eye or tissue  donation purposes.

Research: We may disclose your PHI to researchers when their research has been  approved by an institutional review board that has reviewed the research proposal and  established protocols to ensure the privacy of your PHI. 

Criminal Activity: Consistent with applicable federal and state laws, we may disclose  your PHI, if we believe that the use or disclosure is necessary to prevent or lessen a  serious and imminent threat to the health or safety of a person or the public. We may also  disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an  individual. 

Workers’ Compensation: Your PHI may be disclosed by us as authorized to comply  with workers’ compensation laws and other similar legally established programs. 

Inmates: We may use or disclose your PHI if you are an inmate of a correctional facility  and your physician created or received your PHI in the course of providing care to you. 

Required Uses and Disclosures: Under the law, we must make disclosures to you and  when required by the Secretary of the Department of Health and Human Services to  investigate or determine our compliance with privacy regulations under HIPAA. 

Uses and Disclosures to Which You May Object 

For certain health information, you can tell us your choices about what we share. If you  have a clear preference for how we share your information in the situations described  below, please contact us and we will make reasonable efforts to follow your instructions. 

Others Involved in Your Healthcare: Unless you object, we may disclose to a member  of your family, a relative, a close friend or any other person you identify, your PHI that  directly relates to that person’s involvement in your health care. We may share your PHI  with these persons if you are present or available before we share your PHI with them  and you do not object to our sharing your PHI with them, or we reasonably infer that you  would not object to this. If you are not present or unable to agree or object to such a  disclosure, we may disclose such information as necessary if we determine that it is in  your best interest based upon our professional judgment. This could include sharing  information with a family member, personal representative or any other person that is  responsible for your care of your location, general condition or death.  

Patient Directories: Unless you object, we may include your information in a patient  directory.  

Emergencies: We may use or disclose your PHI in an emergency treatment situation. If  this happens, your physician shall try to obtain your consent as soon as reasonably  practicable after delivery of treatment. 

Disaster Relief: We may use or disclose your PHI to an authorized public or private  entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or  other individuals involved in your health care. 

Communication Barriers: We may use and disclose your PHI if your physician or  another physician in the hospital attempts to obtain your consent from you but is unable  to do so due to substantial communication barriers and the physician determines, using  professional judgment, that you intend to consent to use or disclosure under the  circumstances. 

Fundraising: We may use or disclose your PHI to contact you for fundraising purposes.  You have the right to opt-out of receiving such fundraising communications.  

Other Uses and Disclosures of PHI for Which Authorization is Required 

Other types of uses and disclosures of your PHI not described above will be made only  with your written authorization/consent, which you have the right to revoke in writing.  However, revocation does not apply to PHI or substance use disorder records that have  already been used or disclosed with your permission. In addition, we are required to  

obtain your specific authorization/consent for the following purposes: (i) most uses and  disclosures of psychotherapy notes; (ii) use and disclosure of PHI which result in our  receiving financial payment from a third party whose product or services is being  marketed (except compensation that merely covers our cost of reminding you to take and  refill your medication or otherwise communicate about a drug or biologic that is currently  prescribed to you); or (iii) disclosures that constitute a sale of PHI. 

Use and Disclosure of Substance Use Disorder Records Subject to Part 2: Federal  law provides heightened confidentiality of substance use disorder (“SUD”) patient  records and places additional restrictions on the use or disclosure of such PHI. A SUD is  a cluster of cognitive, behavioral, and physiological symptoms indicating that the  individual continues using the substance (such as drugs or alcohol, but not including  tobacco or caffeine) despite significant substance-related problems such as impaired  control, social impairment, risky use, and pharmacological tolerance and withdrawal. To  the extent Bournewood offers a program covered by such laws, it complies with the  federal Confidentiality of Substance Use Disorder Patient Records laws and regulations  that protect information regarding SUD diagnosis, treatment and referral for treatment.  See 42 U.S.C 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for  Federal regulations. Additionally, if Bournewood receives records containing information  regarding SUDs, these records may also be protected by Part 2. Where Part 2 is  applicable, Bournewood will not disclose your SUD records, that you are enrolled in a  Part 2 program, or any other information that would identify you as having or having had  a SUD to any other program (collectively “SUD Records”) except in compliance with  this Section. 

We will obtain your written consent to use and disclose your SUD Records unless we are  permitted to use and disclose SUD Records without your written consent consistent with 

Part 2. The following categories describe the ways that we may use and disclose your  SUD Records without your written consent under Part 2. 

• Medical Emergencies. We may disclose your SUD Records to medical personnel  to the extent necessary to meet a bona fide medical emergency in which your  prior written consent cannot be obtained or in which we are closed and unable to  provide services or obtain your prior written consent during a temporary state of  emergency declared by a state or federal authority as the result of a natural or  major disaster, until such time as we resume operations. We will obtain your  authorization prior to disclosing your information for non-emergency treatment.  Facility may also disclose your SUD Records to medical personnel of the Food  and Drug Administration (FDA) who assert a reason to believe that your health  may be threatened by an error in the manufacturer, labeling, or sale of a product  under the FDA jurisdiction, and that your SUD Records will be used for the  exclusive purpose of notifying you or your physicians of potential danger. 

• Scientific Research. Under certain circumstances, we may use and disclose your  SUD Records without your consent for research purposes. Generally, we would  first obtain your written consent; however, in certain circumstances, we may be  permitted to use or disclose your SUD Records for research purposes without  your consent to the extent permitted by HIPAA, FDA and HHS regulations  related to human subject research where a waiver of consent has been granted. 

• Management and Financial Audits and Program Evaluation. Under certain  circumstances, we may use or disclose your SUD Records for purposes of the  performance of certain program financial and management audits and evaluations.  For example, we may disclose your identifying information to any federal, state,  or local government agency that provides financial assistance to the Part 2  program or is authorized by law to regulate the activities of Part 2 program. We  may also use or disclose your identifying information to qualified personnel who  are performing audit or evaluation functions on behalf of any person that provides  financial assistance to the Part 2 program, which is a third-party payer or health  plan covering you in your treatment, or which is a quality improvement  organization (QIO), performing QIO review, the contractors, subcontractors, or  legal representatives of such person or QIO, or an entity with direct administrative  control over our program. 

• Public Health. We may disclose to a public health authority your SUD Records  for public health purposes. However, the contents of the information from the  SUD Records disclosed will be de-identified in accordance with the requirements  of the HIPAA regulations, such that there will be no reasonable basis to believe  that the information can be used to identify you. 

• Fundraising. Consistent with provisions elsewhere in this Notice, we may also  use or disclose your SUD Records for fundraising purposes.

Uses and Disclosures with the Patient Consent. We may use and disclose your records  when you give your consent that specifically meets the requirements of the Part 2. 

• Designated person or entities. We may use and disclose your SUD Records in  accordance with your consent to any person or category of persons identified or  generally designated in your consent. For example, if you provide written consent  naming your spouse or a healthcare provider, we will share your health  information with them as outlined in your consent. 

• Single Consent for Treatment, Payment or Healthcare Operations. We may  also use and disclose your SUD Records when the consent provided is a single  consent for all future uses and disclosures for treatment, payment, and healthcare  operations, as permitted by the HIPAA regulations, until such time you revoke  such consent in writing. 

• Central Registry or Withdrawal Management Program. We may disclose  with your written consent your SUD Records to a central registry or to any  withdrawal management or treatment program for the purposes of preventing  multiple enrollments. For instance, if you consent to participating in a drug  treatment program, we can disclose your information to the related program to  coordinate care and avoid duplicate enrollment. 

• Criminal Justice System. We may disclose information from your SUD Records  to those persons within the criminal justice system who have made your  participation in the SUD program a condition of the disposition of any criminal  proceeding against you. Your written consent must state that it is revocable upon  the passage of a specified amount of time or the occurrence of a specified,  ascertainable event. The time or occurrence upon which consent becomes  revocable may be no later than the final disposition of the conditional release or  other action in connection with which consent was given. For example, if you  consent, we can inform a court-appointed officer about your treatment status as  part of legal agreement or sentencing conditions. 

• Prescription Drug Monitoring Programs. We may report any medication  prescribed or dispensed by us to the applicable state prescription drug monitoring  program if required by applicable state law. We will first obtain your consent to a  disclosure of SUD Records to a prescription drug monitoring program prior to  reporting such information. 

Other Uses and Disclosures. 

• Any SUD Record, or testimony relating the content of such SUD Records, shall  not be used or disclosed in a civil, administrative, criminal, or legislative  proceeding against you unless you provide specific written consent (separate from  any other consent), or a court issues an appropriate order. Your SUD Records will  only be used or disclosed based on a court order after notice and an opportunity to  be heard is provided to you, Bournewood, or other holder of the SUD Record in  accordance with Part 2. A court order authorizing use or disclosure of SUD  Records must be accompanied by a subpoena or other similar legal mandate  compelling disclosure before the SUD Records may be used or disclosed. You  may revoke your authorization at any time, but it will not affect information that  we already used and disclosed. 

• Part 2 does not protect information about a crime committed on Bournewood’s  premises or against any Bournewood personnel or about any threat to commit  such crime. Part 2 also does not prohibit the disclosure of information by  Bournewood to report suspected child abuse or neglect under state law to  appropriate state or local authorities. The restrictions on use and disclosure in Part  2 do not apply to communications of SUD Records between or among personnel  having a need for them in connection with their duties that arise out of the  provision of diagnosis, treatment, or referral for treatment of patients with  substance use disorders if the communications are within the program (or with an  entity that has direct administrative control over the program) and to  communications of SUD Records to a qualified service organization if needed by  the qualified service organization to provide services to or on behalf of  Bournewood (similar to provisions herein regarding Business Associates). To the  extent applicable state law is even more stringent than Part 2 on how we may use  or disclose your health information, we will comply with the more stringent state  law. 

• Please note that if SUD Records are disclosed to us or our business associates  pursuant to your written consent for treatment, payment, and healthcare  operations, we or our business associates may further use and disclose such health  information without your written consent to the extent that the HIPAA regulations  permit such uses and disclosures, consistent with the other provisions in this  Notice regarding PHI. 

YOUR RIGHTS 

Following is a statement of your rights with respect to your PHI and SUD Records and a  brief description of how you may exercise these rights. 

Get a copy of your PHI. 

You may inspect and obtain a paper or electronic copy of the PHI that we maintain about  you. We may deny your request for access in certain limited circumstances allowed by  law, including, for example, psychotherapy notes; information compiled in reasonable  anticipation of, or use in, a civil, criminal, or administrative action or proceeding, and  PHI that is subject to law that prohibits access to PHI. Depending on the circumstances, a  decision to deny access may be reviewed. Please contact the Director of Health  Information Services, if you have questions about access to your medical record.

We may charge a reasonable, cost-based fee for the costs of copying, mailing, or other  supplies associated with your request as allowed by Massachusetts law.  

Bournewood maintains medical records for at least 20 years after the patient’s discharge  or after final treatment, as required by state law; a copy of the hospital’s medical record  retention policy is available upon request. Bournewood may destroy medical records  after the 20 year retention period without notice to the respective patient(s).  

Ask us to limit what we share.  

You can ask us not to use or share certain PHI for the purposes of treatment, payment or  our operations. You may also request that any part of your health information not be  disclosed to family members or friends who may be involved in your care or for  notification purposes as described in this Notice. We may require that you submit this  request in writing. Your request must state the specific restriction requested and to whom  you want the restriction to apply. 

We are not required to agree to the restriction that you may request. We may say “no” to  your request if it would affect your care. But, we will agree not to disclose information  to a health plan for purposes of payment or health care operations if the requested  restriction concerns a health care item or service for which you or another person, other  than the health plan, paid in full out-of-pocket, unless it is otherwise required by law.  

Request confidential communications. 

You can ask us to communicate with you about health matters in a certain way or at a  certain location. We will accommodate reasonable requests. We may also condition this  accommodation by asking you for information as to how payment will be handled or  specification of an alternative address or other method of contact. We will not request an  explanation from you as to the basis for the request. Please make this request in writing to  our Privacy Officer. 

Ask us to correct your medical record. 

You can ask us to correct or amend your PHI that we maintain about you that you think is  incorrect or inaccurate. We may deny your request for an amendment if you ask us to  amend PHI that is not part of our record, that we did not create, that is not part of a  designated record set, or that is accurate and complete. If we deny your request, we will  tell you why in writing. If we deny your request for amendment, you have the right to  file a statement of disagreement with us and we may prepare a rebuttal to your statement  and will provide you with a copy of any such rebuttal. Please contact our Privacy Officer  to determine if you have questions about amending your medical record.

Get a list of those with whom we’ve shared your PHI. 

You can request an accounting of certain PHI disclosures that we have made during the  six (6) years prior to your request for such disclosure. This right applies to disclosures  for purposes other than treatment, payment, healthcare operations, and certain other  disclosures, such as any you asked us to make. We will provide one accounting a year for  free, but may charge a reasonable, cost-based fee if you request another accounting  within 12 months.  

If you are requesting an accounting of disclosures of SUD Records made pursuant to your  written consent in the 3 years prior to the date of the request (or a shorter time period  chosen by you), we will provide such accounting consistent with these HIPAA  requirements and Part 2. When regulations are effective requiring such accountings  pursuant to HIPAA and Part 2, we will provide a patient with an accounting of  disclosures of records for treatment, payment, and health care operations only where such  disclosures are made through an electronic health record and during only the 3 years prior  to the date on which the accounting is requested. 

Get a paper copy of this Notice. 

You can request a paper copy of this Notice at any time, even if you have agreed to  receive the notice electronically.  

Choose someone to act for you. 

If you have given someone medical power of attorney or if someone is your legal  guardian, that person can exercise your rights and make choices about your PHI. 

Make a complaint.  

You can complain to us or to the Secretary of Health and Human Services if you feel we  have violated your rights. We will not retaliate against you for filing a complaint.  

You can submit a written complaint with us by contacting our Privacy Office at 617-676- 3355 for further information about the complaint process. 

You may file a complaint with the U.S. Department of Health and Human Services  Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W.,  Washington, D.C. 20201, calling 1-877-696-6775, or visiting  

www.hhs.gov/ocr/privacy/hipaa/complaints 

For more information see:  

www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html

Contact 

If you have any questions about this Notice, please contact our Privacy Officer: 

Bournewood Health Systems 

Attn: HIS Department/Privacy Office 

300 South St. 

Brookline, MA 02467 

Telephone: 617-676-3355 

Fax: 857-354-3339 

Changes to this Notice: We may change the terms of this Notice, at any time. The revised Notice will be effective for all information that we maintain at that time. The  revised Notice will be available on request, in our office, and on our website.  

This notice becomes effective on February 10, 2026. 

Revised 9/08, 1/10, 8/10, 10/10, 9/12, 5/13, 2/26