DETAILED NOTICE OF PRIVACY PRACTICES

Effective April 14, 2003 (Revised 05/2024)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

It is very important that you understand how your data is kept and how it may be shared with others. You get a copy of this Notice to keep for yourself. We are required by law tell you about our legal duties and privacy practices, as well as how we maintain the privacy of protected health information. We are required to abide by the terms of the notice currently in effect. We may change the terms of this notice at any time. When we change the notice, it will affect all protected health information we maintain. You may get a copy of the new notice in the reception area or online at our website.

This policy applies to all workforce members at all Hiawatha Valley Mental Health Center locations and all current programs. Some parts also apply to companies that act on our behalf with whom we have a Business Associate Agreement and, if they have subcontractors who have access to your data, some applies to them also.

There are a variety of federal and state laws and regulations that protect the data about you at this center. You can be assured that every effort is taken to comply – physically, electronically, and procedurally – to keep your information safe. When state laws protect you more than federal laws, we will follow the state law.

Our policy has always been to keep your records safe. Your records tell what treatments and tests you have had and what decisions have been made and also include things like your name and address and account balances. This is called protected health information and is not publicly available.

Current facility policies, inspection findings of state and local health authorities, and further explanation of the written statement of rights is available to patients, their guardians, or your chosen representative upon reasonable request to the administrator or other designated staff person.

Permitted Uses and Disclosures (Without your permission)

In most cases in Minnesota, your written approval is needed for us to use or share your health information; however, Federal law allows us to do this without your permission sometimes.

We will only share the minimum amount needed of your health information for each situation. Following is a more detailed explanation with some examples.

Treatment

We may use or share information about you to treat your mental health and coordinate care. When treating you, we ask for your written permission to share your information with healthcare providers caring for you outside of our facilities. For example, your therapist may talk to your psychiatrist about your case, a physician caring for you may need your current information, or we may give information about you to an emergency room in a medical emergency. Sometimes, this may be done through a health information exchange or record locator service. We may also call you to provide appointment reminders, unless you tell us not to.

Minnesota law protects your mental health privacy rights more than HIPAA, so in most cases we will need your permission and will have you sign an Authorization to Release Information before talking to someone who is not providing for your care at HVMHC and before sending your information out to anyone.

Payment

We may use or share information in order to bill and collect payment; for example, for insurance eligibility or coverage. Your insurance company may ask for records to determine if your treatment is medically necessary, and we ask you to sign an authorization to send these. You can request we not inform your insurance company of your appointment if you pay for the appointment in full first. We may use a collection agency if bills are not paid.

Healthcare Operations

We may use or share your information to help improve quality of care or services. For example, we may use your information to evaluate the performance of our staff treating you, for cost-savings programs, or conducting audits and compliance programs, including fraud, waste, and abuse investigations. We may share your information with a contracted business associate (for example, a computer programmer, document shredder, etc.); their contract requires they also protect your privacy.

Some companies we hire have rare, incidental disclosures, such as janitorial services, and they sign a privacy agreement.

Additional Uses and Disclosures (Without your permission)

As Required by Law and Legal Proceedings – examples:

  • In response to a court order or judicial or administrative proceedings or, in certain cases, in response to a subpoena or other lawful process
  • To comply with Workmen’s Compensation laws and similar legal programs
  • Inmates – to treat inmates in a correctional facility, for health and safety of client or other inmates, officers, or employees of the facility, or those transporting clients. (Inmates do not have a right to receive this NPP.)
  • Food and Drug Administration – reporting adverse drug events, product defects or problems, etc.
  • As required by the S. Department of Health and Human Services regarding our HIPAA compliance
  • Health Oversight and Public Health – for activities authorized by law, such as audits, investigations, and inspections by government agencies that oversee the healthcare system, government funded programs, other regulatory programs, and civil rights laws, as well as to control disease, injury, or disability.
  • Military Activity and National Security – If you are in the Armed Forces: 1) for activities deemed necessary by military command authorities; 2) for determination of your eligibility for benefits by the VA; or 3) to foreign military authority if you are a member of that service. We may also disclose to authorized federal officials for conducting national security and intelligence activities, including protective services to the President or others legally authorized.
  • Abuse or Neglect – We may disclose your protected health information to a public health authority authorized by law to receive reports of child abuse or neglect or if you have been the victim of abuse, neglect, or domestic violence to the governmental entity or agency authorized to receive such information.
  • Coroners, funeral directors, organ donation – for identification, determining cause of death, etc.
  • To law enforcement when legal requirements are met:
  • For legal processes and otherwise as required by law
  • For limited information requests to identify or apprehend an individual
  • About victims of a crime
  • For suspicion that death has occurred as a result of criminal conduct
    • If a crime occurs on our property
    • For a medical emergency (off our property) where a likely crime has occurred
    • To avert a serious threat to health or safety
    • For research when approved by any applicable waivers or a Review Board.

You May Decide if We Share Your Information (Other permitted and required uses and disclosures that may be made with your consent, authorization, or opportunity to object)

You have the opportunity to object to the use or disclosure of all or part of your protected health information. If you are not present or able to object, such as in a life-or-death emergency situation, then we may, using professional judgement, determine whether the disclosure is in your best interest. In this case, only the minimum necessary will be shared.

Minnesota Law allows certain minor children the right to request data about them be kept from their parents.

With family or others involved in your care while you are present

Unless you object, we may use and share your information with a member of your family or close friend or other person you identify as it directly relates to that person’s involvement with your healthcare, such as bringing someone in with you to see your provider. We will not make the disclosure if you object or if we are unsure if you would object.

We will ask you to sign an Authorization for Release of Information to communicate with them outside of your presence.

Limited Uses and Disclosures When You Are Not Present

In Emergencies

We may use or disclose protected health information to notify or assist in notifying a family member, personal representative, or any other person that is responsible for your care, but only the minimum information necessary, such as of your location, your general condition, or death.

Using our professional judgement, we may tell an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or others involved in your healthcare.

Appointment Reminders

We may call, email, or text you to remind you of your appointment. You must approve text reminders in writing and supply us a cell phone number to send the reminder to.

Hiawatha Valley Mental Health Center does not sell, rent, or lease its client lists or mobile data to third parties for marketing purposes.

Other Forms of Treatment

We may call or write to you to tell you about other treatment options.

Prescription

If a family member comes to pick up your prescription for you, we will give it to them, unless you have told us not to.

Other Uses and Disclosures are not Permitted without Your Authorization

We must have your written authorization to use or share your health information for reasons not covered by this Notice. If you do authorize us to use or share your health information and then change your mind, you have the right to tell us to stop, in writing, at any time. Please understand that we are unable to take back any uses or disclosures that were made before you changed your mind.

Psychotherapy notes (Not normal session notes) require you to sign a specific Release of Information before we can release them, unless we are defending ourselves in a legal action you bring against us.

Substance Use Disorder information also requires a Release of Information, unless it is to the court who ordered your services for a medical emergency, or research, or program evaluation purposes.

Your Privacy Rights

  • Right to Request Restrictions You have the right to request restrictions on our uses and disclosures of your health information; however, we may refuse to accept the restriction.
  • Right to instruct HVMHC to not share information about your treatment with your insurance company when you pay for your appointment with cash.
  • Right to Request Confidential Communications You have the right to request that we communicate with you confidentially; for example, to call you at a certain phone number or to send mail to a different address. This request must be in writing. We will make every attempt to honor your request.
  • Right to Inspect and Copy Your Health Information Your request must be in writing. If you request a summary to aid in your understanding; there will be a charge to create a summary. We may deny your request to access records and, if so, you may request a review of the denial; however, we will make every attempt to honor your request.
  • Right to Request an Amendment of Your Health Information You have the right to request an amendment to your health information. Your request must be in writing to our Medical Records Department and must provide a reason for the amendment. We may deny your request and, if so, you may submit a statement of disagreement; however, we will make every attempt to honor your request.
  • Right to Request an Accounting of Disclosures of Your Health Information You have the right to request an accounting of our disclosures of your health information for purposes other than treatment, payment, and healthcare operations. We will make every attempt to honor your request. We are not required to provide an accounting for disclosures for more than six years prior to the date of your request.
  • Right to Obtain a Paper Copy of the Notice Privacy Practices if you first received this notice electronically. We will give this to you upon request.
  • Right to Breach Notification We are required to notify you by first-class mail or by email (if you indicated a preference to receive information by e-mail) of any breaches of confidentiality within 60 days of discovery of the breach. Such notice shall include a brief description of the breach and the information involved, steps you should take to protect yourself from harm, the action we are taking to investigate the breach, and contact information to obtain additional information.
  • Right to Complain If you believe your privacy rights have been violated, you may file a written complaint with Hiawatha Valley Mental Health Center’s Executive Director Erik Sievers at 420 E Sarnia St. Ste 2100, Winona, MN 55987, 507-454-4341, or with the Secretary of the Department of Health & Human Services at 612-296-3971. We will not retaliate against you for filing a complaint.

Contact Information

You may contact our Compliance Coordinator if you have questions or would like more information about this Notice by mail at: 420 E Sarnia St. Ste 2100, Winona, MN 55987, or by phone at: 507-454-4341.