This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Introduction
Your privacy and protection of your protected health information (PHI) have always been of great importance to everyone who works at the May Institute. We are committed to providing you with the highest quality of care and will continue to respect the privacy and confidentiality of your health information.
On April 14, 2003, the federal Office of Civil Rights enforced new rules to ensure your right to privacy. As part of those rules, the May is obligated to provide you with this notice so that you will understand how the May will handle your health information, the May’s legal duties related to your health information and your rights with regard to your medical information. We will not release personally identifiable information about you without your permission, unless the release is to provide service you expect from us or is otherwise in accordance with the law. Even when allowed, use and disclosure are limited to the minimum amount reasonably necessary for the intended task.
Uses and Disclosures That We may make WITHOUT Your Written Consent
Protected health information means individually identifiable health information. It is information that is provided orally, on paper, or in electronic form on the computer about your past, present or future physical or mental health or condition; the provision of your health care; or the past, present or future payment for your health care services. PHI also includes any information that identifies you such as your name, date of birth, or social security number.
The May uses your PHI within its system and shares your health information outside its system in order to give you excellent care. The May uses and shares your PHI for other reasons that can include medical research, training new health care workers and payment for services. This notice will tell you how the May uses and shares your PHI for these and other purposes. It will also tell you when we need to get your specific permission to do so.
1. Treatment, Payment and Health Care Operations
Except where prohibited by state or federal laws, we may use and share your PHI for treatment, payment and health care operations. We do not need to ask for your specific permission to do these things, as explained below:
Treatment means providing, coordinating or managing supports and related services by one or more health care providers. Under HIPAA, for example, we may disclose PHI to a case manager, who is responsible for coordinating your supports, or we may disclose PHI to another “covered entity” ( e.g., other health care providers such as your primary care physician or a laboratory) working outside of the May.
Payment includes activities such as billing, confirming insurance coverage and utilization review. Under HIPAA, for example, we may provide PHI about you to someone who helps pay for your care, disclose PHI about you to a health oversight agency for activities authorized by law, or share your PHI in order to determine if your insurance plan will approve additional visits to a therapist.
Health Care Operations are activities that are needed to operate the May’s facilities and carry out its mission, including quality improvement activities, audits, cost management and customer service. Under HIPAA, for example, we may provide information to quality improvement staff, or to students or interns while training them.
2. Uses and Disclosures of your PHI for Other Purposes
We may legally use and/or share your health information with others in the following areas without your specific permission:
- Fundraising Activities: we may use or disclose basic contact information such as your name and address, and the dates you were provided service, to contact you about raising money for our programs, services and operations;
- Treatment Alternatives: we may use or disclose basic contact information to contact you about treatment alternatives;
- Health-related Benefits: we may use or disclose basic contact information to provide communication about other health-related benefits and services that may be of interest to you;
- Research: we may disclose your PHI to researchers when their research has been approved by an Institutional Review Board or a similar research board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI;
- As required by Federal, state or local law;
- When necessary to avert a serious threat to health or safety;
- When requested by a correctional institution or law enforcement official, if you are an inmate or under the custody of law enforcement;
- When requested by military command or the Department of Veterans Affairs for current or former military personnel;
- As required by public health organizations;
- As needed to assist with disaster relief;
- When required by legal proceedings;
- As necessary for law enforcement activities;
- When required for purposes of national security;
- As authorized by and as necessary to comply with workers’ compensation laws;
- When required by a medical examiner after death; or
- To remind you of appointments.
The May will keep a log of such disclosures and you may request a listing of any disclosures that we have made of your PHI for these purposes.
3. Uses and Disclosures You May Ask be Limited, or Request Not be Made
Disclosures to Family and Friends may be made to people who have been identified as being involved in your treatment or payment for your care. However, you may ask that any part (or all) of your health information not be disclosed to family members or friends. If you are unable to make health care decisions, we will disclose your health information to a person designated to participate in your care such as your guardian or in accordance with a validly executed advance directive.
Uses and Disclosures for which we Must Obtain Your Authorization
In some cases, we may not use or disclose your PHI unless we obtain your authorization to do so. The authorization, which must be in writing, must specify who will use, disclose and/or receive the PHI; the purpose of the use or disclosure; the date of the authorization; the date the authorization expires; and your signature. You may revoke in writing such authorization at any time. Once you revoke such authorization, we will not make any further uses or disclosures of your health information under that authorization, unless we already have taken an action relying upon the uses or disclosures you previously authorized.
As a general rule, we must obtain your authorization for the release of certain records, including:
- HIV/AIDs or sexually transmitted disease information;
- genetic testing information;
- any psychotherapy notes; and
- information concerning substance abuse.
We are permitted to release such information without your permission when the disclosure is:
- permitted by a court order; or
- made to medical personnel in a medical emergency or to qualified personnel for research, audit or program evaluation purposes.
Your Rights Regarding Your Health Information
The following is a list of your rights regarding your PHI. You should submit any requests to exercise these rights in writing to the program providing you services. Please be advised, we may charge you a fee for copying or other expenses related to your request. Should you have any questions regarding these rights or need additional information, please contact the Privacy Office (see contact information below). Your rights include:
Right to Inspect and Copy - You have the right to request an opportunity to review and copy your PHI. Usually, this includes clinical and billing records, but not psychotherapy notes.
Right to Amend - For as long as we keep records about you, you have the right to request that we amend your PHI. Usually, this includes clinical and billing records, but not psychotherapy notes. In your written request, you must tell us what information you want to amend and why you believe the information is incorrect or inaccurate.
Right to an Accounting of Disclosures - You have the right to request that we provide you with an accounting of disclosures that we have made of your PHI in the six (6) years prior to the date of your request (you may not request an accounting of any such disclosures made prior to April 14, 2003). This list will not include disclosures of your health information made for purposes of treatment, payment, and health care operations, or disclosures made pursuant to your authorization.
Right to Request Restrictions - You may request that we restrict the uses and disclosures of your PHI concerning treatment, payment, or health care operations. However, we are not required to agree to the restriction(s) you request.
Right to Request Confidential Communications - You have the right to request that we communicate with you about your health care only in a certain location or through a certain method. To request such a confidential communication, you must make your request to the program providing services. We will accommodate all reasonable requests. You do not need to give us a reason for the request, but your request must specify how or where you wish to be contacted.
Right to a Paper Copy of this Notice - You have the right to obtain a paper copy of this Notice of Privacy Practices at any time.
Right to Complain – If you believe your privacy rights have been violated, you may complain to:
May Institute
Privacy Office
41 Pacella Park Drive
Randolph, MA 02368
(781) 440-0400
and/or
Office for Civil Rights
U.S. Department of Health & Human Services
JFK Federal Building - Room 1875
Boston, MA 02203
(617) 565-1340; (617) 565-1343 (TDD)
OCRComplaint@hhs.gov
We will take no retaliatory action against you should you complain about our Privacy Practices. If you believe you have been retaliated against, please contact the Privacy Office.
Right To Amend Notice
The May Institute reserves the right to change this Privacy Notice without notice or your consent.
Questions
If you have any questions or concerns about this Privacy Notice or its implementation, please contact:
May Institute - Privacy Office
41 Pacella Park Drive
Randolph, MA 02368
781-440-0400
