Notice of Privacy Practices

Arizona Department of Health Services/Division of Behavioral Health Services (ADHS/DBHS)

Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Duty to Safeguard Your Protected Health Information.

“Protected Health Information” or “PHI” means individually identifiable information about your past, present, or future health or condition; the provision of behavioral health care to you; or payment for the behavioral health care; and that is included in enrollment, payment, claims adjudication, and other records maintained by ADHS/DBHS or used by ADHS/DBHS to make decisions about you.

The ADHS/DBHS must safeguard the privacy of your PHI. The purpose of this Notice of Privacy Practices is to provide you with information about the legal duties and privacy practices of ADHS/DBHS regarding your PHI. ADHS/DBHS may change its policies at any time, however, before any material revisions to our policies are made, we will change our Notice of Privacy Practices and deliver the revised Notice as required by law. The revised Notice will be effective for all PHI that we maintain at that time. Except when required by law, a material change to any term of the Notice may not be implemented before the effective date of the Notice that contains the material change.

You can obtain a copy of the current ADHS/DBHS Notice or Privacy Practices at any time by accessing our website at www.azdhs.gov/bhs. You also can request a copy of our Notice or get more information about how we safeguard your PHI by calling the ADHS/DBHS HIPAA Privacy Official listed on page 5.

How We May Use and Disclose Your Protected Health Information.

The ADHS/DBHS uses or discloses PHI for a variety of reasons. We have a right, with some limitations, to use or disclose your PHI for purposes of treatment, payment, and behavioral health care operations. For other uses or disclosures, ADHS/DBHS must have your written authorization, unless required by law. For those situations where a written authorization is required and you have provided it to ADHS/DBHS, you do have the right to revoke your authorization at any time after providing it. The revocation of your authorization must be in writing to the ADHS/DBHS HIPAA Privacy Official listed on page 5 of this Notice. If we disclose your PHI to a business associate in order for that entity to perform a function on our behalf, we must have in place an agreement signed by the business associate requiring the business associate and its subcontractors to extend the same degree of privacy protection to your PHI that ADHS/DBHS must apply. And, as stated above, we are permitted to make some uses or disclosures without your authorization or consent.

The following pages offer more description and some examples of our potential uses or disclosures of your PHI. If a use or disclosure of PHI is not described in this Notice of Privacy Practices, we will not make that use or disclosure without your written authorization.

Uses and Disclosures Relating to Treatment, Payment, or Behavioral Health Care Operations.

Generally, we may use or disclose your PHI as follows:

• For treatment: We may use or disclose your PHI to administer, coordinate, and manage your behavioral health care and any related services. For example, some of your PHI may be shared with applicable ADHS/DBHS staff. Some of your PHI also may be shared with outside entities that perform services related to your treatment. We may communicate with health professionals and state agency workforce members to plan your care and treatment or for consultation. Your information may also be shared for treatment and care with the Regional Behavioral Health Authorities (RBHAs), Tribal Regional Behavioral Health Authorities (TRBHAs), and their subcontracted providers.
• For payment: We may use or disclose your PHI in order to bill and collect payment for your behavioral health care services delivered to you. For example, we may release portions of your PHI to third-party payers, including applicable insurance companies and Arizona’s Medicaid Agency, the Arizona Health Care Cost Containment System (AHCCCS). We may use portions of your PHI to bill and collect payment from the RBHAs or TRBHAs or make payment for your behavioral health care to the RHBAs, TRBHAs, their subcontracted providers, and other providers. Some of your PHI may be used by the ADHS Financial Services.
• For behavioral health care operations: We may use or disclose your PHI for behavioral health care operations. For example, applicable ADHS/DBHS workforce members may share the minimum amount of PHI necessary to assess the care and outcomes in your case. We may use your PHI in reviewing and improving the quality, efficiency and cost of care. Since ADHS/DBHS is part of the Arizona behavioral health system established by law, we may disclose your PHI to other entities within the system, such as AHCCCS, health professionals, and/or state agency workforce members involved in your care or for consultation purposes. We also may disclose your PHI to RBHAs, TRBHAs, and their subcontracted providers, or to ADHS workforce members as permitted by law for behavioral health care operations.

Uses and Disclosures of PHI Not Requiring Authorization.

Unless otherwise prohibited by law, we may use or disclose your PHI without consent or authorization in the following circumstances:

• When required by law: We may disclose PHI as required by state or federal law. Examples include disclosures: 1) for reporting suspected abuse, neglect, exploitation, or domestic violence; 2) related to suspected criminal activity; 3) in response to a court order or other legal process, judicial or administrative proceedings, or certain other law enforcement situations; 4) to personal representatives; and 5) for workers’ compensation purposes. We must also disclose PHI to authorities that monitor compliance with the privacy requirements described in this Notice.
• For public health activities: We may disclose PHI for public health activities. Examples include when we are required to collect information related to conducting public health surveillance, public health investigations, or public health interventions or related to reporting to the public health authority vital events such as birth or death.
  For health oversight activities: We may disclose PHI to a health oversight agency for activities authorized by law. These oversight activities may include monitoring, audits, investigations, inspections, and licensing.
• Relating to decedents: We may disclose PHI related to an individual’s death to coroners, medical examiners, funeral directors, or organ procurement organizations (with regard to anatomical gifts). Unless an individual indicated otherwise before death, we also may disclose PHI related to the individual’s death to family members, friends, or others who were involved in the individual’s care or payment for care before death.
• For research purposes: In limited circumstances, we may disclose your PHI for research purposes. All research projects for which we disclose your PHI without your written authorization are subject to a special review and approval process. We will request your written authorization if the researcher will further use or disclose your PHI.
  To avert threat to health or safety: In order to avoid a serious threat to health or safety, we may disclose PHI as necessary to law enforcement or other persons who can reasonably prevent or lessen the threat of harm.
• For specific government functions: We may disclose PHI of military personnel and veterans in certain situations. Other government related disclosures may include information disclosed to Human Rights Committees, the Sexually Violent Persons Program, correctional facilities and other law enforcement custodial situations, and to government benefit programs (for purposes of eligibility and enrollment). We also may disclose your PHI for national security reasons, such as protection of the President.

Uses and Disclosures Requiring Your Written Authorization.

We may not use or disclose your PHI without your written authorization if the use or disclosure would constitute a sale of PHI. We may not use or disclose your PHI for marketing purposes without your written authorization. Most uses and disclosures of your psychotherapy notes will require your written authorization. There may be other uses and disclosures of your PHI for which we will seek your written authorization.

Uses and Disclosures to Which You Have an Opportunity to Object.

Unless otherwise prohibited by law and provided you are informed in advance about the disclosure and do not object, we may disclose a limited amount of your PHI as follows:

• To families, friends or others involved in your care: We may share with these people information directly related to their involvement in your care, or payment for your care. We also may share PHI with these people to notify them about your location, general condition, or death.

Your Rights Regarding Your Protected Health Information.

You have the following rights relating to your Protected Health Information:

• Right to Request Restrictions: You have the right to request that we restrict use or disclosure of your PHI to carry out treatment, payment, health care operations, or communications with family, friends, or other individuals. We are not required to agree to a restriction. We cannot agree to limit uses or disclosures that are required by law. Your request must be made in writing to the ADHS/DBHS HIPAA Privacy Official listed on page 5 of this Notice.
• Right to Request Conditions on Providing Confidential Communications: You have the right to request that we send communications that contain PHI by alternative means or to alternative locations. We must accommodate your request if it is reasonable and you clearly state that the disclosure of all or part of that information could endanger you. Your request must be made in writing to the ADHS/DBHS HIPAA Privacy Official listed on page 5 of this Notice.
• Right to Inspect and Copy: You have the right to inspect and copy behavioral health information that we maintain about you. Your request must be made in writing to the ADHS/DBHS HIPAA Privacy Official listed on page 5 of this Notice. If copies are requested or if you agree to a summary or explanation of such information, we may charge a reasonable, cost-based fee for the costs of copying, including labor, postage; and preparation cost of an explanation or summary. We may deny your request to inspect and copy in certain circumstances as defined by law.
• Right to Request an Amendment: For as long as your behavioral health information is maintained, you have the right to request that an amendment be made to such records. The request must be made in writing to the ADHS/DBHS HIPAA Privacy Official listed on page 5 of this Notice. Your request must include the reason or reasons that support your request. We may deny your request for an amendment if we determine that the record that is the subject of the request was not created by us, is not part of the designated record set, is not available for inspection as specified by law, or is accurate and complete.
• Right to Receive an Accounting of Disclosures: You have the right to receive an accounting of disclosures of your behavioral health information. This does not include disclosures made: to carry out treatment, payment, and health care operations; to you; to family, friends, or others involved in your care; for national security or intelligence purposes; or to correctional institutions or law enforcement officials. Your first request for accounting in any 12-month period will be provided without charge. A reasonable fee will be charged for each subsequent request. Your request must be made in writing to the ADHS/DBHS HIPAA Privacy Official listed on page 5 of this Notice.
• Right to receive this notice: You have the right to receive a paper copy of this Notice and/or an electronic copy by email upon request. This information is also posted on our website at www.azdhs.gov/bhs. You should make your request to the ADHS/DBHS HIPAA Privacy Official listed on page 5 of this Notice.
• Right to be notified of a breach of your PHI. In the event of a breach of your PHI that is created, received, or maintained by ADHS/DBHS, an ADHS/DBHS business associate, or the business associate’s subcontractor, you have the right to receive written notification.

How to File a Complaint if You Believe Your Privacy Rights Have Been Violated.

If you believe your privacy rights as set forth in this Notice have been violated, and you wish to complain, please write or contact one of the persons listed below:

If you make such complaints, retaliatory action is not permitted.
Individuals with a disability may request a reasonable accommodation by calling (602) 364-4558 or toll free to 1-(800) 867-5808.