We take confidentiality very seriously. We follow very strict rules from the United States and Maryland Governments about when we can release your medical record - your protected health information.

The Federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule establishes a foundation of Federal protection for personal health information, carefully balanced to avoid creating unnecessary barriers to the delivery of quality health care. The Rule generally prohibits this program from using or disclosing your protected health information unless authorized by you, except as follows:

First, we are required by law to disclose your protected health information in certain circumstances, for example, to report abuse and neglect, and to warn about dangerous behavior. Second, we are authorized to disclose your protected health information without your consent when we use that information for treatment, payment or the health care operations of the program.

• "Treatment" generally means the provision, coordination, or management of health care and related services among health care providers or by a health care provider with a third party, consultation between health care providers regarding a patient, or the referral of a patient from one health care provider to another.
   
• "Payment" encompasses the various activities of health care providers to obtain payment or be reimbursed for their services.
   
• "Health care operations" are certain administrative, financial, legal, and quality improvement activities of a program that are necessary to run its business and to support the core functions of treatment and payment.

The program will, without your authorization:

Use or disclose your protected health information for its own treatment, payment, and health care operations activities.

For example:

We may use your protected health information to provide health care to you and may consult with other health care providers about your treatment.

We may disclose your protected health information as part of a claim for payment to a health plan.

We may disclose your protected health information for the treatment activities of any health care provider (including providers not covered by the Privacy Rule).

We may disclose your protected health information to another health care provider (including providers not covered by the Privacy Rule) for the payment activities of the entity that receives the information.

We may disclose your protected health information to another provider for certain health care operation activities of the provider that receives the information if:

Each provider either has or had a relationship with you, and the protected health information pertains to the relationship; and

The disclosure is for a quality-related health care operations activity or for the purpose of health care fraud and abuse detection or compliance.

Security. Your medical record (your protected health information) is kept in a secure location and only those employees or clinicians who need access to your medical record for treatment, payment or health care operations, have access to your medical record unless you sign an authorization.

It is our policy to reasonably limit disclosures of, and requests for, protected health information for payment and health care operations to the minimum necessary. We also limit which members of our workforce may have access to protected health information for treatment, payment, and health care operations, based on those who need access to the information to do their jobs.

We may also disclose information in order to contact you, for example to make appointments, to check with you about how you are doing, and to evaluate the services that we provide to you. We may also contact you for our fund-raising efforts.

Your rights to see your record.

You have the right to see your record or to receive a summary of your record. To do this, please contact your staff worker. If you do not have the number, please call Crossroads’ Administrative office at 410 758-3050 for that information.

You also have the right to ask us for an accounting of the persons or programs to whom we have disclosed your protected health information. (This does not include disclosures for treatment, payment or health care operations, or to persons authorized by you.) To receive this accounting, please contact your staff worker.

If you disagree with the contents of your medical record, you may also request an amendment to your record. We will place that amendment in the medical record unless we did not create that part of the record or we believe the existing record is accurate and complete. If we grant the amendment, we will notify you and you may request that we provide the amendment to other programs and to programs that you identify to us as having already received your medical record. If we deny the amendment, we will give you specific reasons for the denial. You may then submit a statement of disagreement and we may submit a rebuttal. If you notify us in writing, we will attach your request for amendment and our denial to future disclosures of that part of your medical record. Also, if you continue to disagree, you may file a complaint.

How to file a complaint. If you believe that your protected health information has been released in violation of the law, you have the right to file a complaint. You may file a complaint with our program by contacting or submitted a letter to: Administrative Services Director, PO Box 718, Centreville, MD. 21617, 410 758-3050, Ext. 12. You may also file a complaint with the Department of Health and Human Services, Office for Civil Rights 200 Independence Ave. SW, Washington, D.C. 20201. You have our promise that our program will not retaliate against you if you choose to file a complaint.

If you want to send your protected health information to someone, you must sign an authorization. Authorizations may be obtained from your staff worker.

Updates. Over time, we may change this Notice of Privacy Practices. If we make changes, we will post the updated version on our web site at www.ccinconline.com.

Frequently Asked Questions

Q: Can health care providers, such as a specialist or hospital to whom a patient is referred for the first time, use protected health information to set up appointments without the patient’s written consent?

A: Yes. The HIPAA Privacy Rule does not require providers to obtain an individual’s consent prior to using or disclosing protected health information about him or her for treatment, payment, or health care operations.

Q: Are health care providers restricted from consulting with other providers about a consumer’s condition without the consumer’s written authorization?

A: No. Consulting with another health care provider about a consumer is within the HIPAA Privacy Rule’s definition of "treatment" and, therefore, is permissible. In addition, a health care provider is expressly permitted to disclose protected health information about an individual to a health care provider for that provider’s treatment of the individual.

Q: Does the HIPAA Privacy Rule permit a provider or its collection agency to communicate with parties other than the patient (e.g., spouses or guardians) regarding payment of a bill?

A: Yes. The Privacy Rule permits a provider, or a business associate acting on behalf of a provider (e.g., a collection agency), to disclose protected health information as necessary to obtain payment for health care, and does not limit to whom such a disclosure may be made. Therefore, a provider, or its business associate, may contact persons other than the individual as necessary to obtain payment for health care services. However, the Privacy Rule requires a provider, or its business associate, to reasonably limit the amount of information disclosed for such purposes to the minimum necessary, as well as to abide by any reasonable requests for confidential communications and any agreed-to restrictions on the use or disclosure of protected health information.

Q: Does a physician need a patient’s written authorization to send a copy of the patient’s medical record to a specialist or other health care provider who will treat the patient?

A: No. The HIPAA Privacy Rule permits a health care provider to disclose protected health information about an individual, without the individual’s authorization, to another health care provider for that provider’s treatment of the individual.

Q: Is a provider permitted to contact another provider, to which a patient will be transferred for further treatment, without the patient’s authorization?

A: Yes. The HIPAA Privacy Rule permits a health care provider to disclose protected health information about an individual, without the individual’s authorization, to another health care provider for that provider’s treatment or payment purposes.