Privacy Practices
HIPAA Compliance
The Health Information Portability and Accountability Act of 1996 (HIPAA) requires all health care entities to develop and document security programs to guard Protected Health Information (PHI) against loss or unauthorized disclosure. HIPAA clearly stresses that these security measures must be "reasonable and appropriate" in nature. This legislation also specifies a series of administrative, technical and physical security practices and procedures for agencies to use that will assure the confidentiality of electronic protected health information.
Woodfords Family Services is also required by HIPAA to maintain the privacy of your protected health information, and to provide you with a notice of Woodfords' privacy practices. Protected Health Information (PHI) includes any information which makes it possible to identify an individual. This includes direct information such as name, address, telephone number, social security number and birth date or indirect information such as diagnosis which can be used to reasonably conclude the identity of an individual.
In order to comply with HIPAA, Woodfords has incorporated the federal and Maine State requirements into its Confidentiality practices. This includes providing protections in the transmission of Protected Health Information via e-mail, cell-phone or by fax. Agency staff ensure that consumers and/or their legally-responsible persons are able to make reasoned decisions around transmission of PHI in a manner that is easily understood and includes all the risks and benefits of services. Consumers and legally responsible persons are informed about the laws, rights and regulations that protect their personal health information and are given a written summary of this information as part of the notice of privacy practices.
For further information regarding HIPAA compliance, please contact Woodfords Family Services Privacy Officer at 878-9663.
Notice of Privacy Practices
This notice of privacy describes how protected health information (PHI) about you may be used and disclosed and how you get access to this information. Please review it carefully.
Introduction: Woodfords Family Services is required by law to maintain the privacy of your protected health information (PHI) and to provide you with a notice of Woodfords’ privacy practices. While we are required to abide by the terms of the notice that is currently in effect, Woodfords reserves the right to change our privacy practices at any time. If Woodfords’ privacy practices change, we will provide you with a revised notice or you may obtain a copy any time by contacting the main office.
PHI includes demographic information such as your name, address, telephone number, and past, present, or future information about you or your child’s physical, developmental or mental health condition; and information about the services provided to you, including payment information if any of that information may be used to identify you.
This Notice describes use and disclosures of PHI to which you have consented, that you may be asked to authorize in the future, and that are permitted or required by state of federal law. Also, it advises you of your rights to access and control of your PHI. This Notice is effective April 14, 2003.
If you have any questions about this Notice of Privacy Practices, please contact the Privacy Officer: Sandra L. Hayward, the Director of Quality Improvement, Mailing address: PO Box 1768, Portland, Maine 04104-1768.
Safeguarding PHI within our offices: Woodfords has in place appropriate administrative, technical, and physical safeguards to protect the privacy of you or your child’s PHI. We regularly train our staff on the obligation to protect the privacy of your PHI. We also hold records in secure areas within our offices. Only individuals who have a “need to know” are permitted access to your PHI. Our employees understand the legal and ethical obligation to protect your PHI. The violation of this Notice of Privacy Practices will result in disciplinary action, up to and including termination, in accordance with Woodfords Family Services’ discipline policy.
Uses and disclosures of your Personal Health Information: Woodfords Family Services may use you or your child’s PHI to provide services to you, to seek payment for the services you receive, and to support the operations of our programs. For example:
- Your information may be used to develop a diagnosis and treatment plan, or to coordinate employee referrals to our preferred health care provider (OH&R).
- Portions of your information may be submitted to our insurance carrier or other third-party payor to secure payment on your behalf.
- Your information may be used in the course of health care operations, such as for quality improvement, evaluation, training or audit activities.
Business associates performing services on Woodfords’ behalf related to treatment, payment or health care related operations may also have access to your information, solely for the purpose of providing such services, provided that the business associate has agreed, in writing, to maintain the confidentiality of such information.
Uses and Disclosures of PHI based upon your written authorization: From time to time, you may request that Woodfords Family Services disclose limited PHI to specified individuals or agencies for a defined purpose and for a defined timeframe. These situations may include disclosures of sensitive PHI, such as mental health or psychiatric treatment. Also, you may authorize disclosures to individuals who are not involved in treatment, payment, or health care operations, such as attorneys, if you are involved in litigation. If you wish Woodfords to make disclosures in these situations, we will ask you to sign our “Consent to Release/Obtain Confidential Information”.
Uses and Disclosures of PHI that are permitted or required by law: Woodfords Family Services may disclose information without your authorization as permitted or required by applicable law, including any of the following:
- In the event of an emergency - If individuals are incapacitated and require medical treatment, Woodfords will use and disclose the PHI to ensure that they receive the necessary medical services.
- In the event of communication barriers – If we try to, but cannot, obtain the consent to use or disclose the PHI because of a substantial communication barrier, and the representative and/or guardian, using his or her professional judgment, infers that the consent is being given, Woodfords will then be able to use or disclose the PHI.
- To comply with public health statutes and rules – Woodfords may disclose the PHI to an authorized public health authority to prevent or control disease, injury, or disability.
- To make any required reports of abuse or neglect
- To comply with health oversight activities by government agencies – Woodfords may disclose the PHI to a health oversight agency for audits, investigations, inspections, and other activities necessary for the appropriate oversight of the health care system and the government benefit programs such as MaineCare, Medicaid and Medicare.
- To comply with a court order, government subpoena, or other lawful process – Woodfords may disclose the PHI in the course of any judicial or administrative proceeding in response to an order, expressly directing disclosure, and within certain limits in response to a subpoena, discovery request, or other lawful process.
- For research purposes
- In the event of your death, to a medical examiner
- For workers’ compensation purposes – Woodfords may disclose the PHI as authorized by and to the extent necessary to comply with the Maine Workers’ Compensation act or other similar programs that provide benefits for work-related injuries or illness without regard to fault.
- For you and/or DHHS – Woodfords must disclose the PHI to you upon request and to the Secretary of the U.S. Department of Health & Human Services to investigate or determine Woodfords Family Services’ compliance with the privacy laws.
Your rights: You have the right to request restrictions on the use of your information. However, Woodfords Family Services is not required to agree to a requested restriction and it is our policy not to agree to such restrictions unless we determine, at our sole discretion, that a compelling reason exists to do so.
You have the right to receive communication from Woodfords Family Services in a confidential manner. If you would like us to use another address or telephone number to contact you, you must make the request in writing.
You have the right to receive an accounting of disclosures of your PHI that you have not authorized. To receive such an accounting please contact:
For employees: the Human Resources Department at the main office.
For parents/guardians and/or consumers: the appropriate/applicable program director.
You have the right to inspect and copy your information. If you wish to do so, you will be provided an opportunity to inspect your files/records within 30 days of receipt of your written request. You may be charged a reasonable cost to copy your information, or for preparing any summaries that you may request.
You have the right to a copy of this Notice of Privacy Practices upon request.
You have the right to request an amendment of any medical information that you believe is inaccurate or incomplete. To do so, please contact the Privacy Officer in writing. Your request may be denied if:
- You do not provide a reason to support your request
- The information to be amended is not part of the information kept by us
- The information was not created by us
- The information is not part of information which you would be permitted to inspect and copy
- The information is accurate and complete.
You have the right to complain to Woodfords Family Services and to the Secretary of the United States Department of Health and Human Services, if you believe your privacy rights have been violated.
You have the right to file a complaint, in writing, with Woodfords Family Services, by contacting Richard Farnsworth, the Executive Director of Woodfords Family Services. You will receive a response to your complaint within 60 days of the date of the submission of the complaint.
You have the right to file a compliant to the Secretary of the United States Department of Health and Human Services, you must make your complaint in writing within 180 days of the act or omission forming the basis of your complaint.
Nobody is permitted to retaliate against you for filing a complaint.