Colorado Community Health Alliance Medical Privacy Notice
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT A PATIENT MAY BE USED AND DISCLOSED, AND HOW A PATIENT CAN GET ACCESS TO THIS INFORMATION.
The medical information we collect is called Protected Health Information ("PHI"). We are required by federal and state law to protect the privacy of PHI and to provide this Notice about how we protect and use it. When we use or give out ("disclose") PHI, we are bound by the terms of this Notice. This Notice applies to all electronic or paper records we create, obtain, and/or maintain that contain PHI. Colorado Community Health Alliance takes our obligation to keep PHI secure and confidential very seriously.
How We Protect Privacy
Colorado Community Health Alliance understands the importance of protecting all PHI. Only those workforce members who need that information for treatment, for payment purposes and/or for health care operations may see that information. We maintain technical, physical and administrative safeguards to ensure the privacy of PHI. Only those workforce members who have been trained and authorized are given access to paper and electronic records and to the systems where the information is stored. People who work for Colorado Community Health Alliance receive the following types of education about PHI:
- Policies and procedures on how to protect PHI
- The technical, physical and administrative safeguards Colorado Community Health Alliance has put in place to make sure PHI remains private and secure.
How We Use and Disclose PHI
Federal law tells us what information we can release to others, who we may share that information with, and the rules we must follow when giving out PHI.
Uses of PHI That Do Not Require an Authorization
We may share PHI without written authorization while providing health benefits, if necessary. We may disclose PHI for the following purposes:
Colorado Community Health Alliance may share PHI for health care treatment, including sharing PHI with physicians, nurses, pharmacies, and other health care professionals who provide health care services or are involved in the coordination of care.
Colorado Community Health Alliance may use or disclose PHI to pay for services that have been received from health care providers. We may also share information in order to make coverage determinations and coordinate payment for benefits with other coverage.
Health care operations:
Colorado Community Health Alliance may use or disclose PHI for health care operations purposes. These uses and disclosures are necessary, for example, to evaluate the quality of the services we provide, such as case management. Colorado Community Health Alliance may also disclose PHI to health care providers or health plans for their health care operations. For example, Colorado Community Health Alliance may provide PHI to manage disease or to coordinate health care or health benefits.
Colorado Community Health Alliance may also disclose PHI without written authorization for other purposes, as permitted by law. This includes:
Disclosures to others involved in health care:
Colorado Community Health Alliance may disclose PHI to a person who is involved in a patient’s care or helps pay for that care, such as a family member or friend. We also may notify family about location or general condition or disclose such information to an entity assisting in a disaster relief effort. As allowed by federal and state law, we may disclose the PHI of minors to their parents or legal guardians.
- If the patient is present or available to tell us to do so, we may disclose PHI to others.
- In an emergency situation, if the patient is not present, or is incapacitated, we will use our professional judgment to decide whether disclosure of PHI to others is in the best interests of the patient. If we do disclose PHI in a situation where the patient is unavailable, we would disclose only information that is directly relevant to the person's involvement with the treatment or for payment related to the treatment. We may also disclose PHI in order to notify (or assist in notifying) such persons of a patient’s location, general medical condition or death.
Disclosures to vendors and accreditation organizations:
- We may disclose PHI to companies that perform certain services we've requested. For example, we may engage vendors to help us to provide information and guidance to patients with chronic conditions like diabetes and asthma.
- Accreditation organizations such as the National Committee for Quality Assurance (NCQA) for quality measurement purposes.
We will not use PHI for marketing purposes without prior written authorization, except as permitted by law.
Health or safety:
We may disclose PHI to prevent or lessen a serious and imminent threat to a patient’s health or safety, or the health or safety of the general public.
Public health activities:
- We may report health information to public health authorities authorized by law to receive such information for the purpose of preventing or controlling disease, injury or disability, or monitoring immunizations.
- We may report child abuse or neglect, or adult abuse, including domestic violence, to a government authority authorized by law to receive such reports.
- We may report information about a product or activity that is regulated by the U.S. Food and Drug Administration (FDA) to a person responsible for the quality, safety or effectiveness of the product or activity.
- We may alert a person who may have been exposed to a communicable disease, if we are authorized by law to give this Notice.
Health oversight activities:
- A government agency that is legally responsible for oversight of the health care system or for ensuring compliance with the rules of government benefit programs, such as Medicare or Medicaid.
- Other regulatory programs that need health information to determine compliance.
We may disclose PHI for research purposes, but only according to and as allowed by law.
Disclosure of PHI Required by Law
Colorado Community Health Alliance may also disclose PHI without written authorization for other purposes, as required by law.
Judicial and administrative proceedings:
We may disclose a patient’s PHI in a judicial or administrative proceeding or in response to a valid legal order.
Law enforcement officials:
We may disclose a patient’s PHI to the police or other law enforcement officials, as required by law or in compliance with a court order or other process authorized by law.
We may disclose a patient’s PHI to various departments of the government such as the U.S. military or the U.S. Department of State as required by law.
We may disclose a patient’s PHI when necessary to comply with workers' compensation laws.
Uses of PHI Requiring Authorization
Other than for the purposes described above, we must obtain written authorization to use or disclose PHI except when specifically permitted or required by law.
"Highly Confidential." For certain kinds of PHI, federal and state law may require enhanced privacy protection. These would include PHI that is:
- Maintained in psychotherapy notes.
- About alcohol and drug abuse prevention, treatment and referral.
- About HIV/AIDS testing, diagnosis or treatment.
- About venereal and/or communicable disease(s).
- About genetic testing.
Cancellation. A patient may cancel ("revoke") a written authorization that was given before. The cancellation, submitted to us in writing, will apply to future uses and disclosures of that patient’s PHI. It will not impact disclosures made previously, while the authorization was in effect.
Patients have the following rights regarding the PHI that is created, obtained, and/or maintained about a patient.
Right to request restrictions:
A patient may ask us to restrict the way we use and disclose a patient’s PHI for treatment, payment and health care operations, as explained in this Notice. We are not required to agree to the restrictions, but we will consider them carefully. If we do agree to the restrictions, we will abide by them.
Right to receive confidential communications:
A patient may ask to receive communications containing PHI by alternative means or at alternative locations. We will accommodate reasonable requests whenever feasible.
Right to inspect and copy a patient’s PHI:
A patient may ask in advance to review or receive a copy of a patient’s PHI that is included in certain paper or electronic records we maintain. Under limited circumstances, we may deny a patient access to a portion of a patient’s records. A patient may request that we disclose or send a copy of a patient’s PHI to a Health Information Exchange (HIE).
Right to amend a patient’s records:
A patient has the right to ask us to correct a patient’s PHI contained in our electronic or paper records if a patient believes it is inaccurate. If we determine that the PHI is inaccurate, we will correct it if permitted by law. If a health care facility or professional created the information that a patient wants to change, a patient should ask them to amend the information.
Right to receive an accounting of disclosures:
Upon a patient’s request, we will provide a list of the disclosures we have made of a patient’s PHI for a specified time period. However, the list will exclude:
- Disclosures a patient has authorized.
- Disclosures made earlier than six years before the date of a patient’s request (in the case of disclosures made from an electronic health record, this period may be limited to three years before the date of a patient’s request).
- Disclosures made for treatment, payment, and health care operations purposes except when required by law.
- Certain other disclosures that are excepted by law.
If a patient requests an accounting more than once during any 12-month period, we will charge a patient a reasonable fee for each accounting report after the first one.
Right to name a personal representative:
A patient may name another person to act as a patient’s Personal Representative. A patient’s representative will be allowed access to a patient’s PHI, to communicate with the health care professionals and facilities providing a patient’s care, and to exercise all other HIPAA rights on a patient’s behalf. Depending on the authority a patient grants a patient’s representative, he or she may also have authority to make health care decisions for a patient.
Right to receive a paper copy of this Notice:
Upon a patient’s request, we will provide a paper copy of this Notice, even if a patient has already received one, as described in the Notice Availability and Duration section found later in this Notice.
Actions a Patient May Take
If a patient has questions about a patient’s privacy rights, believes that we may have violated a patient’s privacy rights, or disagrees with a decision that we made about access to a patient’s PHI, a patient may contact Colorado Community Health Alliance at the following address or telephone number:
Colorado Community Health Alliance
PO Box 13406
Denver, CO 80202
Telephone Number: 1-855-627-4685 (toll free)
For callers with hearing or speech disabilities: 711 (TTY)
For certain types of requests, a patient must complete and mail to CCHA the applicable form, which is available by calling the CCHA Support Services number at 1-855-627-4685 or 711 (TTY).
Contact a government agency. If a patient believes we may have violated a patient’s privacy rights, a patient may also file a written complaint with the Secretary (the "Secretary") of the U.S. Department of Health and Human Services ("HHS"). A patient’s complaint can be sent by email, fax, or mail to the HHS Office for Civil Rights ("OCR"). For more information, go to the OCR website (http://www.hhs.gov/ocr/privacy/hipaa/complaints).
We will not take any action against a patient if a patient exercises a patient’s right to file a complaint, either with us or with the Secretary.
Notice Availability and Duration
Notice availability. A copy of this Notice is available upon request by calling the CCHA Support Services number at 1-855-627-4685 or 711 (TTY), or from our website.
Right to change terms of this Notice. We may change the terms of this Notice at any time, and we may, at our discretion, make the new terms effective for all of a patient’s PHI in our possession, including any PHI we created or received before we issued the new Notice.
If we change this Notice, we will update the Notice on our website.
Effective date. This Notice is effective as of 3/29/2012, and updated as of 05/01/2018.