Serenity HIPPA & 42 CFR
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes standards to protect the privacy of healthcare information. Clients have certain rights to access and control how their healthcare information is used. Clients may request copies of their records, authorize others to receive copies of their records, request that corrections or changes be made to their record, and request a list of when and to whom their health information has been shared.
“Protected healthcare information” means healthcare information (including identifying information) collected from a client or received by a provider, another provider, a health plan, employer, or healthcare clearinghouse. It may include information about a client’s past, present, or future physical or mental health or condition, the provision of healthcare and payment for services.
As a client, your alcohol and/or drug treatment records are protected under the Federal regulations governing Confidentiality and Drug Abuse Patient Records, 42 C.F.R. Part 2, and the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 C.F.R. pts 160 & 164, and cannot be disclosed without written consent unless otherwise provided for by the regulations.
Both HIPAA and 42 CFR, Part 2 protect service recipient identifying information. Under 42 CFR, Part 2 this is information that would identify them as someone who has received alcohol or drug treatment services, either directly or indirectly. This includes any information, whether oral or written that would directly or indirectly reveal a person’s status as a current or former service recipient.
Records protected from unauthorized disclosure include any information acquired about an individual – including identity, address, medical or treatment information, and all communications made to program staff – whether it is in writing or is recorded in some other form.
42 CFR, Part 2 protects “service recipients” who have applied for, participated in, or received an interview, counseling, or any other service from a federally assisted or drug abuse program, including someone who, after arrest on a criminal charge, is identified as an alcohol or drug patient during an evaluation of eligibility for treatment.
HIPAA protects any health information that identifies an individual, while 42 CFR, Part 2 only protects information that identifies an individual as being a patient in a drug or alcohol abuse program or as having a drug or alcohol problem. It is possible for some information, i.e. that which does not include drug/alcohol info, to only be protected by HIPAA and not by 42 CFR, Part 2.
All protected healthcare information will be compiled in a client’s chart, which will be kept in locked cabinets in a locked room unless being utilized by staff members responsible for the provision of clinical services. At such times, staff members are responsible for maintaining confidentiality of information in the chart.
Clients have the right to choose the healthcare/mental healthcare provider that will provide services. If at any time after selecting a provider, the client would like to change providers, HIPAA gives the client a right to do so. This is known and portability of services.
Before Serenity can disclose any healthcare information, they must obtain specific written consent to do so. Client has the right to revoke said written consent in writing at any time.
Clients have the right to review and copy their chart maintained by SERENITY, except when that information is being compiled for use in civil, criminal, or administrative proceedings. Clients have the right to review this information after giving at least 24 hours oral or written notice. The client or their legal representative has the right to receive photocopies within 48 hours of notice.
Clients have the right, with some exceptions, to correct or change healthcare information maintained in their records. Clients may request and receive a list of disclosures of their health-related information created by SERENITY.
HIPAA allows the exchange of protected information with Medicare, Medicaid, Nevada Check-Up, and other private insurance companies for the purpose of treatment, payment, and healthcare operations. Requests for healthcare information that will be utilized in determining eligibility for treatment or pre-authorization of payment do not require authorization from the patient/recipient for release.
Federal Law permits the disclosure of your information without your written consent for the following circumstances:
To report a crime permitted on our premises or against our personnel
To medical personnel in a medical emergency
For research, audit, or evaluations
To appropriate authorities to report suspected child abuse or neglect
As allowed by a court order
Notice of Privacy Rights for Substance Use Disorders (SUD) as required by the Standards for Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2).
All consents must be formally in writing. A verbal consent is not allowed. If authorized by consent, a disclosure is allowed even if it may not be in the individual’s best interests.
The individual may revoke consent at any time. 42 CFR, Part 2 is silent on the issue of whether the revocation can be oral or must be in writing. Serenity Health will honor all oral revocations.
The program must always obtain the minor’s consent for disclosures and cannot rely on the parent’s signature instead; and parental consent for disclosure to a third party is required in addition to the minor’s only if the program is required by state law to obtain parental permission before providing treatment to a minor. In other words, if parental consent was not required to treat the minor, then parental consent is not required to make disclosures. If it is required, the consent of both the minor service recipient and the parent or guardian is required to make disclosures.
Adolescents (14-18 years old): Typically, parents’ consent to treatment for their child to receive mental health services. This is not the case for adolescents receiving substance use disorder treatment. It is recommended that at the onset of mental health services, the adolescent sign releases and consents that are 42 CFR, Part 2 compliant. Otherwise, if the child becomes a participant in co-occurring treatment, the parental consent and releases will no longer be effective.
Any disclosure made with written service recipient consent must be accompanied by a written statement that the information is protected by federal law and that the recipient cannot make any further disclosure unless permitted by regulations. Re-disclosure is not allowed unless the individual requests it and signs a valid authorization.
Disclosures may be permitted when an individual has a medical condition that poses an immediate threat to the health of an individual or requires immediate medical intervention. In this situation, information may only be disclosed to medical personnel, not family members or “emergency contacts”.
Under 42 CFR, Part 2, a subpoena, search warrant or arrest warrant, even when it is signed by a judge and labeled a court order, is not sufficient, when standing alone, to require or even permit a program to make a disclosure.
Serenity providers have a duty to warn. This can be done without violation by either obtaining a court order, anonymously or a non-patient identifying report (and must not implicate substance use disorder treatment).
If there is suspected Child Abuse and Neglect, the program must comply with State mandatory reporting laws in accordance with the procedures included within.
In the event of a policy or law conflict regarding confidentiality procedures, Serenity and its employees/contractors will follow the most conservative/restrictive policy.