Effective 10/01/2013

GOVERNMENT OF THE DISTRICT OF COLUMBIA

DEPARTMENT OF BEHAVIORAL HEALTH

JOINT NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION (PHI)

INCLUDING MENTAL HEALTH INFORMATION AND ALCOHOL/DRUG TREATMENT AND PREVENTION INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED. PLEASE REVIEW THIS NOTICE CAREFULLY.

The Department of Behavioral Health (DBH) Network includes DBH and all providers that are certified, licensed, or otherwise regulated by DBH or have entered into a contract or agreement with DBH to provide mental health services or supports and or alcohol/drug treatment and prevention services. This notice explains how your PHI will be used, shared, and protected by the participating Network providers.

What is PHI? PHI is any written, recorded, or oral information which:

(l) identifies, or could be used to identify, a consumer; and

(2) relates to: (a) the physical or mental health or condition of a consumer,

(b) provision of health care to a consumer, or

USES AND DISCLOSURES OF YOUR PHI WHEN AUTHORIZATION IS NOT REQUIRED

Under what circumstances can my PHI be shared without my consent or authorization?

(1)Your PHI (including mental health information, and alcohol/drug treatment and prevention information maintained by an alcohol/drug treatment and prevention provider) may be disclosed without your prior consent or authorization in the following situations:

To report suspected child abuse or neglect;
In a medical emergency when there is a threat to health of individual that requires immediate medical attention.
For health oversight activities such as evaluating programs and audits; In response to a court order;
For research purposes, such as research related to the development of better treatments, provided the research study meets certain privacy requirements;
To report a crime or a threat of crime occurring on the provider’s premises or directed against the provider’s staff; and
Pursuant to a qualified service organization or business associate agreement.

(2) For Mental Health Information Only. In addition, mental health PHI may also be disclosed without prior consent or authorization as follows:

With Network providers or those D.C. Health and Human Service Agencies and their respective service providers that are covered entities under HIPAA, including Department of Human Services, Child and Family Services Agency, Department of Health, and Department of Health Care Finance, to coordinate treatment benefits and services;
When a mental health professional believes it is necessary to ask for emergency psychiatric hospitalization, or to protect you or someone else from serious physical harm; For certain judicial and administrative proceedings;
To report suspected adult or child abuse or neglect;
When requested by a designated agency representative for the District of Columbia protection and advocacy agency when investigating allegations of abuse or neglect for persons with mental illness;
At the request of your legal representative;
To correctional institutions or law enforcement officials having lawful custody of you in order to facilitate the delivery of mental health services and supports; and
To monitor your compliance with a condition of pretrial release, probation, parole, supervised release, or diversion agreement regarding mental health treatment.

FREQUENTLY ASKED QUESTIONS

If I am in an alcohol/drug treatment and prevention program, can the provider share my alcohol/drug treatment and prevention information with another Network provider without my consent?

No. 42 CFR Part 2 specifically requires written consent to disclose alcohol/drug treatment and prevention information unless an exception noted in (l) above applies.

Can my PHI be used or disclosed for other purposes if I give permission?

Yes. Your PHI can be shared for purposes other than those described above, but only if you give specific permission by signing an authorization form. For example, you might give us permission to release your PHI to a provider outside of the Network to allow that provider to give you a service or treatment that you need. You have the option of saying that the authorization will remain in effect for any period of time up to 365 days, except in cases where you authorized the disclosure in order to obtain life insurance or noncancellable or guaranteed renewable health insurance, in which case the authorization can be up to two (2) years from the date of the policy.

If I authorize disclosure, can I revoke my authorization?

Yes. Except for insurance purposes, you can revoke your authorization anytime by giving written notice to your provider. But you must do this in writing and bring it to your provider so that Network providers will stop using and disclosing your PHI. Network providers are permitted to use and disclose your PHI based on your authorization until the Network provider receives your revocation in writing. The revocation of your authorization will not affect any action by the Network provider before it was received.

OUR DUTY TO PROTECT YOUR PHI

What is the Network required to do to protect my PHI?

All Network providers are required by law to protect the privacy of your PHI, and to provide you with this Notice of their legal duties and privacy practices. If the law requires changes to the terms of this Notice, all Network providers will be required to follow the terms of the changed Notice.

YOUR RIGHTS REGARDING YOUR PHI

What rights do I have concerning my PHI?

You have the right to see and copy your PHI with limited exceptions.
You have the right to request that your record of PHI be amended.
You have the right to be informed about your PHI in a confidential manner that you choose. The manner you choose must be reasonable for us to do.
You have the right to request that we limit certain uses and disclosures of your PHI. Network providers do not have to agree to your restrictions, but if we do agree, we must follow the restrictions.
You have a right to restrict disclosure of PHI when paid out of pocket.
You have the right to obtain information about disclosures that the Network providers have made of your PHI
You have the right to have a paper copy of this Privacy Notice
You have a right to be notified of a breach of your PHI.

What can I do if I wish to exercise my rights, have questions, or want to complain about the use and disclosure of my PHI?

If you wish to exercise your rights, or you have a question or compliant about the use and disclosure of your PHI, you should contact the MBI Privacy Officer

MBI Privacy Officer

MBI Health Services, LLC

1221 Taylor St. NW

Washington, DC 20011

Phone: (202) 464-9200

E-mail: PRC@mbihs.com

You may also complain to the DBH Privacy Officer or the U.S. Department of Health and Human Services, Office of Civil Rights by sending a written complaint to the address below:

DBH Privacy Officer Office for Civil Rights – Region III

DC Department of Behavioral Health US Department of Health and Human Services

64 New York Avenue, NE, 2^nd Floor 150 S. Independence Mall West, Suite 372

Washington, DC 20002 Public Ledger Building

Phone: (202) 671-4088 Philadelphia, PA 19106-9111

TIYITTD: (202) 673-7500 Main Line (215) 861-4441; Hotline (800) 368-1019

E-mail: dbh.privacy@dc.gov Fax (215) 861-4431; TDD (215) 861-4440

E-mail: ocnnail@hhs.gov

CHANGES TO THIS NOTICE

If the law requires changes to the terms of this Notice, all Network providers will be required to follow the terms of the changed Notice. If the notice is changed, the changes will apply to all PHI (including mental health information, and alcohol/drug treatment and prevention information maintained by an alcohol/drug treatment and prevention provider) created or received before the notice was changed. The amended notice will be posted on the DBH website and should be provided to you at your next visit and posted at all service sites.