This notice describes how protected medical and drug and alcohol-related information about you may be used and disclosed and how you can get access to this information.  Please review it carefully.

General Information 

Information regarding your health care, including payment for health care and treatment, is primarily protected by three federal laws: (i) the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d et seq., 45 C.F.R. Parts 160 & 164; (ii) the additional privacy and security requirements enacted pursuant to Subtitle D of the Health Information Technology for Clinical Health Act (HITECH), including 45 C.F.R. Sections 164.308, 164.310, 164.312, and 164.316; and (iii) the Confidentiality Law, 42 U.S.C. § 290dd-2, 42 C.F.R. Part 2.  Under these laws, Granite Recovery Centers (“GRC”) may not say to a person outside GRC that you attend the program, nor may GRC disclose any information identifying you as someone with a substance use disorder, or disclose any other protected information about you, except as permitted by federal law.

How GRC May Use and Disclose Medical Information about You. 

The following list describes the ways GRC may use and disclose your medical information.  The examples provided serve only as guidance and do not include every possible use or disclosure.

 

For Treatment.  We may use and disclose your Protected Health Information to provide, coordinate, or manage your health care and any related service.

 

For Payment.  We may use and disclose medical information about you so that the treatment and services you receive may be billed and payment may be collected from you, an insurance company, or a third party.  We may also tell your health plan about a treatment or procedure you are going to receive in order to obtain prior approval or to determine whether your plan will cover the services.

 

For Health Care Operations. We may use and disclose medical information about you for our operations.  These uses and disclosures are necessary to operate GRC in an efficient manner and to ensure that all individuals receive quality care.

 

Treatment Reminders.  We may use and disclose medical information in order to remind you of a scheduled treatment appointment or procedure.

 

Business Associates. GRC may disclose information about you without your authorization to obtain claims processing, utilization review, quality assurance, legal, accounting financial, management, administrative and other services, as long as GRC has a Business Associate Agreement in place with the applicable third party.

 

Required by Law.  We will disclose medical information about you when required to do so by federal or state laws.
To Avert a Serious Threat to Health or Safety.  We may use and disclose medical information about you to medical or law enforcement personnel when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.

 

Sale of GRC.  We may use and disclose medical information about you to another healthcare entity in the sale, transfer, merger, or consolidation of GRC, unless your medical information includes information about substance use disorder treatment services provided to you.  Such information will only be transferred to the new entity pursuant to your written authorization as further described below.

 

Electronic Disclosure.  We may disclose your medical information orally, in paper format or through the use of any electronic means.

Special Situations 

Organ and Tissue Donation.  If you have formally indicated your desire to be an organ donor, we may release medical information to organizations that handle procurement of organ, eye, or tissue transplantations.

 

Military and Veterans.  If you are a member of the armed forces, we may release medical information about you as required by military command authorities.

 

Workers’ Compensation.  We may release medical information about you for workers’ compensation or similar programs.  These programs provide benefits for work-related injuries or illness.

 

Qualified Personnel.  We may disclose medical information for research or for management audit, financial audit, or program evaluation, but GRC personnel may not directly or indirectly identify you in any report of the research, audit, or evaluation, or otherwise disclose your identity in any manner.

 

Public Health Risks.  We may disclose medical information about you for public health activities.  These activities generally include the following:

 

• To prevent or control disease, injury, or disability; 
• To report births and deaths; 
• To report child abuse or neglect; 
• To report reactions to medications or problems with products; 
• To notify people of recalls of products they may be using; 
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; 
• To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence. 

All such disclosures will be made in accordance with the requirements of federal and state laws and regulations.
Health Oversight Activities.  We may disclose medical information to a health oversight agency for activities authorized by law.  Health oversight agencies include public and private agencies authorized by law to oversee health care providers and the health care industry in general.

 

Law Enforcement.  We may release medical information if asked to do so by a law enforcement official: (1) in response to a court order or subpoena; or (2) if GRC determines there is a probability of imminent physical injury to you or another person, or immediate mental or emotional injury to you.

 

Coroners, Medical Examiners, and Funeral Directors.  We may release medical information to a coroner or medical examiner when authorized by law (e.g., identify a deceased person or determine cause of death) or to funeral directors.

 

Inmates.  If you are an inmate of a correctional facility or under the custody of a law enforcement official, we may release health and treatment information about you to the correctional facility or law enforcement official.  Such release would be necessary for: (1) the facility to provide you with proper care; (2) to protect your health and safety or the health and safety of others; and (3) to ensure the safety and security of the correctional facility.

Other Uses and Disclosures 

GRC will not use or disclose your medical information for any other purposes (including, without limitation, marketing), unless you give GRC your written authorization to do so.  If you give GRC such written authorization for a purpose not described in this Notice, then you may, in most cases, revoke such authorization in writing at any time.  Your revocation will be effective for all your medical information GRC maintains, unless GRC has already taken action in reliance on your prior authorization.

 

Substance Use Disorder Treatment.  To the extent your treatment at GRC consists of substance use disorder treatment, your medical information related to such services is protected by federal law and regulation (see 42 CFR Part 2) and will only be used or disclosed by GRC pursuant to: (1) your written authorization; (2) a court order or other legal requirement; (3) medical needs in an emergency to qualified medical personnel; or (4) research, audit, or program evaluation purposes to qualified personnel.  This includes use or disclosure of such information in the event of a sale, transfer, merger, or consolidation of GRC.  If you do not provide written authorization in such an event, your information will not be transferred, and the non-transfer could impact the ability of GRC to provide or continue your treatment.  Please note that federal law or regulations protecting alcohol or drug treatment records do not protect any information about a crime committed by a patient of GRC or a member of GRC’s workforce, or any information about suspected child abuse or neglect that is otherwise reportable under state law to appropriate state or local authorities.  A violation of the federal law and regulations that protect the confidentiality of substance use disorder treatment patient records is a crime.  Suspected violations may be reported to appropriate authorities in accordance with 42 CFR Part 2.

Your Health Information Rights 

Right to Inspect and Copy.  You have the right to inspect and obtain a paper or electronic copy of medical information that may be used to make decisions about your care, except for psychotherapy notes, counseling notes, or information compiled for use in a civil, criminal, or administrative proceeding or in other limited circumstances.

 

To inspect and copy your medical information, you must submit your request in writing to the GRC Privacy Officer.  If you request a copy of the information, GRC may charge a fee as established by its licensing authority, if applicable, for the costs of copying, mailing, or summarizing your medical records.

 

GRC may deny your request to inspect and copy your medical information in certain very limited circumstances.  If you are denied access to medical information, including psychotherapy notes or counseling notes, you may request that the denial be reviewed.  A third-party licensed health care professional chosen by GRC will review your request and denial.  This professional will not be the same person who denied your request.  GRC will comply with the outcome of the review.

 

Right to Amend.  If you feel that medical information maintained about you is incorrect or incomplete, you may ask GRC to correct or amend the information.  You have the right to request an amendment for as long as the information is kept by GRC.

 

To request an amendment, your request must be made in writing and submitted to the GRC Privacy Officer.  In addition, you must provide a reason that supports your request.  GRC may deny your request for an amendment if it is not in writing or does not include a reason to support the request.

 

Right to an Accounting of Disclosures.You have the right to request an “accounting of disclosures.”  This is a list of the disclosures made of your medical information for purposes other than treatment, payment, or health care operations.

To request this list, you must submit your request in writing to the GRC Privacy Officer.  Your request must state a time period, which may not be longer than six (6) years.  Your request should indicate in what form you want the list (for example, on paper or electronically).  The first list you request within a 12-month period will be provided to you by GRC for free.  For additional lists within the 12-month period, you may be charged for the cost of providing the list.  GRC will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

 

Right to Request Restrictions. You have the right to request a restriction or limitation on the medical information GRC uses or discloses about you for treatment, payment, or health care operations.  You also have the right to request a limit on the medical information GRC uses or discloses about you to someone who is involved in your care or the payment for your care.  GRC is not required to agree to such a request.  Should GRC agree to your request, GRC will comply with your request unless the information is needed to provide you emergency treatment.

 

If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information with your health insurer for the purpose of payment or our operations.  We will honor such a request unless law requires us to share that information.
To request restrictions you must make your request in writing to the GRC Privacy Officer.  In your request you may indicate: (1) what information you want to limit; (2) whether you want to limit GRC’s use and/or disclosure; and (3) to whom you want the limits to apply.  For example, you may not want disclosures to be made to your spouse.

 

Right to Request Confidential Communications.  You have the right to request that GRC communicate with you about medical matters in a certain way or at a certain location.  To request that GRC communicate in a certain manner, you must make your request in writing to the GRC Privacy Officer.  You do not have to state a reason for your request.  GRC will accommodate all reasonable requests.  Your request must specify how or where you wish to be contacted.

Changes to This Notice 

GRC reserves the right to change its privacy and security practices and to make the new provisions effective for all Protected Health Information that GRC holds or maintains.  Should our privacy practices change, we will post the amended Notice of Privacy Practices in our offices at each facility’s address and on our website.

Complaints 

If you believe your privacy rights have been violated, you may file a complaint with the GRC Privacy Officer or with the Office for Civil Rights, U.S. Department of Health and Human Services at 200 Independence Avenue, S.E., Washington, D.C. 20201.