Notice of Privacy Practices (NPP) 

Adopted August 2018

This notice describes how your protected health information may be used and disclosed and how you may access this information.

Please review it carefully.                  

If you have any questions about this Notice, please contact the Privacy Officer at 781-320-5383

1. INTRODUCTION: Riverside Community Care (Riverside) is committed to protecting your privacy and abiding by all privacy and confidentiality rules and regulations, such as HIPAA, 42 CFR Part 2 and other state and federal regulations. This notice outlines: Riverside Community Care’s responsibilities to keep confidential your Protected Health Information (PHI) and your rights with regard to your own PHI.
   
   This Notice of Privacy Practices (Notice) describes how Riverside Community Care may use and disclose your Protected Health Information (PHI) to carry out care coordination, treatment, and payment or healthcare operations and for other purposes that are permitted or required by law. This Notice applies to the privacy practices of all Riverside Community Care programs.
2. PROTECTED HEALTH INFORMATION (PHI): Protected Health Information (PHI) means health information, including identifying information about you, which we have collected from you or received from your healthcare providers, health plans, and your employer, a healthcare clearinghouse. It may include any information about your past, present of future physical or mental health or condition, the provision of your healthcare, and payment for your healthcare services.
3. RIVERSIDE COMMUNITY CARE RESPONSIBILITIES: We are committed to respecting your privacy and confidentiality. We are required by law to maintain the privacy of your PHI and to provide you with this Notice. We are also required to comply with the terms of our current Notice. You may obtain a copy of the current Notice upon request or on the Riverside Community Care webpage.
4. HOW WE MAY USE AND DISCLOSE YOUR PHI: We may use and disclose your PHI for various reasons. For some uses or disclosures, we need your written authorization. Below we describe the different categories of uses and disclosures and give you some examples of each category. Except when disclosing PHI relating to your care coordination, treatment, payment or healthcare operations, we must use or disclose only the minimum necessary PHI to accomplish the purpose of the use or disclosure.
   
   1. TREATMENT: We may use or disclose your PHI to manage, coordinate, and provide your healthcare services. For example, one Riverside program may disclose information to another Riverside program involved in coordinating or providing your care.  We will respect and maintain the privacy of alcohol and drug abuse records covered by 42 CFR Part 2. We will not disclose or re-disclose information governed by 42 CFR Part 2 without written consent from you. 
   2. PAYMENT: We may use or disclose your PHI for billing and payment purposes. For example, we may disclose your PHI to MassHealth, your insurer or health plan for a number of reasons, including to obtain approval of services; to determine eligibility or coverage for health insurance; to review whether your services were medically necessary, appropriately authorized or certified in advance; or to review your services for purposes of utilization review, to ensure the appropriateness of your care or to justify the charges for your care.
   3. HEALTHCARE OPERATIONS: We may use and disclose your PHI for our healthcare operations. These uses and disclosures are necessary to make sure that you receive quality care. These activities may include monitoring and reporting quality metrics, quality assessment and improvement, quality management and training assessments. Within Riverside Community Care program, we may combine your PHI with the information of other person served to compare how each program is doing and see where we can make improvements in our services.  When we combine PHI, we will remove identifying information so it may be used to study healthcare, behavioral healthcare, care coordination, and/or service delivery without identifying specific people served.  
   4. ADDITIONAL DATA PROTECTIONS: Some services, including but not limited to electronic data and medical records storage, may be performed on the behalf of Riverside Community Care by third party contractors called Business Associates. Business Associates are required to safeguard your PHI in the same way that we are required to do so. Also, Riverside Community Care may also enter into contractual arrangements, called Data Usage Agreements, to protect your PHI when different systems share and compare quality outcomes to monitor general population health improvements or declines.
   5. OPPORTUNITY TO OBJECT: 
      
      1. Persons Involved in your Care: In limited circumstances, we may use and disclose your PHI without your authorization, but you will have an opportunity to object. For example, we may disclose your PHI for the purposes of collecting payments from someone who helps pay for your care. In such case, you would have an opportunity to object.
      2. Fundraising: We may contact you as part of our fundraising efforts. You have the right to opt out of receiving such communication. Any fundraising material sent to you will include a description of how you may opt out of receiving such communications. If you opt out, we will use best efforts to make sure that you do not receive any further fundraising solicitations.
5. OTHER PERMITTED OR REQUIRED USES AND DISCLOSURES THAT MAY BE MADE WITHOUT YOUR AUTHORIZATION OR OPPORTUNITY TO OBJECT
   
   Riverside Community Care may legally use and disclose your PHI to others for certain purposes that are not care-coordination, treatment, payment or healthcare operations, without your written authorization or opportunity to object. Such examples include, but are not limited to, the following: 
   
   1. EMERGENCIES: If you are in an emergency situation, we may disclose your PHI. In this case we will determine whether the disclosure is in your best interest, and if so, only disclose the information that is directly relevant to the emergency. In the event that the emergency is related to alcohol and drug abuse treatment governed by 42 CFR Part 2, we will disclose your PHI in accordance with those regulations.
   2. UNABLE TO MAKE HEALTHCARE DECISIONS: In situations where you are unable to make your own healthcare decisions, we will, under certain circumstances and as authorized by law, disclose your PHI to an authorized healthcare proxy, guardian or applicable state agency responsible for consenting to your care.
   3. AS REQUIRED BY LAW: We will disclose PHI about you when required to do so by federal, state or local law. 
   4. TO PREVENT A SERIOUS THREAT TO HEALTH OR SAFETY: We may use and disclose your PHI when necessary to prevent a serious and imminent threat to the health or safety of you, the public or another person. Under these circumstances, we will only disclose the PHI to someone who is able to help prevent or decrease the threat. 
   5. PUBLIC HEALTH ACTIVITIES: We may use or disclose PHI about you as necessary for public health activities if required to do so by law; for example: reporting child or elder abuse or neglect. We will use or disclose your PHI to the appropriate government agency if we believe you have been the victim of abuse, neglect or domestic violence.
   6. HEALTH OVERSIGHT ACTIVITIES: We may disclose PHI about you to a health oversight agency for activities authorized by law. Oversight agencies may include government agencies that oversee the healthcare system, government benefit programs such as Medicare or Medicaid.
   7. DISCLOSURES IN LEGAL PROCEEDINGS: In limited circumstances, and as authorized by law, we may disclose your PHI to a court or other administrative tribunal.
   8. LAW ENFORCEMENT ACTIVITIES: We may disclose your PHI to a law enforcement official for law enforcement purposes in limited circumstances as authorized by law. 
   9. MEDICAL EXAMINERS OR FUNERAL DIRECTORS: We may provide PHI about you to a medical examiner and/or funeral director according to law.
   10. NATIONAL SECURITY AND PROTECTIVE SERVICES FOR THE PRESIDENT AND OTHERS: We may disclose medical information about you to authorized federal officials for intelligence, counter-intelligence, and other national security activities authorized by law.
   11. WORKERS COMPENSATION: We may disclose PHI about you to comply with the Massachusetts Workers Compensation Law. 
6. YOUR RIGHTS REGARDING YOUR PHI:
   
   1. YOU HAVE THE RIGHT TO: 
      
      1. Inspect and copy your PHI
      2. Right to request amendment of your PHI
      3. Right to restrict disclosures of your PHI
      4. Right to request confidential communications of your PHI
         
         In order to do any of the above, you must submit a “PHI Request for Action Form” to a program director managing the services you are receiving at one of Riverside Community Care’s programs. This form can be accessed by contacting Riverside Community Care’s Privacy Officer. The Riverside Community Care program director will document receipt of this request and decide if they may honor the request. The request will not be honored if it will create false or inaccurate information or if the request could lead to harmful health or safety outcomes for you. 
   2. BREACHES: Individuals’ PHI that has been breached will be notified in writing, as required by law. 
   3. CONFIDENTIALITY OF ALCOHOL AND SUBSTANCE USE RECORDS: Riverside Community Care agree to protect the confidentiality of client records governed by 42 CFR Part 2. 
   4. RECORD RETENTION: Riverside Community Care will maintain person served records for the period of time required by law.
   5. CHANGES TO THIS NOTICE: We reserve the right to change the terms of this Notice. We also reserve the right to make the revised or changed Notice effective for PHI that we already have about you as well as any PHI we receive in the future. You may obtain a copy of the current Notice upon request or on the Riverside Community Care website.
   6. RIGHT TO A PAPER COPY OF THIS NOTICE: You have the right to obtain a paper copy of this Notice. 
   7. RIGHT TO FILE A COMPLAINT: You have the right to file a complaint if you believe your privacy rights were violated by Riverside Community Care. Your care will not be affected if you file a complaint. You may file a complaint by contacting the Privacy Officer listed below:
      
      Riverside Community Care’s Privacy Officer: 
      VP of Quality Management
      270 Bridge Street, Suite 301 
      Dedham MA 02026
      781.320.5383
      
      You may also file a complaint with the Secretary of the US Department of Health and Human Services, Office of Civil Rights, at (617) 565-1340.