Notice of Privacy Practices 

EFFECTIVE DATE OF NOTICE

October 7, 2024

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

HealthReach Community Health Centers (HRCHC) is required by law to maintain the privacy of your protected health information (PHI), to provide you with this Notice of HRCHC’s legal duties and privacy practices with respect to your PHI, and to notify you in the event of a breach of any unsecured PHI HRCHC maintains about you. While required to abide by the terms of the Notice that is currently in effect, HRCHC reserves the right to change HRCHC’s privacy practices at any time and to make the new Notice provisions effective for all PHI that it maintains about you. If HRCHC’s privacy practices change, HRCHC will provide you with a revised Notice at your next visit. HRCHC is an organization with 11 health centers, two dental practices, a school based health center, and a Central Administrative office, all of which share one medical records system.

Uses and Disclosures of Your PHI When Your Authorization Is Not Required:

Treatment, Payment, and Healthcare Operations: HRCHC may use and disclose your PHI, without your authorization, for purposes of treatment, payment, and healthcare operations.

For example:
• Treatment: HRCHC has an integrated medical record. This means that Mental Health, Substance Abuse, and HIV related information is shared among medical and behavioral health providers on a need-to-know basis without additional written permission from patients. Your PHI may be used or disclosed between HRCHC practice locations or with other health care providers and facilities involved in your care (including pharmacists and medical equipment suppliers), to develop a diagnosis and treatment plan, to coordinate your care, to arrange for referrals, to send appointment reminders to you, and for other treatment-related purposes.
• Payment: HRCHC may disclose your PHI to your insurance carrier, health plan or other third-party payors (e.g., Medicare, MaineCare) to secure payment on your behalf, and to determine your eligibility for coverage and benefits.
• Operations: HRCHC may use and disclose your PHI for health care operations purposes, such as quality review and improvement activities, risk management activities, training, and audit activities.

HealthInfoNet: HRCHC shares information with Maine’s state-designated, state-wide electronic health information exchange called HealthInfoNet. HealthInfoNet allows HRCHC and other participating Maine healthcare providers who treat you to share certain limited health information about you. However, the following information will not be disclosed to HealthInfoNet or made accessible to providers participating in HealthInfoNet without your specific authorization: (i) information maintained by substance abuse treatment programs, (ii) certain information maintained by licensed mental health facilities and professionals, (iii) HIV information, and (iv) genetic test results. Health information stored on HealthInfoNet’s network may also be disclosed to governmental entities for certain required public health reporting purposes. HealthInfoNet’s computer system tracks everyone who electronically accesses your information. You can request a list of who accesses your information from HealthInfoNet.

Opting Out of HealthInfoNet: You may opt out of having your information shared through HealthInfoNet. You may opt out by contacting HealthInfoNet (www.hinfonet.org) and completing an Opt Out form. HRCHC can also provide you with this form. However, there are risks with not participating. Your healthcare providers may not have access to the most current and complete information about you when they need it to treat you or to coordinate your care in an urgent situation. Choosing to opt out could also increase your wait time for care due to the time it takes to get paper copies of your medical records to your treating healthcare providers. If you choose to opt out, you can opt in later. However, if you opt in later, the only healthcare information that will be made accessible to participating HealthInfoNet providers will be healthcare information created after the time you choose to participate. If you decide to opt out, HRCHC will not deny care to you on the basis that you have opted out.

For More Information: If you have any questions about HealthInfoNet, you may contact HRCHC’s Privacy Officer. You may also contact HealthInfoNet at hinfonet.org (website), by email at info@hinfonet.org, by phone at (207) 541-9250, or by mail at 125 Presumpscot St., Portland, ME, 04103.

Business Associates: HRCHC may disclose your PHI to contractors (called “business associates”) performing services on HRCHC’s behalf when such contractors have agreed in writing to appropriately protect your PHI.

Uses and Disclosures Allowed by Law: HRCHC may disclose PHI without your authorization as permitted or required by applicable law, including for any of the following circumstances:
• For public health activities, including mandatory health reports to government agencies;
• To comply with mandatory abuse and neglect reporting laws;
• For health oversight activities by government agencies;
• To comply with court orders, governmental subpoenas, or other lawful processes;
• For certain research purposes provided that certain requirements are met;
• To a coroner, medical examiner, or funeral director for purposes authorized by law;
• For law enforcement purposes, such as to report gunshot wounds, crimes committed on HRCHC premises, or crimes committed against HRCHC personnel;
• For cadaveric organ, eye, or tissue donation purposes;
• To avert a serious threat to health or safety; or
• For Workers’ Compensation purposes.
Specialized Government Functions: HRCHC may use and disclose your PHI for specialized government functions when such uses or disclosures are authorized or required by applicable law, including any of the following circumstances:
• For intelligence, counter-intelligence, and other national security activities authorized by the National Security Act and related Executive Orders;
• For the provision of protective services to the President or other persons or for the conduct of investigations, authorized under applicable federal law;
• For corrections and other law enforcement custodial situations, such as disclosures to a correctional institution or a law enforcement official having lawful custody of an inmate or other individual, of PHI about the inmate or other person when necessary (i) to provide health care to the inmate or person in custody, (ii) for the health and safety of the inmate or person in custody, (iii) for the health and safety of correctional personnel, (iv) for the health and safety of persons responsible for transporting the inmate or person in custody, (v) for law enforcement on correctional facility premises, and (vi) for administering and maintaining the safety, security and good order of the correctional institution;
• With respect to persons who are members of the Armed Forces and of foreign military personnel, HRCHC may use and disclose PHI for activities deemed necessary by appropriate military command authorities to assure the proper execution of a military mission; and
• For purposes of reporting to the National Instant Criminal Background Check System the identity of an individual prohibited from possessing a firearm under federal law if certain requirements are met.
Other Uses and Disclosures:
• HRCHC may disclose your PHI to notify, or assist in the notification of a family member, your personal representative or another person responsible for your care about your location, general condition, or death, if certain requirements are met.
• HRCHC may use PHI to provide information to you about treatment alternatives or other health services.
• HRCHC may disclose your PHI to family members, relatives, or close personal friends, or anyone else identified by you, involved in your care involved in securing payment for your care, or for notification purposes, if certain requirements are met.
• HRCHC may use and disclose your PHI to public or private entities authorized by law or its charter to assist in disaster relief efforts for certain notification purposes, provided certain requirements are met.
• HRCHC may use and disclose your PHI to contact you in the effort to raise money for HealthReach Community Health Centers or our individual health centers. HRCHC will only release to our internal Development Office your name, address, phone number and email. HRCHC will not give the office any medical information about you. If you do not want your name on the list for fundraising requests, please write to us at: Development Office, HealthReach Community Health Centers, 10 Water Street, Suite 305, Waterville, Maine 04901.
Except as described above, HRCHC will not use or disclose your information outside of our organization, except with your written authorization. An authorization may be revoked by sending a revocation to HRCHC in writing, except to the extent that HRCHC has already taken action in reliance on the authorization.

Uses and Disclosures of Your PHI When Your Authorization is Required:

• HRCHC will obtain your written authorization for any use or disclosure of your PHI to sell or market products or services, except in limited circumstances (for example, in face-to-face marketing communications with you or a promotional gift of nominal value). HRCHC will also obtain your written authorization any disclosure of your PHI that involves a sale of your PHI, unless an exception applies under applicable law.
• HRCHC will not photograph or video record you, or use or disclose any photographs and video recordings of you, for non-treatment related purposes, for marketing or public relations purposes, without your written authorization, unless the creation, use or disclosure of such photographs or video recordings are authorized by law (e.g., for HRCHC facility security surveillance purposes).

Special Protections for Certain Types of PHI:

Certain Mental Health Information: If HRCHC maintains PHI about you derived from mental health services provided to you by a psychiatrist, psychologist, clinical nurse specialist, social worker or counseling professional, HRCHC will not disclose such mental health information to another health practitioner or facility outside of HRCHC, for a diagnostic, treatment or continuity of care purpose, without your written authorization, unless such disclosure is:
• Necessary in an emergency;
• To a pharmacist for the purpose of dispensing medication; or
• To a healthcare provider or facility, or to a third-party payor, for purposes of care management or coordination of care.
HRCHC may use this information within HRCHC for your diagnosis, treatment, and continuity of care.
HIV Information: If HRCHC maintains any PHI regarding your HIV status (such as HIV test results or medical records containing HIV information), such information is afforded heightened protection under Maine law and HRCHC will maintain the confidentiality and privacy of such information, and will not use or disclose such information, except as specifically authorized or required by Maine’s HIV confidentiality laws. Examples of permissible disclosures of HIV information that do not require an authorization, include:
• Disclosures to the Maine Department of Health and Human Services’ Bureau of Health when necessary to carry out its statutory duties, including the duty to protect the public health and to notify individuals in at risk for the transmission of communicable diseases;
• Disclosures pursuant to a court order;
• Disclosures in proceedings held under Maine’s communicable disease laws;
• Disclosures in proceedings held pursuant to Maine’s Adult Protective Services Act;
• Disclosures in proceedings pursuant to Maine’s child protection laws;
• Disclosures in proceedings held pursuant to Maine’s mental health laws; and
• Disclosures to utilization review committees or peer review organizations for utilization review, audits, and program evaluation purposes.

Certain Substance Abuse Information: If HRCHC possesses any substance abuse PHI about you that is subject to the heightened federal confidentiality protections afforded to certain substance abuse program records under 42 C.F.R. Part 2, or if HRCHC acquires such PHI from another provider or facility, HRCHC will maintain the confidentiality and privacy of such information, and will not use or disclose such information, except as specifically authorized or required by 42 C.F.R. Part 2. If HRCHC creates, acquires or maintains any substance abuse information about you that is not from a Part 2 substance abuse program, HRCHC will protect the confidentiality of such information and use and disclose such information in the same way.

Reproductive Health Care: Prohibited Uses and Disclosures: HRCHC may not use or disclose your PHI for any of the following activities: (i) to conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care; (ii) to impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care; or (iii) to identify any person for any purpose described in (i) or (ii). For example, if you receive reproductive health care from HRCHC that is lawful under Maine law and/or protected, required, or authorized by Federal law, under the circumstances in which it is provided, and a health oversight agency or a law enforcement official from another state were to request or subpoena your PHI related to such reproductive health care from HRCHC for one of the above prohibited purposes, HRCHC would not be authorized to disclose such PHI in response to the request or subpoena.

Uses and Disclosures Conditioned Upon an Attestation: Additionally, as specified under HIPAA, HRCHC may not use or disclose PHI potentially related to your reproductive health care (i) to a health oversight agency, (ii) in the course of any judicial or administrative proceeding (e.g., in response to a court order, subpoena), (iii) to a law enforcement official, or (iv) to a coroner or medical examiner, unless HRCHC obtains a valid written attestation from the person requesting your PHI related to reproductive health care. The attestation must verify that the requested use or disclosure of your PHI related to reproductive health care is not otherwise prohibited by HIPAA and complies with HIPAA’s requirements.

HRCHC protects, uses, and discloses your other PHI. Examples of permissible disclosures of this information that do not require an authorization include disclosures:
• Within HRCHC for treatment purposes, such as to develop a diagnosis and treatment plan;
• For HRCHC’s healthcare operations, such as reviewing quality of care, if certain requirements are met;
• To other HRCHC personnel who have administrative control over the program within HRCHC that has the information;
• To contractors to perform services for HRCHC, if those contractors agree to protect the information;
• To law enforcement for reporting of crimes against HRCHC personnel or on HRCHC’s premises;
• Under mandatory child abuse and neglect reporting laws;
• Relating to the cause of death of a patient when made under laws requiring the collection of death or other vital statistics, or permitting inquiries into the cause of death, or to personal representatives of an estate or a deceased patient’s spouse or family member;
• To a central registry or to a detoxification program to prevent multiple enrollments of a patient, if certain requirements are met;
• For certain research purposes if certain requirements are met;
• For certain medical emergencies and to the federal Food and Drug Administration when the health of an individual may be threatened by a product;
• For certain audit, evaluation, and quality improvement activities;
• Under a court order that meets certain requirements; or
• When otherwise permitted or required by law.

Your Rights:

Right to Request Restrictions on Uses and Disclosures: You have the right to request restrictions on the use and disclosure of your PHI. If you request that HRCHC not disclose your PHI to a third-party payor health plan for purposes of carrying out payment or health care operations, and you have paid HRCHC in full out of pocket for services provided to you, HRCHC is required to honor your requested restriction. Otherwise, HRCHC is not required to agree to a requested restriction, and it is HRCHC’s policy not to agree to such restrictions unless HRCHC determines, in HRCHC’s sole discretion, that a compelling reason exists to do so.

Right to Request Confidential Communications: You have the right to receive communications from HRCHC in a confidential manner and HRCHC will accommodate reasonable requests. If you would like HRCHC to use an address or telephone number other than your billing address to contact you, you must request so in writing.

Right to Receive an Accounting of Disclosures: You have the right to receive an accounting of certain disclosures of your PHI made by HRCHC in the six years prior to the date of your request if you did not specifically authorize those disclosures. The accounting will not include disclosures made directly to you, disclosures made to others pursuant to your written authorization, disclosures made to carry out treatment, payment, and health care operations for which your written authorization was not required, incidental uses and disclosures, and uses and disclosures for which an accounting is not required by law. To receive such an accounting, please contact HRCHC at the address given below, allowing up to 30 days to process this request.

Right to Access Your Information: You have the right to inspect and copy your PHI in your medical and billing records at reasonable times. If you wish to do so, you will be provided an opportunity to inspect this information within 30 days of receipt of your written request. If HRCHC needs extra time, it may extend the time once for an additional 30 days and we will provide you written notice of the extension. You have the right to receive this information in the form and format of your choosing, if such information can be readily produced in such form and format, or in a readable hardcopy form, or in another format agreed to between you and HRCHC. If HRCHC maintains your PHI in an electronic health record, you have the right to obtain a copy of this information in an electronic format and to direct HRCHC to transmit an electronic copy of your PHI directly to another clearly specified entity or person of your choice. In certain limited circumstances, you may be denied access to this information and records. However, you may request that a decision denying you access to this information and records be reviewed.
Please contact HRCHC’s Privacy Officer if you have questions about your right to access your information. You may be charged reasonable costs for copying your information, or for preparing any summaries that you request.

Right to Request Amendments to Your Information: You have the right to request amendments, corrections and clarifications to PHI contained in your medical and billing records. Your request must be in writing and you must provide a reason supporting your request. If you wish to do so, please submit the proposed amendment in writing to HRCHC at the address given below. If you are requesting a change to the PHI in your treatment record, we will place your request for amendment, correction or clarification in your record. HRCHC may add a response to your record, and will provide to you a copy of our response. If you are requesting a change in other records (that are neither medical nor billing records), HRCHC may deny your request. If your request is denied, we will notify you in writing and provide our reasons for the denial. You have the right to file a statement of disagreement with HRCHC and it may prepare a response to your statement. HRCHC will provide you with a copy of our response.

Special Rules for Minors: If you are a minor authorized by law to consent to health care services on your own behalf and you in fact consent to such services on your own behalf, HRCHC is required to protect the privacy of your PHI with respect to health care services you have consented to on your own behalf in the same way that HRCHC protects the privacy of an adult’s PHI, unless a special exception applies under the law. For example, HRCHC is authorized by law to notify your parent or guardian if, in the judgment of your HRCHC provider failure to inform your parent or guardian would seriously jeopardize your health or would seriously limit the ability of your HRCHC provider to provide treatment to you. Additionally, if you want HRCHC to bill your parent’s insurance for services provided to you, your parents will receive from their insurance company an Explanation of Benefits regarding the services provided to you by HRCHC and, as a result, the fact that you received services from HRCHC will not be confidential from your parents. However, if you do not want your parents to know that you are receiving services from HRCHC, you must notify HRCHC of that fact at the time services are provided to you so that arrangements can be made for payment of such services privately or out-of-pocket, or to determine your eligibility for free or discounted care.

Other Rights:
• You have the right to a paper copy of this Notice of Privacy Practices upon request, even if you agreed to receive this Notice electronically.
• You have the right to request that specific practice staff not have access to your medical records unless it causes an undue hardship for HRCHC.
• You have the right to complain to HRCHC and to the Secretary of the U.S. Department of Health and Human Services if you believe your privacy rights have been violated by HRCHC. To file a complaint, please contact HRCHC’s Compliance Specialist. HRCHC will not retaliate against you for filing a complaint.

For further information about HRCHC’s privacy policies or to submit a complaint, please contact:

Kate Quimby
Compliance Specialist
HealthReach Community Health Centers
P.O. Box 569
Rangeley, ME 04970
(207) 864-2699
Fax: (207) 864-2969