Notice of Privacy Practices and Limits of Confidentiality
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY!
Updated Notice Effective Date: August 26, 2021
The Haven Detox is a provider of treatment for substance use disorder, and is obligated to the highest levels of
confidentiality. Accordingly, The Haven Detox, is subject to the confidentiality requirements of 42 CFR Part 2,
a federal regulation that requires the highest levels of privacy for patients of substance use disorder treatment
programs. For a thorough resource regarding the confidentiality of protected health information, please see
The Confidentiality of Alcohol And Drug Abuse Client Records Regulation and the HIPAA Privacy Rule: Implications
For Alcohol And Substance Abuse, which was issued by the United Statements Department of Health and Human
Services Substance Abuse and Mental Health Services Administration (SAMHSA). This document explains how
Federal regulations restrict communications that could identify an individual by “programs” that provide
substance use and/or mental health diagnosis, treatment, or referral for treatment.
Specifically, 42 CFR Part 2 protects any and all information that could reasonably be used to identify an
individual and requires that disclosures be limited to the information necessary to carry out the purpose of the
disclosure. See 42 CFR §§2.11 and 2.13(a). Under the Privacy Rule, a program may not use or disclose
“protected health information” (PHI) except as permitted or required by the Rule. See 45 CFR §164.502(a).
Purpose
The purpose is to decrease the risk that information about individuals in recovery will be disseminated and
that they will be subjected to discrimination and to encourage people to seek treatment for substance abuse
disorders. A complete version of the HIPAA regulations can be found in Title 45 and Title 42 Part 2 of the Code
of Federal Regulations. If you have questions about any part of this Notice or if you want more information
about the privacy practices at The Haven Detox or would like to request a paper copy of the most recent version,
please contact:
Haven Health Management
Attn: Quality Assurance Dept.
2925 10th Ave. N.
Palm Springs, FL 33461
Phone: (561) 516-0734
Email: [email protected]
Understanding Protected Health Information and Your Medical Record
Protected Health Information is also called PHI and typically includes your name, address, date of birth, billing
arrangements, care, services, treatments, laboratory and assessment results, medications, and other
information that relates to your health, health care provided to you, or payment for health care provided to
you. PHI does NOT include information that is de-identified or cannot be linked to you.
The Haven Detox obtains most of its PHI directly from you by asking questions and through care applications,
and assessments, and when allowed from family or collateral sources. We may collect additional personal
information depending on the nature of your needs and consent to make additional referrals and inquiries. We
may also obtain PHI from community health care agencies, other governmental agencies, or health care
providers as we set up your service arrangements. Substance abuse treatment records may also contain mental
health diagnoses, information on STD’s, and HIV status.
Each time a service is provided, there is electronic documentation of the service by the provider. Your
electronic medical records contain, but is not limited to, screenings, assessment, symptoms, diagnosis, progress
notes treatment plan, medications, laboratory results, follow-up care, discharge planning, and treatment
recommendations. This Protected Health Information (PHI), often referred to as your medical record, serves
as a basis for planning your treatment, a means to communicate between service providers involved in your
care, as a legal document describing your care and services, and verification for you and/or a third-party payer
that the services billed were provided to you. It can also be used as a source of data to assure that we are
continuously monitoring the quality of services and measuring outcomes. Understanding what is in your
medical record and how, when, and why we use the information helps you make informed decisions when
authorizing disclosure to others. Your health information will not be disclosed without your authorization
unless otherwise required or allowed by State and Federal laws, rules, or regulations.
All reasonable efforts to use, disclose, and request only the amount of PHI needed to accomplish the intended
purpose of the use, disclosure, or request will be made. Access to PHI by staff will be on a need-to-know basis
and only those who have a need for the information in connection with their duties that arise out of the
provision of diagnosis, treatment or referral for treatment of alcohol or drug abuse shall have access to the
information needed to carry out the service.
Limits of Confidentiality/Use and Disclosure of PHI Without Consent
Federal laws require or allow that we share your health information, including alcohol and drug abuse records,
with others in specific situations in which you do not have to give consent, authorize or have the opportunity
to agree or object to the use and disclosure. Prior to disclosing your health information under one of these
exceptions, we will evaluate each request to ensure that only necessary information will be disclosed. All other
disclosures will be made only with written consent or authorization. Under the following situations, the types
of uses and disclosures The Haven Detox may make without consent or authorization are:
- In connection with treatment, payment, or healthcare operations;
- To qualified service organizations or business associates who provide services to the program’s
treatment, payment, or health care operations; - In medical emergencies;
- When there is a court order;
- To auditors and evaluators;
- To research if the information will be protected as required by Federal regulations;
- To report suspected child or elderly abuse or neglect; and
- To report a crime or threat to commit a crime on program premises or against program personnel.
Federal law and regulations do not protect any information about a crime committed by a Client either
at the program or against any person who works for the program or about any threat to commit such
a crime.
Federal laws and regulations do not protect any information about elderly abuse, suspected child abuse
or neglect, threats to harm to self or others from being protected or leased to under State law to
appropriate State or local authorities beyond Federal CFR 42-Regulations. (See 42 U.S.C. 290dd-3 and 42
U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for Federal regulations)
How The Haven Detox May Use or Disclose Your Health Information
Any disclosure of PHI will be made with expressed written consent of the client, except where otherwise
permitted by law (see Limits of Confidentiality/Use and Disclosure of PHI Without Consent above). The
authorization may be revoked at any time, unless the program has taken action in reliance on the consent or
authorization. Once information is disclosed, The Haven Detox can no longer guarantee the protections under
federal confidentiality laws as there is always the potential for the recipient to re-disclose information
The Haven Detox will release protected health information only when a valid release of information complies
with the applicable requirements of 45 CFR §164.508. A proper consent form must contain, at minimum,
these elements:
• Name or general designation of the program or person permitted to make the disclosure
• Name or title of the individual or name of the organization to which disclosure is to be made
• Name of the client
• Purpose of the disclosure
• How much and what kind of information is to be disclosed
• Signature of client
• Date on which consent is signed
• Date, event, or condition upon which consent will expire if not previously revoked
• A statement that the consent is subject to revocation at any time except to the extent that the
program has already acted on it
• A statement that the information disclosed cannot be re-disclosed
• A statement that the patient will be provided a copy of the signed release
A general medical release form, or any consent form that does not contain all the elements listed above,
is not acceptable.
The following categories describe all the ways that The Haven Detox may use or disclose your health
information. Any use or disclosure of your health information will be limited to the minimum information
necessary to carry out the purpose of the use or disclosure. Note that we can only use or disclose alcohol and
drug abuse records with your consent or as specifically permitted under federal law unless the use falls within
the “Limits of Confidentiality” (see below). Remember: You can revoke your authorization at any time;
however, we will be unable to take back any disclosures that have already been made with your
permission.
To Obtain Payment – The Haven Detox may use or disclose your health information to insurance companies
to determine eligibility for plan benefits, obtain authorizations, facilitate payment for the treatment and
services you receive, and/or determine plan responsibility for benefits. Health information may be shared with
private insurance to determine medical necessity of services or determine whether a specific service or
treatment is covered under your plan.
Treatment/Healthcare Operations – The Haven Detox may use and disclose health information about you to
carry out necessary quality assurance checks and improvement activities such as handling and investigating
complaints, reviewing charts for compliance, competency of providers, auditing, etc. The Haven Detox may use
and disclose your health information to provide and coordinate appropriate treatment services, formulate
treatment plans, set up referrals with other providers, etc. We may also share your health information with
emergency treatment providers when you need emergency services. We may also communicate and share
information with other behavioral health service Providers who have Contracts with The Haven Detox with
whom we have Business Associate Agreements. We require the contractor to appropriately safeguard your
information. Prior to sharing PHI with other providers, not contracted with The Haven Detox, you will be asked
to complete a Release of Information which you can choose to sign or decline.
Required by Law – The Haven Detox may use and disclose your health information when required by statute,
regulation, court order, government agency, we reasonably believe an individual to be a victim of abuse, neglect
or domestic violence, for judicial and administrative proceedings, and enforcement purposes. However, no
information obtained from a provider–even with the client’s consent–may be used in a criminal investigation
or prosecution of a client unless a court order also has been issued in accordance with §2.65 We may disclose
PHI regarding deceased clients as mandated by state law, or to a family member that was involved in your care
or payment for care prior to death, based on your prior consent. A release of information regarding deceased
clients may be limited to an executor or administrator of a deceased person’s estate or the person identified as
next-of-kin.
Public Health – Your health information may be reported to a public health authority or other appropriate
government authority authorized by law to collect or receive information for purposes related to preventing
or controlling disease, injury or disability; reporting to the Food and Drug Administration problems with
products and reactions to medications, and reporting disease or infection exposure.
Health Oversight Activities – We may disclose your health information to health, regulatory and/or oversight
agencies during audits, investigations, inspections, licensure, and other proceedings related to oversight of the
health care system. Information may be reviewed by investigators, auditors, accountants or lawyers who make
certain that we comply with various laws or to audit your file to make sure that no information about you was
given to someone in a way that violated this Notice.
Judicial and Administrative Proceedings – We may disclose your health information in response to a
subpoena or court order in the course of any administrative or judicial proceeding, in the course of any
administrative or judicial proceeding required by law (such as a licensure action), for payment purposes (such
as a collection action), or for purposes of litigation that relates to health care operations where The Haven
Detox is a party to the proceeding. However, a subpoena must be attached to a release with the federally
required information prior to releasing PHI.
Public Safety/ Law Enforcement – We may disclose your health information to appropriate persons in order
to prevent or lessen a serious or imminent danger or threat to the health or safety of a particular person or the
general public or when there is likelihood of the commission of a felony or violent misdemeanor.
Research – Under certain circumstances, and only after a special approval process, we may use and disclose
your health information to help conduct research.
Incidental Uses and Disclosures – Incidental uses, and disclosures of PHI are those that cannot be reasonably
prevented, are limited in nature and that occur as a by-product of a permitted use or disclosure. Such incidental
disclosures are permitted if The Haven Detox uses reasonable safeguards and use to disclose only the minimum
amount of PHI necessary.
Disclosures of Health-Related Benefits or Services – The Haven Detox may want to contact you regarding
service reminders, alumni meetings, coordination of care, follow-up services, or for other reasons that may be
of interest to you. You will be asked to sign a consent for follow-up in cases where you may be contacted postdischarge. You have the right to decline contact or revoke your release at any time.
To Personal Representatives – The Haven Detox may disclose your health information to a person you have
designated to act on your behalf and make decisions about your care in accordance with state law. We will act
according to your written instructions in your chart and will require anyone claiming to be your personal
representative to provide proof/verification.
To Family and Friends – The Haven Detox may disclose your health information to persons that you indicate
are involved in your care or the payment of care. These disclosures may occur when you are not present if you
agree and do not express objection. These disclosures may also occur if you are unavailable, incapacitated, or
facing an emergency medical situation and we determine that a limited disclosure may be in your best interest.
We may also disclose limited PHI to a public or private entity that is authorized to assist in disaster relief efforts
in order for that entity to locate a family member or other person that may be involved in caring for you. You
have the right to limit or stop these disclosures.
Restricting Uses and Disclosures of Protected Health Information.
45 CFR § 164.522 details your right to request privacy protection for protected health information (PHI). Be
advised that restrictions on disclosure of information cannot be accepted except when the individual, family
member, or other person has provided payment in full by sources other than the insurance company for all
services on behalf of the individual. If the individual is paying privately for treatment and no insurance
company is being billed, all services must be paid in full prior to accepting a restriction. All restrictions must be
documented in accordance with 45 CFR §160.530(j) of Subchapter C in Title 45 of the Code of Federal
Regulations.
The Haven Detox must permit an individual to request that we restrict:
a. Uses or disclosures of PHI about the individual to carry out treatment, payment, or healthcare
operations; and
b. Disclosures permitted under 45 CFR §164.510(b) – see above Notice of Privacy Practices
The Haven Detox must agree to the request of an individual to restrict disclosure of PHI to a health plan, if:
a. The disclosure is for the purpose of carrying out payment or healthcare operations and is not
otherwise required by law; and
b. The PHI pertains to a service for which the individual, family member, or person other than the health
plan on behalf of the individual, has paid The Haven Detox in full.
If The Haven Detox agrees to a restriction, we may not use or disclose PHI in violation of the restriction, except
when the individual who requested the restriction is in need of emergency treatment and the restricted PHI is
needed to provide that treatment. In this case, we may use or disclose the PHI to the health care provider to
provide such treatment to the individual. If restricted information is disclosed to a health care provider for
emergency treatment The Haven Detox must request that the healthcare provider not further use or disclose
the information.
The Haven Detox may terminate a restriction, if:
a. the individual agrees to or requests termination in writing;
b. the individual orally agrees to the termination and the oral agreement is documented; or
c. The Haven Detox informs the individual that it is terminating its agreement to a restriction, except that
such termination is: - not effective for PHI restricted as noted above; and
- only effective with respect to PHI created or received after it has so informed the individual
If you would like to request a restriction on the use or disclosure of PHI, please advise staff and it will be
submitted for approval. You must provide specific information as to what you would like restricted.
Statement of Your Health Information Rights
Although your health information is the physical property of The Haven Detox, the information belongs to you.
You have the right to request, in writing, certain uses and disclosures of your health information. There are
special circumstances in which The Haven Detox may deny a request even though it falls under the rights of the
individual. Once you have initiated a request to act upon your rights, The Haven Detox will either provide the
requested information to the individual or provide a reason in writing explaining the reason for denial within
30 days. If an extension is needed, the individual will be notified in writing.
You may exercise any of the rights below by contacting the Quality Assurance Department using the
contact information at the end of this document.
Your rights with respect to protected health information are:
Right to Inspect and Copy – You have the right to inspect and copy your PHI in a designated record set except
where State law may prohibit client access. A designated record set contains medical, clinical, billing, and case
management information. If we do not have your PHI record set but know who does, we will inform you how
to get it. If our PHI is a copy of information maintained by another health care provider, we may direct you to
request the PHI from them. Should we deny your request for access to information contained in your designated
record set, you have the right to ask for the denial to be reviewed by another healthcare professional designated
by The Haven Detox.
Right to Request Amendment – You have the right to request certain amendments to your PHI if, for example,
you believe a mistake has been made or a vital piece of information is missing. The Haven Detox is not required
to make the requested amendments and will inform you in writing of our response to your request.
Right to Accounting of Disclosures – You have the right to receive an accounting of disclosures of your PHI
that were made by The Haven Detox for a period of six (6) years prior to the date of your written request. This
list of PHI that has been disclosed does not include disclosures for purposes of treatment, payment, health care
operations or certain other excluded purposes, but includes other types of disclosures, including disclosures
for public health purposes or in response to a subpoena or court order.
Revoke Authorizations – You have the right to revoke any authorization you have provided, except to the
extent that The Haven Detox has already relied upon the authorization.
Right to Receive Confidential Communications – You have the right to receive your health information
through a reasonable alternative means or at an alternate location. To request confidential communications,
you must submit your request in writing to the Quality Assurance Department at the address listed below. We
are not required to agree to your request.
Right to be Notified of a Breach – You have the right to be notified if we (or one of our Business Associates)
discover a breach of your unsecured protected health information. Notice of any such breach will be made in
writing and in accordance with federal requirements.
Right to Request Restriction of Use and Disclosure – You have the right to request privacy protection of your
PHI. The Haven Detox will accommodate reasonable requests under a specific circumstance which can be found
under the section “Restricting Uses and Disclosures of Protected Health Information” in this Notice of Privacy
Practices. The Haven Detox is not required to agree to your request, and you cannot place limits on uses and
disclosures that we are legally required or allowed to make.
Right to a Copy of Privacy Practices and Paper Copy – You have a right to receive an electronic copy of this
Notice of Privacy Practices and any revised notices at any time.
Responsibilities and Obligations of Facility
The Haven Detox is required by law to maintain the privacy and security of Protected Health Information that
we collect, create, and receive about your past, present, or future health condition including health care we
provide to you and payment for services. The Haven Detox is also required to provide clients with notice of the
facility’s legal duties and privacy practices, including any changes to our policies. We are only allowed to use
and disclose protected health information in the manner described in this Notice. To comply with these state
and federal laws, The Haven Detox has adopted policies and procedures that require its employees, contractors,
and business associates to obtain, maintain, use and disclose PHI in a manner that protects client privacy. In
the case of a breach of unsecured protected health information, all affected individuals will be notified in
writing via mail. Clients are encouraged to keep their address up to date by contacting the Quality Assurance
Department. The contact information can be found below.
Changes to This Notice and Distribution
The Haven Detox is required by law to provide you with this notice which includes our legal duties, privacy
practices, and process for changing our policies. The Haven Detox must abide by the terms of the Notice
currently in effect. The Haven Detox reserves the right to amend this Notice of Privacy Practices at any time in
the future and to make the new Notice provisions effective for all health information that it maintains. If we
have more than one Notice of Privacy Practices, the individual will be provided with the Notice that pertains to
them. The most recent Notice of Privacy Practices will always be posted in a common area of each facility and
facility building and entered into the EMR to ensure the recent version is reviewed and signed by clients upon
admission. The Client Handbook will be updated as needed. You may submit a written request at any time using
the contact information at the end of this form and the most recent notice will be provided to you.
Complaints
Complaints about this Notice of Privacy practices or about how we handle your health information should be
directed to the Haven Health Management Quality Assurance Department at 2925 10th Ave. N. Palm Springs, FL - You may also contact the Director of Quality Assurance via email at
[email protected] or by phone at (561) 516-0734. The Haven Detox will not retaliate
against you in any way for filing a complaint. All complaints to The Haven Detox must be submitted in writing.
If you believe your privacy rights have been violated, you may also file a complaint with the Secretary of the
Department of Health and Human Services online at www.hhs.gov/ocr/privacy/hipaa/complaints/ or call
(800) 368-1019. You may also submit your complaint in writing to:
The U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll Free: 1-877-696-6775
Contact
If you would like to have a more detailed explanation of these rights, or if you would like to exercise one or
more of these rights, or if you have a complaint, please contact the Quality Assurance Department at:
Haven Health Management
Attn: Quality Assurance Dept.
2925 10th Ave. N.
Palm Springs, FL 33461
Phone: (561) 516-0734
Email: [email protected]
