The U. S. Health Insurance Portability and Accountability Act requires Joanne Garlich LLC to provide clients with information as to how your personal data may be used and disclosed and how you can get access to this information.  Please review this Notice of Privacy Practices carefully.

What is “Medical Information”?

 The term “medical information” is synonymous with the terms “personal health information” and “protected health information” for purposes of this Notice. It essentially means any health information that is identifiable, either directly or indirectly, whether oral or recorded in any form or medium, that is created or received by a health care provider (me), health plan, or others and 2) relates to the past, present, or future physical or mental health or condition of an individual (you); the provision of health care (e.g., mental health) to an individual (you); or the past, present, or future payment for the provision of health care to an individual (you).

I am a mental health care provider for Joanne Garlich LLC. More specifically, I am a Licensed Professional Clinical Counselor, licensed by the State of Minnesota through the Board of Behavioral Health and Therapy. I create and maintain treatment records that contain individually identifiable health information about you. These records are generally referred to as “medical records” or “mental health records,” and this Notice, among other things, concerns the privacy and confidentiality of those records and the information contained therein.

 Use and Disclosure of Medical Information:  Treatment, Payment, or Health Care Operations

 Federal privacy rules allow health care providers who have a direct treatment relationship with the patient to use the patient’s personal health information to carry out the health care provider’s own (1) treatment, (2) payment, or (3) health care operations.

1. Treatment: I can disclose your protected health information to another health care provider for treatment purposes.  The word “treatment” includes, among other things, the coordination and management of health care among health care providers or by a health care provider with a third party, consultations between health care providers, and referrals of a patient for health care from one health care provider to another.  An example of a use or disclosure for treatment purposes:  If I decide to consult with another health care provider about your care, I can use and disclose your personal health information, which is otherwise confidential, in order to assist me in the diagnosis or treatment of your mental health condition.  Disclosures for treatment purposes are not limited to the minimum necessary standard, because physicians and other health care providers need access to the full record and/or full and complete information in order to provide quality care.
2. Payment:  An example of a use or disclosure for payment purposes: If your health plan requests a copy of your health records, or a portion thereof, in order to determine whether or not payment is warranted under the terms of your policy or contract, I am permitted to use and disclose your personal health information.
3. Health Care Operations:  An example of a use or disclosure for health care operations purposes: If your health plan decides to audit my practice in order to review my competence and my performance, or to detect possible fraud or abuse, your mental health records may be used or disclosed for those purposes.

PLEASE NOTE: I, or someone in my practice acting with my authority, may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. Your prior written authorization is not required for such contact.

Other Uses and Disclosures of Medical Health Information

Pursuant to the HIPAA Privacy Rule, I am permitted to use and disclose your personal health information (e.g., your mental health records) without your written authorization under certain circumstances, including:

1. Required by Law.  I may disclose protected health information without your authorization as required by law (including by statute, regulation, or court orders);
   1. Public Health Activities. I may disclose protected health information to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and postmarketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OHSA), the Mine Safety and Health Administration (MHSA), or similar state law.
   2. Victims of Abuse and Neglect; Pregnant Women who Use Non-Medically Prescribed Controlled Substances and/or Consume Alcoholic Beverages Habitually or Excessively. As a mandated reporter, I am required to disclose protected health information to appropriate government authorities regarding victims of abuse or neglect relating to children, adolescents, and vulnerable adults and regarding women who are pregnant who have used a controlled substance for a nonmedical purpose including tetrahydrocannabinol or have habitually or excessively consumed alcoholic beverages.
   3. Health Oversight Activities. I may disclose protected health information to health oversight agencies for purposes of legally authorized health oversight activities, such as audits and investigations necessary for oversight of the health care system and government benefit programs.
   4. Judicial and Administrative Proceedings. I may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided.
   5. Law Enforcement Purposes. I may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official’s request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person’s death, if I suspect that criminal activity caused the death; (5) when I believe that protected health information is evidence of a crime that occurred on the premises of my practice; and (6) during a medical emergency not occurring on the premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.
   6. Decedents. I may disclose protected health information to funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law.
   7. Cadaveric Organ, Eye, or Tissue Donation. I may disclose protected health information to facilitate the donation and transplantation of cadaveric organs, eyes, and tissue.
   8. Research. “Research” is any systematic investigation designed to develop or contribute to generalizable knowledge.  The Privacy Rule permits me to use and disclose protected health information for research purposes, without an individual’s authorization, provided I obtain either: (1) documentation that an alteration or waiver of individuals’ authorization for the use or disclosure of protected health information about them for research purposes has been approved by an Institutional Review Board or Privacy Board; (2) representations from the researcher that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purpose preparatory to research, that the researcher will not remove any protected health information from the covered entity, and that protected health information for which access is sought is necessary for the research; or (3) representations from the researcher that the use or disclosure sought is solely for research on the protected health information of decedents, that the protected health information sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is sought.  I also may use or disclose, without an individuals’ authorization, a limited data set of protected health information for research purposes.
   9. Serious Threat to Health or Safety. I may use or disclose protected health information that I believe is necessary to prevent or lessen a serious and imminent threat to a person or the public, when such disclosure is made to someone I believe can prevent or lessen the threat (including the target of the threat). I may also disclose to law enforcement if the information is needed to identify or apprehend an escapee or violent criminal.
   10. Essential Government Functions. An authorization is not required to use or disclose protected health information for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs.
   11. Workers’ Compensation. I may disclose protected health information as authorized by, and to comply with, workers’ compensation laws and other similar programs providing benefits for work-related injuries or illnesses.

PLEASE NOTE: The above list is not an exhaustive list, but informs you of most circumstances when disclosures without your written authorization may be made. Other uses and disclosures will generally (but not always) be made only with your written authorization, even though federal privacy regulations or state law may allow additional uses or disclosures without your written authorization. Uses or disclosures made with your written authorization will be limited in scope to the information specified in the authorization form, which must identify the information “in a specific and meaningful fashion.” You may revoke your written authorization at any time, provided that the revocation is in writing and except to the extent that I have taken action in reliance on your written authorization. Your right to revoke an authorization is also limited if the authorization was obtained as a condition of obtaining insurance coverage for you. If Minnesota law protects your confidentiality or privacy more than the federal “Privacy Rule” does, or if Minnesota law gives you greater rights than the federal rule does with respect to access to your records, I will abide by Minnesota law. In general, uses or disclosures by me of your personal health information (without your authorization) will be limited to the minimum necessary to accomplish the intended purpose of the use or disclosure. Similarly, when I request your personal health information from another health care provider, health plan or health care clearinghouse, I will make an effort to limit the information requested to the minimum necessary to accomplish the intended purpose of the request. As mentioned above, in the section dealing with uses or disclosures for treatment purposes, the “minimum necessary” standard does not apply to disclosures to or requests by a health care provider for treatment purposes because health care providers need complete access to information in order to provide quality care.

Your Rights Regarding Protected Health Information

1. You have the right to request restrictions on certain uses and disclosures of protected health information about you, such as those necessary to carry out treatment, payment, or health care operations. I am not required to agree to your requested restriction. If I do agree, I will maintain a written record of the agreed upon restriction.
2. You have the right to receive confidential communications of protected health information from me by alternative means or at alternative locations.
3. You have the right to get an electronic or paper copy of your medical record.  I will provide a copy or a summary of your health information, usually within 30 days of your request.  I may charge a reasonable fee.  The right to a copy is not absolute; in other words, I am permitted to deny access for specified reasons.
4. You have the right to amend protected health information in my records by making a request to do so in a writing that provides a reason to support the requested amendment. This right to amend is not absolute; in other words, I am permitted to deny the requested amendment for specified reasons. You also have the right, subject to limitations, to provide me with a written addendum with respect to any item or statement in your records that you believe to be incorrect or incomplete and to have the addendum become a part of your record.
5. You have the right to receive an accounting from me of the disclosures of protected health information made by me in the six years prior to the date on which the accounting is requested. As with other rights, this right is not absolute. In other words, I am permitted to deny the request for specified reasons. For instance, I do not have to account for disclosures made in order to carry out my own treatment, payment or health care operations. I also do not have to account for disclosures of protected health information that are made with your written authorization, since you have a right to receive a copy of any such authorization you might sign.
6. You have the right to obtain a paper copy of this notice from me upon request.
7. You have the right to choose someone to act for you.  If you have given someone medical power if attorney or if someone is your legal guardian, that person can exercise you rights and make choices about your healthcare information.  I will make sure the person has this authority and can act for you before I take any action.
8. You have the right and the choice to tell me to share information with your family, close friends, or others involved in your care, and share information in a disaster relief situation.  If you are not able to tell me your preferences, for example if you are unconscious, I may go ahead and share your information if I believe it is in your best interest.  I may also share your information when needed to lessen a serious and imminent threat to health or safety.

PLEASE NOTE: In order to avoid confusion or misunderstanding, I ask that if you wish to exercise any of the rights enumerated above, that you put your request in writing and deliver or send the writing to me. If you wish to learn more detailed information about any of the above rights, or their limitations, please let me know. I am willing to discuss any of these matters with you. As mentioned elsewhere in this document, I am the Privacy Officer of this practice.

My Duties

I am required by law to maintain the privacy and confidentiality of your personal health information. This notice is intended to let you know of my legal duties, your rights, and my privacy practices with respect to such information. I am required to abide by the terms of the notice currently in effect. I reserve the right to change the terms of this notice and/or my privacy practices and to make the changes effective for all protected health information that I maintain, even if it was created or received prior to the effective date of the notice revision. If I make a revision to this notice, I will make the notice available at my office upon request on or after the effective date of the revision, and I will post the revised notice in a clear and prominent location.

As the Privacy Officer of this practice, I have a duty to develop, implement and adopt clear privacy policies and procedures for my practice and I have done so. I am the individual who is responsible for assuring that these privacy policies and procedures are followed not only by me, but by any employees that may work for me in the future. I have trained or will train any employees that may work for me so that they understand my privacy policies and procedures. In general, patient records, and information about patients, are treated as confidential in my practice and are released to no one without the written authorization of the patient, except as indicated in this notice or except as may be otherwise permitted by law. Patient records are kept secured so that they are not readily available to those who do not need them.

Effective Date: 9/01/2013