THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

THIS NOTICE ALSO DESCRIBES:

• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION;
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION.

YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM).

IF YOU HAVE ANY QUESTIONS, CONTACT THE PRIVACY OFFICER AT: (231) 638-9809 OR privacy@lsre.org.

This notice is being provided to you pursuant to the federal law known as HIPAA and an amendment to that law, known as HITECH. Other statutes and regulations including, for example, the Michigan Mental Health Code and Part 2 of Title 42 of the Code of Federal Regulations, may further restrict our use and disclosure of your Protected Health Information. When that is the case, the greater restrictions or protections apply.

Protected Health Information (PHI) is all individually identifiable health information that is created or received by Lakeshore Regional Entity that relates to your past, present, or future physical or mental health condition, the provision of health care services, and payment for those services. Examples of identifiable health information include: your name, address, telephone number, and date of birth; your diagnosis (the condition for which you are receiving treatment), and your treatment plan and goals.

Our Pledge Regarding Your Protected Health Information

We understand that health and medical information about you is personal. We are required by law to maintain the privacy of your PHI, to notify you following a breach of your unsecured PHI, and to provide you with this notice of our legal duties and privacy practices with respect to your PHI. This notice applies to the information we maintain concerning the services you receive that are covered by the Lakeshore Regional Entity. Each service provider may have different policies and/or notices regarding the use and disclosure of your PHI created and provided by that service provider’s organization.

This notice will tell you about how we may use and disclose (share with others) your PHI. It also describes our obligation and your rights regarding the use and disclosure of PHI.

How We May Use and/or Disclose PHI About You

We may use and disclose PHI for a variety of reasons. We have a limited right to use and/or disclose your PHI without your authorization for treatment, payment, or our healthcare operations. Other uses and disclosures require your written authorization unless the law permits or requires us to make the use or disclosure without your authorization. If you are receiving substance use treatment services, you must give us written permission before we may use or disclose your PHI relating to those services, including for treatment, payment, or healthcare operations. In these cases, you may give a single consent for all future uses or disclosures for treatment, payment, and healthcare operations. If we disclose your PHI to a third party so that party can perform a function on our behalf, the third party must agree that it will extend the same degree of privacy protection to your PHI that we do. You understand that PHI that you give us permission to disclose may be redisclosed by the recipient and no longer protected under HIPAA.

Subject to the limitations of the Michigan Mental Health Code, and Title 42, Part 2 of the Code of Federal Regulations, we may use or disclose your PHI without your authorization as follows:

Treatment: We may use and disclose your PHI to healthcare providers under contract with Lakeshore Regional Entity to provide and coordinate your healthcare and related services. For example, we may disclose your PHI to a Community Mental Health Agency that is involved in your care.

Payment: We may disclose your PHI to receive or make payment for the mental health and/or substance use disorder treatment services provided to you. For example, we may disclose your PHI to Medicaid and/or our contracted service providers to make sure your services are medically necessary and to facilitate and/or receive payment for the treatment and services you receive.

Health Care Operations: We may use and disclose your PHI to support our business activities (operational purposes). For example, we may use your PHI to: make sure we meet important goals and standards, judge how well our employees are doing their jobs, train workers and volunteers, or maintain our licensing or accreditation. We may also use and disclose your PHI for compliance, business planning and development, and other general administrative activities.

Fundraising and Other Communications: We may use or disclose parts of your PHI to offer you information that may be of interest to you. For example, we may use your name and address to send you newsletters or other information about activities. LRE does not engage in fundraising; however, if we were to contact you to raise funds, we would inform you of our intention and your right to opt out of receiving such communications. Before using substance use disorder treatment records for fundraising, we would provide you with a clear and conspicuous opportunity to elect not to receive any fundraising communications using such records.

Business Associates and Subcontractors: We may contract with individuals and entities known as Business Associates to perform various functions or provide certain services. To perform these functions or provide these services, Business Associates may receive, create, maintain, use, and/or disclose your PHI, but only after they sign an agreement with us requiring them to implement appropriate safeguards regarding your PHI. Similarly, a Business Associate may hire a Subcontractor to assist in performing functions or providing services in connection with your services, but the Business Associate may not disclose your PHI to the Subcontractor unless the Subcontractor enters into a Subcontractor Agreement with the Business Associate that requires the Subcontractor to safeguard your PHI.

Avert a Serious Threat to Health or Safety: We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure for these purposes would only be to someone able to help prevent the threat.

Public Health: We may disclose your PHI to a public health authority when the law requires us to do so for the purpose of controlling disease, injury, or disability.

Health Oversight Agencies: We may disclose your PHI to health oversight agencies responsible for making sure our services meet quality standards. For example, we may disclose your PHI to the Centers for Medicare and Medicaid Services or the Michigan Department of Health and Human services in the event of an audit, investigation, or inspection.

Law Enforcement: We may disclose your PHI when required by federal, state, or local law. For example, we may disclose your PHI in the course of a court or administrative proceeding if we are ordered to do so and/or to meet legal requirements. We may also disclose PHI for law enforcement purposes, such as investigation of a crime, but only if such disclosure complies with Michigan law.

Food and Drug Administration: We may disclose your PHI if the Food and Drug Administration requires it: for example, to report adverse events or product defects, help track products, or to help with product recalls.

Coroners or Medical Examiners: We may disclose your PHI to a coroner or medical examiner for identification purposes, determining the cause of death, or for the coroner or medical examiner to perform other duties.

Research Organizations/Individuals: We may disclose your PHI to researchers with your authorization.

Department of Health and Human Services (HHS): We may disclose your PHI to HHS so they can make sure we are following the law. We will also disclose your PHI if we suspect child or vulnerable adult abuse or neglect. Federal and State Laws require these reports. Michigan law does not require us to notify you when we make a report about abuse or neglect.

As Required by Law: We will disclose your PHI when required to do so by federal, state, or local law. For example, we may disclose your PHI to the Michigan Department of Health and Human Services as a part of their oversight of the public mental health system.

Substance Use Treatment Records: Substance use treatment records, or testimony relaying the content of such records, may not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless based on your specific written permission or a court order authorizing the use or disclosure. A court order for this purpose must be accompanied by a subpoena or similar legal mandate compelling the disclosure. Such records may only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you or the holder of the record.

Reproductive Health Care: We may not use or disclose your PHI for any of the following activities:

• To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.
• To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.
• To identify any person for any purpose described above.

Attestation. By law, if we collect, receive, or maintain health information that is potentially related to your reproductive health care, in some cases we must obtain an attestation from the health information recipients that they will not use or share that health information for a purpose prohibited by law. For example, the situations requiring an attestation may involve

• Health oversight activities. For example, we may share your reproductive health care-related health information in some situations for health oversight agency audits or inspections, civil or criminal investigations or proceedings, or licensure actions.

• Judicial and administrative proceedings. For example, we may share your reproductive health care-related health information in some situations in response to a court or administrative order, subpoena, or discovery request.


• Law enforcement purposes. For example, we may share your reproductive health care-related health information in some situations for law enforcement purposes, including in response to a court-ordered warrant or a law enforcement official's request for information about a victim of a crime.


• Coroners or medical examiners. For example, we may share your reproductive health care-related health information in some situations to a coroner or medical examiner to identify a deceased person, determine cause of death, or other duties as authorized by law.

Any uses and disclosures not described in this Notice of Privacy Practices will be made only with your written permission.

Your Rights Regarding Your Protected Health Information (PHI) 
You have the following rights regarding your PHI, which we maintain:

Right to inspect and receive a copy of your PHI: You have the right to request access to the portion of your PHI that is contained in a designated records set for as long as we maintain the PHI. “Designated record set” means medical and billing records and any other records that this agency uses for making decisions about you. This includes the right to inspect the information as well as the right to a copy of the information. You may request that the information be sent to a third party. You must submit a request for access in writing to the Lakeshore Regional Entity Privacy Officer. If you request a copy of the information, we may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request (such as a thumb drive in the case of a request for electronic information). We may deny your request to inspect and copy in certain circumstances. If you are denied access to medical information, you may request that the denial be reviewed by contacting our Privacy Officer.

If we maintain your PHI electronically in a designated records set, we will provide you with access to the information in an electronic form and format you request if readily producible or, if not, in a readable electronic form and format as agreed to by you and Lakeshore Regional Entity.

Under federal law, you may not see or copy the following that may be contained in your record:  

• psychotherapy notes; 
• information gathered for use in court or at hearings; 
• PHI that is covered by a law that states you may not see it, and/or information assigned or developed as part of a peer review function.

Right to Amend: If you feel that PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for Lakeshore Regional Entity. To request an amendment, your request must be made in writing and submitted to the Privacy Officer. In addition, you must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• is not part of the treatment information kept by Lakeshore Regional Entity;
• was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
• is not part of the information which you would be permitted to inspect and copy; or is accurate and complete.

Right to Request Restrictions. You have the right to request a restriction or limitation regarding your PHI that we use or disclose for treatment, payment, or health care operations. You also have the right to request a limit on your PHI that we disclose to someone who is involved in your care or the payment for your care, like a family member or friend. You may also restrict disclosures of records to your health plan for services for which you paid in full. To request restrictions, you must make your request in writing to the Privacy Officer. In your request, you must tell us: what information you want to limit, whether you want to limit our use, disclosure, or both, and to whom you want the limits to apply.

We are not required to agree to your request. Please discuss any restrictions you wish to request with the Lakeshore Regional Entity Privacy Officer.

Right to Request Confidential Communications: You have the right to request that we communicate with you about your services in a certain way or at a certain location. For example, you can ask that we only contact you at work or that we send mail to your Post Office box instead of your home address. To request confidential communications, you must make your request in writing to the Privacy Officer. We will not ask the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to an Accounting of Disclosures: You have the right to request an accounting of certain disclosures of your PHI. The accounting will not include disclosures to carry out treatment, payment, and health care operations, disclosures to you about your own PHI, disclosures pursuant to an individual authorization or other disclosures as set forth in HIPAA privacy policies and procedures. To request this list or accounting of disclosures, you must submit your request in writing to the Privacy Officer. Your request must state a time period that may not be longer than six years. If your request involves substance use treatment records, the time period may not be longer than three years. Your request should indicate in what form you want the list (for example, paper or electronic). The first list you request within a 12-month period will be free. For additional lists, we may charge you for the reasonable costs of providing the list. We will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.

Effective at the time prescribed by federal regulations, you may also request an accounting of uses and disclosures of your PHI maintained as an electronic health record.

Right to Discuss: You have the right to discuss this notice with the Privacy Officer.

Right to Elect: You have the right to elect not to receive fundraising communications.

Right to List: You have the right to a list of disclosures of substance use disorder records made in the past 3 years by an intermediary (an organization, other than a federally-funded substance use disorder program or a HIPAA-covered entity or business associate, who received the records under a general designation in your patient consent).

Right to a Paper Copy of this Notice: Even if you received this notice electronically, you have the right to a paper copy of this notice. You may ask us to give you a paper copy of this notice at any time. To obtain a paper copy of this notice, contact the Privacy Officer.

Genetic Information: If we use or disclose PHI for underwriting purposes with respect to your services, we will not use or disclose PHI that contains your genetic information for such purposes.

Breach Notification Requirements: You have a right to be notified following a breach of your unsecured PHI. We will also inform HHS and take any other steps required by law with respect to any such breach.

Your Written Permission is Required for Other Uses and Disclosures of Your PHI: The following uses and disclosures of your PHI will be made only with your written authorization:

• Uses and disclosures of PHI for marketing purposes;
• Disclosures that constitute a sale of your PHI; and
• Uses and disclosures of psychotherapy notes other than to carry out treatment, payment, and health care operations set forth at 45 CFR § 164.508(a)(2).

Other uses and disclosures of your PHI not covered by this notice or applicable laws will be made only with your written permission.

Right to Revoke Permission: If you provide us with permission to use or disclose your PHI, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose your PHI for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission. You also understand that if permission was given as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself.

Changes to this Notice

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for PHI we already have about you, as well as any information we receive in the future. We are required to comply with the notice that is currently in effect. We will notify you in the event of a change in several ways:

• The Notice of Privacy Practices listed on the LRE website (www.lsre.org) will be updated, including the effective date.
• A revised paper copy of the Notice of Privacy Practices will be made available upon request.
• The Community Mental Health agencies within the LRE region and the service providers within their networks will be instructed to distribute the revised Notice of Privacy Practices.
• The revised Notice of Privacy Practices will be included in the next Newsletter distribution.