We understand that your health and medical information about you is personal. We are required by law to maintain the privacy of your PHI, to notify you following a breach of your unsecured PHI, and to provide you with this notice of our legal duties and privacy practices with respect to your PHI. This notice applies to the information we maintain concerning the services you receive that are covered by the Lakeshore Regional Entity. Each service provider may have different policies and/or notices regarding the use and disclosure of your PHI created and provided by that service provider’s organization.

This notice will tell you about the ways in which we may use and disclose (share with others) your PHI. It also describes our obligation and your rights regarding the use and disclosure of PHI.

We may use and disclose PHI for a variety of reasons. We have a limited right to use and/or disclose your PHI without your authorization for the purpose of treatment, payment or our health care operations. Other uses and disclosures require your written authorization unless the law permits or requires us to make the use or disclosure without your authorization. If we disclose your PHI to a third party in order for that party to perform a function on our behalf, the third party must agree that it will extend the same degree of privacy protection to your PHI that we do. Subject to the limitations of the Michigan Mental Health Code, and Title 42, Part 2 of the Code of Federal Regulations, we may use or disclose your PHI without your authorization as follows:

Treatment. We may use and disclose your PHI to health care providers under contract with Lakeshore Regional Entity in order to provide and coordinate your health care and related services. For example, we may disclose the needed parts of your PHI to a Community Mental Health Agency that is involved in taking care of you.

Payment. We will disclose your PHI in order to receive or make payment for the mental health and/or substance use disorder treatment services provided to you. For example, we may disclose your PHI with Medicaid and/or our contracted service providers to make sure services provided to you are medically necessary and to facilitate and/or receive payment for the treatment and services you receive.

Health Care Operations. We may use and disclose your PHI to support the business activities of this agency (operations purposes). For example, we may use your PHI in connection with: making sure we meet important goals and standards; judging how well our employees do their job; training workers and volunteers; licensing or accreditation of our agency; fraud and abuse detection programs; business planning and development; and other general administrative activities.

Fundraising and Other Communications. We may use or disclose parts of your PHI to offer you information that may be of interest to you. For example, we may use your name and address to send you newsletters or other information about activities. If we contact you to raise funds, we will inform you of our intention and your right to opt out of receiving such communications.

Business Associates and Subcontractors. We may contract with individuals and entities known as Business Associates to perform various functions or provide certain services. In order to perform these functions or provide these services, Business Associates may receive, create, maintain, use and/or disclose your PHI, but only after they sign an agreement with us requiring them to implement appropriate safeguards regarding your PHI. Similarly, a Business Associate may hire a Subcontractor to assist in performing functions or providing services in connection with your services. If a Subcontractor is hired, the Business Associate may not disclose your PHI to the Subcontractor until after the Subcontractor enters into a Subcontractor Agreement with the Business Associate that also requires the Subcontractor to safeguard your PHI.

Avert a Serious Threat to Health or Safety. We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

Public Health. We may disclose parts of your PHI to the Public Health Department when the law requires us to do so. This disclosure would only be made for the purpose of controlling disease, injury or disability.

Health Oversight Entities. We may disclose your PHI to agencies that are responsible for making sure our services meet quality standards. They may need your PHI for activities such as audits, investigations and inspections. Agencies that use this information may include the Centers for Medicare and Medicaid Services and the Michigan Department of Community Health.

Law Enforcement. We will disclose your PHI when required to do so by federal, state or local law. For example, we may disclose PHI in the course of any court or administrative proceeding, if we are ordered to do so and/or to meet legal requirements. We may also disclose PHI for law enforcement purposes, such as investigation of a crime, but only if such disclosures comply with Michigan law.

Food and Drug Administration. We may disclose your PHI if the Food and Drug Administration requires it: for example, to report adverse events or product defects or problems; help track products; and allow product recalls.

Coroners or Medical Examiners. We may disclose PHI to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties.

Research Organizations/Individuals. We may disclose your PHI to researchers only with your authorization.

Department of Health and Human Services (HHS). We must release your PHI to HHS so they can make sure we are following the law. We also will release your PHI if we suspect there may have been child or vulnerable adult abuse or neglect. Federal and State Laws require these reports. Michigan law does not require us to notify you when we make a report about abuse or neglect.

As Required by Law. We will disclose your PHI when required to do so by federal, state or local law.

You have the following rights regarding your PHI which we maintain:

You have the right to inspect and receive a copy of your PHI. You have the right to request access to the portion of your PHI that is contained in a designated records set for as long as we maintain the PHI. “Designated record set” means medical and billing records and any other records that this agency uses for making decisions about you. This includes the right to inspect the information as well as the right to a copy of the information. You may request that the information be sent to a third party. You must submit a request for access in writing to the Lakeshore Regional Entity Privacy Officer. If you request a copy of the information, we may charge a reasonable fee for the costs of copying, mailing or other supplies associated with your request (such as a thumb drive in the case of a request for electronic information). We may deny your request to inspect and copy in certain circumstances. If you are denied access to medical information, you may request that the denial be reviewed by contacting our Privacy Officer.

If we maintain your PHI electronically in a designated records set, we will provide you with access to the information in an electronic form and format you request if readily producible or, if not, in a readable electronic form and format as agreed to by you and Lakeshore Regional Entity.

Under federal law you may not see or copy the following that may be contained in your record: psychotherapy notes; information gathered for use in court or at hearings; PHI that is covered by a law that states you may not see it and/or information assigned or developed as part of a peer review function.

Right to Amend. If you feel that PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for Lakeshore Regional Entity. To request an amendment, your request must be made in writing and submitted to the Privacy Officer. In addition, you must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• is not part of the treatment information kept by Lakeshore Regional Entity;


• was not created by us, unless the person or entity that created the information is no longer available to make the amendment;


• is not part of the information which you would be permitted to inspect and copy; or is accurate and complete

Right to Request Restrictions. You have the right to request a restriction or limitation regarding your PHI that we use or disclose for treatment, payment or health care operations. You also have the right to request a limit on your PHI that we disclose to someone who is involved in your care or the payment for your care, like a family member or friend. To request restrictions, you must make your request in writing to the Privacy Officer. In your request, you must tell us: what information you want to limit, whether you want to limit our use, disclosure or both, and to whom you want the limits to apply.

We are not required to agree to your request. Please discuss any restriction you wish to request with the Lakeshore Regional Entity Privacy Officer.

Right to Request Confidential Communications. You have the right to request that we communicate with you about your services in a certain way or at a certain location. For example, you can ask that we only contact you at work or that we send mail to your Post Office box instead of your home address. To request confidential communications, you must make your request in writing to the Privacy Officer. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to an Accounting of Disclosures. You have the right to request an accounting of certain disclosures of your PHI. The accounting will not include disclosures to carry out treatment, payment and health care operations, disclosures to you about your own PHI, disclosures pursuant to an individual authorization or other disclosures as set forth in HIPAA privacy policies and procedures. To request this list or accounting of disclosures, you must submit your request in writing to the Privacy Officer. Your request must state a time period which may not be longer than six years. Your request should indicate in what form you want the list (for example, paper or electronic). The first list you request within a 12-month period will be free. For additional lists, we may charge you for the reasonable costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Effective at the time prescribed by federal regulations, you may also request an accounting of uses and disclosures of your PHI maintained as an electronic health record.

Right to a Paper Copy of this Notice. Even if you received this notice electronically, you have the right to a paper copy of this notice. You may ask us to give you a paper copy of this notice at any time. To obtain a paper copy of this notice, contact the Privacy Officer.

Genetic Information. If we use or disclose PHI for underwriting purposes with respect to your services, we will not use or disclose PHI that
contains your genetic information for such purposes.

Breach Notification Requirements. You have a right to be notified upon a breach of your unsecured PHI. We will also inform HHS and take any other steps required by law.

Your Written Permission is Required for Other Uses and Disclosures of Your PHI. The following uses and disclosures of your PHI will be made only with your written authorization:

• Uses and disclosures of PHI for marketing purposes;
• Disclosures that constitute a sale of your PHI; and
• Uses and disclosures of psychotherapy notes other than to carry out the treatment, payment, and health care operations set forth at 45 CFR § 164.508(a)(2).

Other uses and disclosures of your PHI not covered by this notice or applicable laws will be made only with your written permission. If you provide us permission to use or disclose your PHI, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose your PHI for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission.

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for PHI we already have about you as well as any information we receive in the future. We will notify you in the event of a change.