[Copied from the SCDMH form M-010, “Notice of Privacy Practices” brochure]

NOTICE OF PRIVACY PRACTICES   (Effective April 14, 2003 )

THIS  NOTICE  DESCRIBES  HOW  MEDICAL INFORMATION  ABOUT  YOU  MAY  BE  USED  AND DISCLOSED  AND  HOW  YOU  CAN  GET  ACCESS  TO THIS  INFORMATION.   PLEASE REVIEW IT CAREFULLY.

The South Carolina Department of Mental Health (DMH) is required by Law to protect the privacy of your Protected Health Information (or “PHI”, see Definitions at the end for terms that start with a capital letter). PHI is information identifying you and about your health care or payment for your health care, or information about your past, present, or future medical condition.  We are required by Law to provide you, a DMH Consumer, with this Notice explaining our legal duties and privacy practices concerning your PHI. Identified alcohol and drug Treatment programs usually have stricter privacy requirements.

We must follow the terms of this Notice and only use/disclose PHI as described in this Notice.  We may change the terms of this Notice and make the new Notice effective for all DMH PHI.  A current Notice (with effective date at the top right) is posted in our service waiting areas where you and others will be able to read it, and on our website: www.state.sc.us/dmh. You may get a copy of the current Notice by calling the office where you were or are receiving services and asking that a copy be mailed to you, or ask for a copy during your next visit.

For questions about this Notice or our Privacy Practices, or if you are writing about your PHI, including requests for restrictions on its use or disclosure, about your Privacy Rights described below, or to make a complaint about our Privacy Practices, please contact the local Privacy Officer where you are or were receiving services, or the Privacy Officer, South Carolina Department of Mental Health, P.O. Box 485, 2414 Bull St., Columbia, SC 29202, phone 803-898-8557.

You may also make a complaint to the Secretary of the Department of Health and Human Services (HHS) by calling 877-696-6775 or if you believe your privacy rights have been violated by writing: Office of Civil Rights, Medical Privacy, Complaint Division, U.S. Department of Health and Human Services, 200 Independence Avenue, SW , HHH Building , Room 509H, Washington , D.C. 20201 . Phone: 866-OCR-PRIV (627-7748) TTY: 886-788-4989 or E-mail: www.hhs.gov/ocr. Regardless of how you make a complaint, there will be no retaliation and you will still have the same access to DMH services. 

In General: How We Use/Disclose Your PHI

When we provide Treatment to you, we need to gather, use and share your PHI. Your PHI may identify you by name, address, date of birth, social security number, photo, etc., and include your diagnosis, type of Treatment and other Treatment or Payment information.  After you have the opportunity to review this Notice and object or request some restrictions, we may share your PHI with DMH staff involved in Treatment, Payment and Operations who need to use/share your PHI in their job. We may also share PHI with others involved in your Treatment/Payment outside DMH, including other medical providers, insurance companies, Medicare/Medicaid and other payers. 

We may use/share your PHI in an emergency/your incapacity before you have an opportunity to review this Notice, object or request restrictions. You will have that opportunity after the emergency or incapacity is over.  We may use sign-in sheets at our service sites and call you by name when your medical provider is ready to see you.  We may also share your PHI with Business Associates providing services to DMH by written agreement, such as consultants, and require that they agree to protect your PHI privacy.

When practical and when it will not compromise your Treatment, we will try to accommodate your request to restrict PHI use/disclosure and limit it to the Minimum Necessary to accomplish the purpose for the use/disclosure. Unless permitted in this Notice, we cannot use/share your PHI unless you sign an Authorization. You may cancel an Authorization in writing and we will no longer use/share PHI for that purpose. However, we cannot take back any use/release made with your Authorization and we must keep records of your Treatment.

Some Specific Uses/Disclosures After You Have The Opportunity To Review This Notice, Object And/Or Request Restrictions:

Treatment: We may use/share your PHI needed for your DMH and other providers’ Treatment or care (your diagnosis, medications, treatment plan, etc.), including PHI needed for case management, consultation and referral with/to other Treatment or care providers.  

Payment: We may use/share PHI (Treatment dates or types) to bill/be paid for Treatment (insurance/Medicaid/Medicare or other payer).  We may also share PHI with payers before we provide Treatment to get their approval, or find out if the type of Treatment is covered.

Operations: We may use/share PHI for our Operations, for example, sharing PHI between our offices to determine what services you need.  We may sometimes share PHI for Operations of agencies and organizations with health care accrediting or licensing authority.

General Notification: We may share with your caregiver, family, close friend, or a person whom you identify: your name, location where you are receiving Treatment and your general condition.  If you are in a DMH hospital, ministers/clergy may be told your religion.

Persons Involved in Treatment/Payment: We may share PHI with your caregiver, family, close friend, or other person involved in your Treatment or Payment as needed for your Treatment or Payment.

Keep You Informed: We may phone and/or mail you reminders for appointments, need for our services, Treatment information, health care benefits or related services and satisfaction surveys.

Uses/Disclosures Without Right to Object/Request Restrictions:

Public Health and Health Oversight: We may share PHI with a public health authority such as the S. C. Department of Health and Environmental Control related to: prevention/control of disease, injury or disability; births/deaths, or disease/condition. DMH may share your PHI with the S.C. Department of Social Services, law enforcement or other agency authorized to receive abuse/neglect reports.  We will normally let you know unless it would place you or others at risk.  We may share PHI with the Food and Drug Administration to report adverse events including medication reactions or problems with products.  We may also share PHI with agencies authorized to receive reports for health oversight activities (such as HHS and S.C. Attorney General) for audits, inspections and investigations.

Lawsuits, Disputes or other Legal Proceedings: If you are involved in a legal proceeding, we may share PHI by a court order pursuant to §44-22-100(A)(2), S.C.Code, showing that disclosure is necessary for the proceeding and failure to disclose is against public interest. Without a court order however, a subpoena or other lawful process alone, normally does not permit PHI disclosure, unless from another public agency assuring that disclosure is necessary and that it has attempted to notify you or obtain an order protecting the subpoenaed PHI.

Law enforcement: We may share PHI with law enforcement: if required by Law, such as reporting abuse/neglect; by court order, subpoena, warrant or other lawful process; to identify/locate a suspect, fugitive, witness, missing person or crime victim; suspicion as to cause of death; crime on our premises; crime when responding to emergency not on our premises; or a serious, imminent threat.

Research: We may share PHI for research (for example, a medication study) approved by an institutional review board after review of the research rules to ensure privacy of your PHI.

Serious Threat to Health or Safety and Disaster Relief: We may use or share PHI if needed to prevent a serious/imminent threat to your or another person’s health or safety. We will share PHI only to persons able to lessen/prevent the threat and limited to PHI necessary to lessen or prevent the threat. We may use/share PHI with a public or private entity authorized to assist in disaster emergency relief efforts.

Coroners, Medical Examiners, Funeral Directors and Organ Donation: We may share PHI with a coroner/medical examiner to identify a deceased person/determine cause of death and share PHI with funeral directors as needed to carry out their duties. If you are an organ donor, we may share PHI with applicable organizations.

Correctional Institution: If you are an inmate or otherwise under law enforcement custody, we may share PHI with the correctional institution or law enforcement as needed for your health care, your or other’s health or safety, or institution’s safety/ security.

National Security and Protection for the President: We may share PHI with authorized federal officials for intelligence, counterintelligence and other national security activities authorized by Law.  DMH may also share your PHI with authorized federal officials to provide protection to the President, other authorized persons or foreign heads of state or to conduct special investigations.

Military and VA:  If you are in the military, we may share PHI as required by military command authorities, including for foreign military personnel, to foreign military authority.  We may release PHI for VA determination of veteran’s benefit eligibility.

Court Ordered Treatment/Evaluation or Emergency Admission: We may use/share your PHI as needed for your emergency admission, judicial admission or commitment, or other court ordered Treatment or evaluation. We may share your PHI as needed for participants in such proceedings upon evidence of their appointment/authority, including: judge, designated examiners, your attorney, and guardian ad litem.

By Law: We will share your PHI when otherwise required by Law.

De-Identified Information: We may share information that is not PHI, because it does not identify you, such as in research/data analysis.

Your PHI Privacy Rights

Right to a Paper Copy of this Notice:  You have the right to request a paper copy of this Notice at any time by contacting the Privacy Officer.

Right to Request Restrictions: You have the right to request in writing restrictions on our use/sharing of your PHI for Treatment, Payment or Operations. You may request that PHI not be shared with others (such as your spouse). Although we are not required to agree to a request, we will accommodate reasonable requests if practical and if it will not compromise Treatment. If we agree, we will comply with the restriction except in an emergency/other exception under Law. You may request a restriction in writing stating the PHI to be restricted, if you want to restrict its use, sharing or both, and to whom the restrictions apply.

Right to Request Confidential Communications/Notification: You have the right to request in writing how you want us to communicate with you by indicating how/where you are to be contacted, for example,  only at work or by regular mail. We will accommodate reasonable requests if practical and if it will not compromise your Treatment.

Right to Inspect and Copy:  You have the right to ask in writing to see and receive a copy (applicable charges for copying, postage/retrieval) of your PHI in a Designated Record Set.  We may deny in writing your access to some information including: Psychotherapy Notes; PHI needed for some legal proceedings; research PHI; PHI given to DMH under the promise of confidentiality if likely to reveal the source, or if a DMH licensed health care professional determines that access is reasonably likely to endanger your or other person’s life or safety.

We will normally provide access to PHI within 30 days of request. If the PHI is not located on site, we will notify you and may take up to 60 days to provide access. Within the 60 days, if there will be more delays, we may take a one time 30 day extension by letting you know in writing the reasons for delay and date we will take action. If you agree, instead of providing access, we may provide a written summary of PHI requested (charging you the agreed upon preparation cost). If we deny a request, we will do so in writing giving our reasons and you may have the right to have that decision reviewed. 

Right to Request Amendment: If you believe your PHI is incorrect or incomplete, you have the right to ask in writing that we amend it, stating why the PHI is inaccurate/ incomplete.  Normally we will act within 60 days of request, but may take up to 90 days.  We may deny your request if the PHI was not created by DMH, is not part of PHI you may see and copy, or if it is accurate and complete. If we deny your request, we will do so in writing giving our reasons and you may file a written disagreement and we may provide you with a written reply.

Right to an Accounting of Disclosures: You have the right to ask in writing for an accounting of our disclosures of your PHI for up to 6 years before your request, but not for disclosures made before April 14, 2003 .  However, an accounting does not include disclosures made: for Treatment, Payment or Operations; for general notification; to you or your caregiver; made by Authorization; for national security or intelligence; to correctional facilities/’law enforcement holding custody; or to health oversight/law enforcement if it would impede those activities.  We will normally provide an accounting to you within 60 days of request, but may take up to 90 days if we tell you in writing the reasons for the delay and the date that it will be provided. The first list within a 12 month period will be free.  We will let you know the cost of additional lists before we charge you.

Right to File a Complaint:  You have the right to file a written complaint with the Privacy Officer and/or HHS as described on the first page.

Definitions Of Terms Used In This Notice:

“Authorization”: Required in writing for use/sharing of PHI for non-Treatment, Payment or Operation purposes, unless otherwise permitted in the Notice. Authorization must describe the PHI shared, name of the person/entity to receive PHI, purpose of use/ disclosure, expiration date, statement of right to cancel, that PHI used/shared may re-disclosed, signature and date, and if signed by Personal Representative, a description of authority, and a copy given to Consumer or his or her Personal Representative.

“Business Associate”: Person or entity, in providing a service to DMH, who may receive PHI (e.g., consulting, computer services), but does not include an entity whose only relationship to DMH is as a Treatment provider. By the terms of the agreement with DMH, a Business Associate must protect the privacy of PHI.

“Designated Record Set”: Group of Treatment and Payment records containing PHI, kept and used by DMH, to be made available to Consumer for inspecting/copying in accord with the Notice.

“Law”:  Includes 45 CFR Part 160 (HIPAA), 42 CFR Part 2 (alcohol and drug), 44-22-100, SC Code (DMH patient confidentiality).

“Minimum Necessary”:  To use/share PHI only as needed to fulfill the intended purpose and when practical to de-identify information. PHI use/disclosure is not limited when needed for Treatment, by Authorization, access to own PHI, or when required by Law.

“Operations”: Activities of DMH employees, officials or volunteers in carrying out their DMH duties including activities related to Treatment or Payment, such as oversight, monitoring and administration of Treatment/Payment. Operations also specifically include DMH offices, programs and activities involving: medical records/health information; billing, reimbursement, accounting or collections; quality assurance, improvement or monitoring; corporate compliance; Consumer rights, advocacy, affairs or benefits coordination; information technology; judicial processing; legal; audit, review, monitoring or investigations; medical or other health care student or resident training; and conducting/arranging DMH activities as required by Law. DMH may also sometimes share PHI for Operations of other agencies and organizations that have health care accrediting or licensing authority.

“Payment”: DMH billing/reimbursement, eligibility determination, estate recovery, collections and related activities, and may include Payment activities of other public agency also providing Consumer Treatment.  

“Personal Representative”:  Person authorized to act for Consumer:  parent/guardian/ custodian of a child; adult acting in place of a parent;  person appointed by the probate court as guardian having health care power, or power to act for a deceased individual; or a person appointed by Consumer through a power of attorney.

“Protected Health Information”, “PHI”: Includes information that identifies a Consumer in any form (electronic, written, oral, etc.) collected, created, maintained or received by DMH relating to past, present or future physical/mental health or condition; health care provided or  past, present or future Payment for provided health care. PHI specifically includes information related to a prospective or actual commitment for involuntary Treatment under applicable Law, but normally does not include education or DMH employment records.

“Psychotherapy Notes”: Therapist’s detailed written notes of conversations during individual/group/family/other counseling session,  not intended to be shared/put in medical record.  They do not include information normally kept in a medical record, such as type of service, date/time/duration or billing code; diagnosis, Treatment plan, medication, progress or assessment results. Authorization is normally required for the disclosure of Psychotherapy Notes.

“Treatment”: Provision, coordination or management of health care and related services, by DMH or other health care providers, including when needed, for consultation or referral, case management and consultation/referral with/to other Treatment or care providers.