We are required by law to:

• Maintain the privacy and security of your protected health information;
• Notify you of our legal duties and privacy practices with respect to protected health information about you;
• Notify you if a breach occurs that may have compromised the privacy or security of your protected health information; and Follow the terms of this Notice.

The following categories describe some of the different ways that we may use or disclose your protected health information without your prior authorization. Even if not specifically listed below, we may use and disclose your protected health information as permitted or as required by law or as authorized by you.

• FOR TREATMENT: We may use and disclose your health information to provide you with medical treatment and related services. For example, your health information may be used to refer you to other providers or to other treating health care professionals, such as your primary care physician, and arrange post-discharge services (this includes psychiatric or HIV information if needed for purposes of your diagnosis and treatment).
• FOR HEALTH CARE OPERATIONS: We may use and share your health information as necessary to run our organization and improve your care.
• FOR PAYMENT: We may use and share your health information so that we can bill and receive payment from plans or other entities for the treatment and related services you receive.
• BUSINESS ASSOCIATES: There may be some services provided by our business associates that provide services to us, such as billing, legal or accounting. To protect your health information, we require business associates to enter into a written contract that requires them to safeguard your health information.
• APPOINTMENT REMINDERS: We may use and disclose your health information to contact you as a reminder that you have an appointment with us.
• PUBLIC HEALTH ACTIVITIES: We may disclose your health information to a public health authority that is authorized by law to collect or receive such information. These activities generally include the following:
  • To report disease, injury or vital statistics;
  • To aid in product recalls;
  • To report adverse reactions to medications;
  • To report suspected abuse, neglect or domestic violence; or
  • To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.
• TO AVERT A SERIOUS THREAT: We may use or disclose your health information when necessary to prevent a serious threat to the health or safety of you or others. Any disclosure, however, would only be to help prevent the threat.
• WORKERS’ COMPENSATION: We may use or disclose your health information to comply with laws relating to workers’ compensation or similar programs.
• INMATE/LAW ENFORCEMENT CUSTODY: If you are an inmate of a correctional institution or under the custody of law enforcement official, we may disclose your health information to the institution or official for certain purposes, including the health and safety of you and/or others.
• FUNDRAISING ACTIVITIES: We may disclose limited information about you to the Griffin Hospital Development Fund, so that they may contact you to raise money for the hospital. If you do want the hospital to contact you for fundraising or marketing, you must notify Griffin Hospital Development Fund at (203) 732-7504.
• LAW ENFORCEMENT: We may disclose your health information for certain law enforcement purposes if permitted or required by law, such as to:
  • Respond to a court order, subpoena, warrant, summons or similar process;
  • Identify or locate a victim, suspect, fugitive, material witness or missing person; or
  • Report criminal conduct.
• HEALTH OVERSIGHT ACTIVITIES: We may disclose your health information to a health oversight agency for oversight activities such as audits, investigations, inspections, and licensure, or other activities necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
• JUDICIAL PROCEEDINGS: If you are involved in a lawsuit or dispute, we may disclose your health information in response to a court order, administrative order, subpoena or other lawful process if permitted by law.
• CORONERS, MEDICAL EXAMINERS, FUNERAL DIRECTORS, ORGAN PROCUREMENT ORGANIZATIONS: If you are deceased, we may disclose limited health information to a coroner, medical examiner, funeral director, or if you are an organ donor, to an organization involved in the donation of organs and tissues.
• NATIONAL SECURITY MATTERS: We may disclose your health information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law. These activities may include protective services for the President, other authorized persons or foreign heads of state.
• MILITARY ACTIVITIES: If you are a member of the Armed Forces, we may release your health information as required by military command authorities and applicable law.
• RESEARCH: Under certain circumstances, we may use and disclose your health information for research purposes, subject to a special approval process.
• HOSPITAL DIRECTORY: If admitted as an inpatient, unless you tell us otherwise, we will list in the patient directory, your name, location in the hospital, your general condition (good, fair, etc.) and your religious affiliation, and may release all but your religious affiliation to anyone who asks about your name. Your religious affiliation may be disclosed only to clergy members, even if they do not ask for you by name.
• INDIVIDUALS INVOLVED IN YOUR CARE OR PAYMENT FOR YOUR CARE: We may release your health information to a friend or family that you indicate is involved in your care or payment for your care, unless you request a restriction.
• DISASTER RELIEF: We may release your health information to disaster relief authorities so that your family can be notified of your status, location and condition.
• AS REQUIRED BY LAW: We will disclose health information about you when required to do so by federal, state or local law.

For disclosures concerning protected health information relating to care for psychiatric conditions, substance abuse or HIV related testing and treatment, special restrictions may apply. For example, we generally may not disclose this specially protected information in response to a subpoena, warrant, or other legal process unless you sign a special authorization or a court orders the disclosure.

• BEHAVIORAL HEALTH INFORMATION: Certain behavioral health information may be disclosed for treatment, payment and health care operations as permitted or required by law. Otherwise, we will disclose such information pursuant to an authorization, court order or as otherwise required by law.
• SUBSTANCE ABUSE TREATMENT INFORMATION: If you are treated in a specialized substance abuse program, the confidentiality of alcohol and drug abuse patient records is protected by federal law and regulations. Generally, we may not disclose to a person outside the program that you attend the program, or disclose any information identifying you as an individual being treated for drug or alcohol abuse, unless:
  1. You consent in writing;
  2. The disclosure is allowed by a court order; or
  3. The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation;
  4. In order to report a crime committed by a patient either at the facility or against an employee of the facility; or
  5. In order to report suspected child abuse or neglect as required by law.
• HIV-RELATED INFORMATION: We may disclose HIV-related information as permitted or required by State law. For example, your HIV-related information, if any, may be disclosed without your authorization for treatment purposes, certain health ;oversight activities, pursuant to a court order, or in the event of certain exposures to HIV by personnel of this facility, another person, or a known partner (if certain conditions are met). Any use and disclosure for such purposes will be to someone able to reduce the outcome of the exposure and limited in accordance with state and federal law.
• MINORS: We will comply with State law when using or disclosing health information of minors. For example, if you are an unemancipated minor consenting to a health care service related to HIV/AIDS, sexually transmitted disease, abortion, outpatient mental health treatment or alcohol/drug dependence, and you have not requested that another person be treated as a personal representative, you may have the authority to consent to the use and disclosure of your health information.

Other uses and disclosures of protected health information not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you provide us authorization to use or disclose protected health information about you, you may revoke it, in writing, at any time. Examples of when an authorization form from you may be required include the following:

• Marketing Purposes;
• Sale of your Information; and
• Most sharing of your psychotherapy notes.

You have the right to:

• INSPECT OR COPY YOUR MEDICAL RECORD: You have the right to inspect and copy your medical record by written request to the Medical Records Office, with some exceptions. You also have the right to obtain an electronic copy of any of your health information that we maintain in electronic format. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. We will respond within 30 days of receiving your written request. Under certain very limited circumstances, we may deny your request to inspect or obtain a copy of your information. You may request that the denial be reviewed by contacting the Privacy Officer.
• REQUEST TRANSMISSION OF YOUR PROTECTED HEALTH INFORMATION: You have the right to request that we transmit a copy of your health information to another person or entity designated by you.
• AMEND YOUR MEDICAL RECORD: You have the right to request an amendment to your medical record for as long as the information is maintained by or for us. This request must be made in writing to the Medical Records Office. We will respond within 60 days of receiving your written request. We reserve the right to deny the request, to which you may make a further appeal.
• REQUEST CONFIDENTIAL COMMUNICATION: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.
• REQUEST RESTRICTIONS: You have the right to request a restriction or limitation on the protected health information (PHI) we use or disclose about you for treatment, payment, or health care operations. This request must be made in writing to the Medical Records Office. You have the right to request a restriction or limitation on the PHI we disclose about you to a person who is involved in your care or the payment for your care, like a family member or friend. We are not required to agree to these types of requests and may deny such requests if it would affect your care. You may restrict the disclosure of your PHI to a health plan for purposes of payment (other than Medicaid or other federal health programs that require us to submit information) if you paid out-of-pocket in full for the health services or the item to which the information relates.
• OBTAIN A LIST OF DISCLOSURES WE HAVE MADE ABOUT YOU: You have the right to a list of disclosures of your PHI, with certain exceptions. You must submit your request for a list of disclosures in writing to the Medical Records Office. Your request must state a time period that may not be longer than six years prior to the request date. The first list you request within a 12-month period will be free. For additional lists during the same 12-month period, we may charge you for the cost of providing the list. To the extent we use or maintain an electronic health record with respect to your PHI, you have the right to a list of disclosures that is also related to treatment, payment, or healthcare operations for a period of three years prior to the date on which the accounting is requested.
• TO NAME A PERSONAL REPRESENTATIVE: You have the right to name another person to act as your Personal Representative. Your representative will be allowed access to your PHI, to communicate with the health care professionals and facilities providing your care, and to exercise all other HIPAA rights on your behalf. Depending on the authority you grant your representative, he or she may also have authority to make health care decisions for you.

• RECEIVE A PAPER COPY OF THIS NOTICE: You have the right to a paper copy of this Notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

We reserve the right to change this Notice and to make the revised or changed Notice effective for protected health information we already have about you as well as any such information we receive in the future. The new Notice will be available on our Web site at griffinhealth.org. You can receive a copy of the current notice at any time. Copies of the current notice will also be available each time you come to our facility for treatment.

In addition to calling one of the phone number listed above, questions concerning this Notice can be directed to:

Griffin Hospital
130 Division Street
Derby, CT 06418
Attention: Privacy Officer
(203) 732-7502