Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW PSYCHOLOGICAL AND MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY, AND SIGN THE ACKNOWLEDGEMENT OF RECEIPT.
Protecting Your Personal and Health Information
The Psychological Services Center (PSC) is committed to protecting the privacy of patient personal and health information. Additionally, both Federal and Massachusetts laws require us to maintain the privacy of our patients’ personal and health information. This Notice explains the PSC’s privacy practices, our legal duties, and your rights concerning your personal and health information. In this Notice, your personal or protected health information (PHI) is referred to as “health information” and includes information about your health care and treatment when it contains identifiable information such as your name, age, address, income or other financial information.
How We Protect Your Health Information
We protect your health information by:
- Treating all of your health information that we collect as confidential.
- Stating confidentiality policies and practices in our clinic staff handbooks, as well as disciplinary measures for privacy violations.
- Restricting access to your health information to only those clinical staff who need to know your health information in order to provide our services to you.
- Only disclosing your health information that is necessary for an outside service company to perform its function on the clinic’s behalf; such companies have by contract agreed to protect and maintain the confidentiality of your health information.
- Maintaining physical, electronic, and procedural safeguards to comply with federal and state regulations guarding your health information.
- Keeping you continuously informed of policy changes by providing you with updates to this document, making it available in our waiting room and on our website (www.umass.edu/psc).
- Asking for separate, written authorization for any disclosures not covered above.
Uses and Disclosures for Treatment, Payment, and Health Care Operations
The PSC may use or disclose your protected health information (PHI), for treatment, payment, and health care operations purposes, as long as you consent to receive evaluation or treatment services from the clinic. To help clarify these terms, here are some definitions:
- “Treatment, Payment, and Health Care Operations”
Treatment is when a clinician provides, coordinates, or manages your health care and other services related to your health care. An example of treatment would be when a clinician consults with another health care provider, such as your family physician. Payment is when a clinician obtains reimbursement for your healthcare. Examples of payment are when the PSC discloses your PHI to your health insurer to obtain reimbursement for your health care or to determine eligibility or coverage. Health Care Operations are activities that relate to the performance and operation of the PSC. Examples of health care operations are quality assessment and improvement activities, business-related matters such as audits and administrative services, case management and care coordination, conducting training and educational programs or accreditation activities.
- “Use” applies only to activities within the PSC such as sharing, employing, applying, utilizing, examining, and analyzing information that identifies you. An example of such use would be a meeting to discuss your case between your clinician a clinical supervisor.
- “Disclosure” applies to activities outside of the PSC, such as releasing, transferring, or providing access to information about you to parties not affiliated with the PSC. An example of such use would be if the PSC were to discuss your case with your primary care physician. A written release of information would be required for any communication between a staff member of the PSC and any outside entity or provider.
Uses and Disclosures Requiring Authorization
The PSC may use or disclose PHI for purposes outside treatment, payment, or healthcare operations when your appropriate authorization is obtained. An “authorization” is written permission above and beyond the general consent that permits only specific disclosures. In those instances when the PSC is asked for information for purposes outside of treatment, payment or healthcare operations, we will obtain an authorization from you before releasing this information.
The PSC must obtain permission in writing from its patients to release any documents related to treatment that are not part of your patient file.
- Any consumer of health care who pays for health care services out-of-pocket, meaning without use of benefits provided by their health care insurance provider, may restrict the distribution of their PHI to their health care insurance provider.
- The PSC will never use any patient data, including PHI, for purposes of fundraising. We are, however, required by law to inform you that you may opt-out of any fundraising communications that the PSC might initiate.
- The PSC will never engage in a private or commercial sale of any patient data, including PHI. We are, however, required by law to inform you that should such a sale occur we would first have to obtain your written permission to sell or transfer any PHI data.
- The PSC will never disclose any patient information for marketing purposes or for a sales transaction. However, should this policy change, the PSC would be legally required to inform you in writing that there has been a change in policy; whether disclosure of this type would include psychotherapy notes, and whether the PSC has been paid for the disclosure of this information. The PSC would also be required to obtain written authorization to release this information from the patients affected by any such disclosure.
You may revoke all such authorizations at any time, provided each revocation is in writing. You may not revoke an authorization to the extent that (1) the clinic has relied on that authorization; or (2) if the authorization was obtained as a condition of obtaining insurance coverage (the law may provide the insurer the right to contest the claim under the policy). In the PSC, the most common requests for disclosure involve the coordination of your care with other treatment providers such as physicians or psychiatrists.
Uses and Disclosures with Neither Consent nor Authorization
The PSC may use or disclose PHI without your consent or authorization in the following circumstances:
- Health Care Operations- The PSC discloses health information that is necessary for outside service companies to perform its function on the clinic’s behalf; such companies have by contract agreed to protect and maintain the confidentiality of your health information. An example is our Information Technology department, which manages and protects our electronic medical record.
- Supervision – Clinicians in the PSC are doctoral students who are supervised by licensed clinical psychologists. Clinicians also consult about case material and treatment progress with members of their treatment teams or other clinicians in the PSC. Ongoing consultation and supervision ensures the quality of your treatment and is an essential component of our training program.
- Abuse – If we have reason to believe that a minor child, elderly person or disabled person has been abused, abandoned, or neglected, the PSC must report this concern or observations related to these conditions or circumstances to the appropriate authorities.
- Health Oversight Activities – If the Massachusetts Board of Registration of Psychologists is investigating a clinician that you have filed a formal complaint against, the PSC may be required to disclose protected health information regarding your case.
- Judicial and Administrative Proceedings as Required – If you are involved in a court proceeding and a court subpoenas information about the professional services provided you and/or the records thereof, we may be compelled to provide the information. Although courts have recognized a therapist-patient privilege (e.g. the privacy of the therapeutic process), there may be circumstances in which a court would order the clinic to disclose personal health or treatment information. The PSC will not release information without your written authorization or that of your legally appointed representative unless a court order compels us to do so. The privilege does not apply when you have agreed to be evaluated for a third party (e.g. Law enforcement agency or Social Security) or where the evaluation is court ordered, but exceptions will always be made clear to you at the outset of treatment.
- Serious Threat to Health or Safety – If you communicate to clinic personnel an explicit threat of imminent serious physical harm or death to identifiable victim(s), and we believe you may act on the threat, we have a legal duty to take the appropriate measures to prevent harm to that person(s) including disclosing information to the police and warning the victim. If we have reason to believe that you present a serious risk of physical harm or death to yourself, we may need to disclose information in order to protect you. In both cases, we will only disclose what we feel is the minimum amount of information necessary.
- Worker’s Compensation – The PSC may disclose protected health information regarding you as authorized by, and to the extent necessary, to comply with laws relating to worker’s compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.
- National Security- We may be required to disclose to military authorities the health information of Armed Forces personnel under certain circumstances. We may be required to disclose to authorized federal officials health information required for lawful intelligence, counterintelligence, and other national security activities. We may be required to disclose health information to a correctional institution or law enforcement official having lawful custody of protected health information of an inmate or patient under certain circumstances.
- Research- Under certain limited circumstances, we may use and disclose health information for research purposes. Projects that require the disclosure of health information are subject to an institutional review board and require your written consent. De-identified clinical information (e.g. information that cannot be linked to your identity) may be used for ongoing program evaluation and psychotherapy research.
Patient’s Rights and Psychologist’s Duties
- Rights to Request Restrictions – You have the right to request additional restrictions on certain uses and disclosures of protected health information. The PSC may not be able to accept your request, but if we do, we will uphold the restriction unless it is an emergency.
- Right to Receive Confidential Communications by Alternative Means and at Alternative Locations – You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations (For example, you may not want a family member to know that you are being seen at the PSC. On your request, the PSC will send your bills to another address).
- Right to Inspect and Copy – You have the right to inspect or obtain a copy (or both) of your clinic health records. A reasonable fee may be charged for copying or, if necessary, redacting the record. Currently, this fee is $10 per hour of copying or redacting time and $.10 per page for copies. Access to your records may be limited or denied under certain circumstances, but in most cases you have a right to request a review of that decision. On your request, we will discuss with you the details of the request and denial process.
- Right to Amend - You have the right to request in writing an amendment of your health information for as long as PHI records are maintained. The request must identify which information is incorrect and include an explanation of why you think it should be amended. If the request is denied, a written explanation stating why will be provided to you. You may also make a statement disagreeing with the denial, which will be added to the information of the original request. If your original request is approved, we will make a reasonable effort to include the amended information in future disclosures. Amending a record does not mean that any portion of your health information will be deleted.
- Right to an Accounting –You generally have the right to receive an accounting of disclosures of PHI. If your health information is disclosed for any reason other than treatment, payment, or operation, you have the right to an accounting for each disclosure. The accounting will include the date, name of person or entity, description of the information disclosed, the reason for disclosure, and other applicable information. If more than one (1) accounting is requested in a twelve (12) month period, a reasonable fee may be charged.
- Electronic vs. Paper Copy – If you received this notice electronically (e.g., accessing a website), you have the right to obtain a paper copy of the notice from the PSC upon request.
- The PSC is required by law to maintain the privacy of PHI and to provide you with a notice of legal duties and privacy practices.
- The PSC is required to inform its affected patients of any breach of confidentiality to their PHI.
- The PSC reserves the right to change the privacy policies and practices described in this notice. Unless we notify you of such changes, however, the PSC will abide by the terms currently in effect.
- Couples and families seeking treatment will be asked to sign individual consent forms, and further understand that the record of treatment services provided will not be released without authorization from all adults present. If one individual insists on their right to review and copy the record, the record would have to be redacted (e.g. identifying information about the non-consenting party is removed).
- We retain all records related to your treatment for a period of seven years after completion of treatment or seven years after the 18th birthday of a minor who received treatment,
Changes to this Notice:
The PSC reserves the right to change our privacy practices at any time, as permitted by applicable law. We reserve the right to make the changes in our privacy practices and the new terms will be applicable for all health information, whether it was collected before or after the changes. You will be notified before we implement such changes, and the new policies will be posted in the waiting room as well as our website (www.umass.edu/psc). You may request a copy of the Notice at any time.
Questions and Complaints
For questions regarding this Notice or our privacy practices, please contact the PSC Privacy Officer, at the address listed below.
If you are concerned that your privacy rights may have been violated, you may contact the PSC Privacy Officer to make a complaint. You may also make a written complaint to the U.S. Department of Health and Human Services, and we can provide you with the address at your request.
We hope that we can resolve issues that may arise and are committed to considering your feedback very carefully and respectfully. However, if you chose to make a more formal complaint, we also want to assure you that we will not retaliate in any way.
Questions or concerns may be directed to:
Psychological Services Center
135 Hicks Way- 123 Tobin Hall
University of Massachusetts
Amherst, MA 01003