Confidentiality and HIPAA Notice

02 Confidentiality of health information

Protected health information is information Solace receives or creates about your past, present, or future health, treatment, or payment for health care that identifies you or could reasonably identify you. Federal law protects the confidentiality of substance-use-disorder patient records. When 42 CFR Part 2 applies, Solace generally may not tell a person outside the program that you are a patient or disclose information identifying you as having or having had a substance use disorder except as Part 2 permits. HIV, mental-health, substance-use-disorder, and other sensitive records may receive additional protection under applicable law.

03 Our responsibilities

Solace is required to maintain the privacy and security of protected health information, provide this notice of our legal duties and privacy practices, follow the notice currently in effect, and notify affected individuals when required after a breach of unsecured information. Substance-use-disorder patient records may also be protected by 42 CFR Part 2 and more protective California law. When a state or federal rule is more protective or materially limits a disclosure otherwise described here, the stricter rule controls.

04 Additional California confidentiality limits

To the extent each law applies, California Civil Code section 56.10 generally prohibits a health care provider from disclosing medical information without authorization except when disclosure is compelled or expressly permitted by that section. California Health and Safety Code section 11845.5 makes a patient’s identity and records of identity, diagnosis, prognosis, or treatment in covered alcohol and other drug programs confidential; it generally permits disclosure with the patient’s prior written consent only to the extent, under the circumstances, and for the purposes stated in the signed release, subject to the statute’s specific exceptions. California Welfare and Institutions Code section 5328 makes information and records obtained while providing the mental-health and related services covered by that section confidential and permits disclosure only in its enumerated circumstances. Which provision applies depends on the record, service, and circumstances.

05 Who and what this notice covers

This notice applies to records of services generated by Solace and to Solace workforce members, volunteers, and other personnel involved in your services who are covered by the notice. A personal physician or another independent provider may have a separate notice and privacy practices. To the extent permitted by law and the documents governing your care, the medical record maintained by Solace is Solace’s business record, while the information in it concerns you and remains subject to your legal rights.

06 Treatment, payment, and operations

HIPAA generally permits certain treatment, payment, and health-care-operations uses and disclosures without a separate authorization. When information is also protected by Part 2 or stricter law, we obtain consent or rely on another permission recognized by the applicable rule before using or disclosing it.

• TreatmentWe may use and share information with professionals involved in providing, coordinating, or managing care. For example, one clinician may consult another about your condition or medications to avoid complications.
• PaymentWe may use and share information to bill for services, obtain payment, and conduct permitted insurance activities. For example, information may be provided to a health plan so it can process payment.
• Health care operationsWe may use and share information for quality review, training, licensing, auditing, compliance, safety, and other lawful operational activities. For example, information may be used to manage treatment services and improve care.
• Business associatesVendors performing billing, data processing, administrative, specialty, or other services involving protected information must be subject to appropriate privacy and security obligations.

07 Limited uses without Part 2 consent

Part 2 permits limited uses or disclosures without consent only when its conditions are met. Examples include communication within the program and with qualified contractors, a bona fide medical emergency, certain non-identifying public-health activity, approved research, authorized audits or evaluations, cause-of-death inquiries, required child-abuse or neglect reporting, and crimes or threats on program premises. Identifying information may also be shared to help the U.S. Food and Drug Administration notify you or your doctor about an unsafe product you may be using. A court order involving Part 2 records must satisfy Part 2 and generally must be accompanied by a subpoena or similar legal mandate. HIPAA permits additional disclosures in defined circumstances, but the more protective rule controls when both apply.

08 Other uses and disclosures permitted by HIPAA

When HIPAA permits and Part 2 or another stricter law does not prohibit or materially limit the disclosure, Solace may use or share information for public-health and safety activities; health research; compliance with federal or state law; organ and tissue donation; coroners, medical examiners, or funeral directors after a death; workers’ compensation; lawful law-enforcement, health-oversight, military, national-security, protective-service, or other government requests; and lawsuits or legal actions. Each use or disclosure must satisfy the conditions and limits that apply.

09 When written permission is required

We generally need written authorization for uses and disclosures not described in this notice. Authorization is generally required for most uses of psychotherapy notes, for marketing involving protected information, and for a sale of protected information, subject to legal exceptions. Part 2 records are used and disclosed only as allowed by Part 2, including under a valid consent or another specific legal permission. You may revoke an authorization in writing for future uses or disclosures, but revocation does not undo action already taken in reliance on it.

10 Your choices

You generally have the right to consent before Part 2 records are used or disclosed. You may provide one consent for future treatment, payment, and health-care-operations uses or choose a more limited consent, although a limitation may affect services or payment. With valid consent or as otherwise legally permitted, Part 2 information may also be used or shared with a person you name, to prevent multiple enrollment in withdrawal-management or maintenance programs, to report participation in court-referred treatment, or to report prescribed substance-use-disorder treatment medication to a state prescription drug monitoring program when law requires it. When otherwise permitted, you may tell us your preferences about sharing relevant information with family, friends, or others involved in your care or payment, and about disaster-relief communications. You will receive clear advance notice and a choice before any fundraising communication based on Part 2 records.

11 Further disclosure after Part 2 consent

Part 2 records disclosed to a Part 2 program, HIPAA covered entity, or business associate under your written consent for treatment, payment, and health-care-operations purposes may be further disclosed by that recipient without your written consent to the extent HIPAA permits. Even then, the information generally cannot be used in a legal proceeding against you without your written consent or a Part 2-compliant court order and subpoena or similar legal mandate.

12 Your privacy rights

Requests may need to be in writing and may be subject to lawful limits, identity verification, reasonable fees, and review procedures.

• Access and copiesYou may inspect or obtain an electronic or paper copy of health information we maintain about you, with limited exceptions.
• CorrectionYou may ask us to amend information you believe is incorrect or incomplete. We may deny a request for a reason allowed by law and will explain the decision.
• Confidential communicationsYou may ask us to contact you in a specific way or at a specific location. We will accommodate reasonable requests.
• RestrictionsYou may ask us to limit certain uses or disclosures. We must agree to some requests involving a health plan when you paid in full out of pocket and disclosure is not otherwise required by law.
• AccountingYou may request an accounting of disclosures of electronic Part 2 records for the past three years and an accounting meeting HIPAA requirements for other disclosures made with consent. HIPAA also provides an accounting right for certain disclosures during its applicable period.
• Intermediary listYou may request a list of disclosures made by an intermediary during the past three years as provided by Part 2.
• Copy of this noticeYou may request a paper or electronic copy at any time, even if you agreed to receive it in another form.
• RepresentativeA person with legal authority to act for you may exercise your rights, subject to verification of that authority.

13 Protection in legal proceedings

Part 2 records generally may not be used or disclosed in a civil, administrative, criminal, or legislative proceeding against you without your written consent or a Part 2-compliant court order and subpoena or similar legal mandate. We follow the notice and hearing procedures required by law before responding to such demands.

14 Complaints

You may complain to the Solace HIPAA Privacy Officer using the contact information on this page. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/hipaa/filing-a-complaint. Complaints involving Part 2 records may also be filed with HHS OCR. Solace will not retaliate against you for filing a complaint or exercising a privacy right.

15 Changes to this notice

We may change this notice and apply the revised terms to information we already maintain as well as information received later, as allowed by law. The current notice will be available on this website, at the facility, and on request. The revised notice will show its effective date.