NOTICE OF PRIVACY PRACTICES

UPDATED 02/01/2022

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW CAREFULLY.

We are required by law to provide you this Notice and to abide by the terms of this Notice currently in effect. If you have questions about our privacy practices or your health information, you are encouraged to discuss them with your provider or contact our Privacy Officer at 479-750-2020 or compliance.office@arisahealth.org.

Arisa Health, Inc. (Arisa Health) is a 501(c)(3) non-profit organization incorporated in the State of Arkansas. Arisa Health brought together four of Arkansas’ leading behavioral health providers to form the state’s premier integrated behavioral health system. Member affiliates integrate the professional staff and services of Professional Counseling Associates, Mid-South Health Systems, Ozark Guidance Center, and Counseling Associates. As such, information held by any of these legacy organizations may be shared, as needed, with the affiliated organizations without your authorization. By Law, Arisa Health and its affiliates required to keep your protected health information (PHI) private.

YOUR HEALTH INFORMATION

We create a record of the care and services you receive at Arisa Health and its Affiliates. This notice applies to all PHI generated by Arisa Health and its Affiliates, whether made by Arisa Health and its Affiliates personnel. This notice will tell you about the ways in which we may use and disclose your PHI. We also describe your rights and certain obligations we have regarding the use and disclosure of your PHI.

Confidentiality of Alcohol and Drug Abuse Records: The confidentiality of alcohol and drug abuse patient records is protected by Federal law and regulations under 42 CFR Part 2. Generally, we may not say to a person outside of Arisa Health that you are a patient receiving substance abuse treatment, or disclose any information identifying you as an alcohol or drug abuser unless:

  • You consent in writing
  • The disclosure is allowed by a court order; or
  • The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation.

These restrictions may not apply to:

  • Communications of information between or among our personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment;
  • Crimes or threats on the premises, including crimes or threats committed by you on the premises, or against program personnel; or
  • Reports of suspected child abuse and neglect.

Violation of the Federal law and regulations by Arisa Health related to alcohol and drug abuse patient records is a crime and violations may be reported to the United States Attorney for Arkansas, as well as to the Substance Abuse and Mental Health Services Administration office responsible for opioid treatment program oversight.

YOUR HEALTH INFORMATION RIGHTS

Although your health record is the physical property of Arisa Health and its Affiliates or facility that made it, the information belongs to you. You have specific privacy rights that protect the confidentiality of your PHI. You also have certain access rights to your PHI. We believe that, if you understand your privacy rights, you can be more involved in all phases of your healthcare, including decisions about how to best protect the accuracy and confidentiality of your PHI.

You have the right to:

Get an electronic or paper copy of your medical record
You can ask to see or get an electronic or paper copy of your health record and other health information we have about you. Ask us how to do this. We will provide a copy of or a summary of your health information, usually within 30 days of your request. We will charge a reasonable fee for the cost of providing you with copies.
Ask us to correct your medical record
You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this. We may say “no” to your request, but we will tell you why in writing within 60 days.
Get a list of those with whom we’ve shared your information
You can ask for a list (accounting) of the times we have shared your PHI with others and why we have shared it for up to six years prior to the date of your request. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable cost-based fee if you ask for another one within 12 months.
Request Restrictions or ask us to limit what we share
You can ask us not to share certain health information for treatment, payment, or our operations. Keep in mind that we are not required to agree to your requests, and we may say “no” if it would affect your care. If you pay for a service or health care item out-of-pocket in full, then you can ask us not to share that information for the purpose of our operations with your health insurer. We will say “yes” to this request unless the law requires us to share that information.
Request Confidential Communications
You can ask us to contact you in a specific way (for example, home or office phone) or to send mail via alternate means (E.g., fax) or to a different address such as a P.O. Box, etc. We will say “yes” to all reasonable requests.
Receive a Paper Copy of This Notice.
You have a right to ask us for a copy of this notice at any time, even if you have agreed to receive the notice electronically. At the time of request, we will provide you with a paper copy promptly.
Choose or appoint someone to act on your behalf
If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure that the person has this authority and can act on your behalf before we take any action
File a complaint or appeal
You can complain if you feel we have violated your rights by following the steps outlined below in the “Complaints” section of this notice. Filing a complaint will not affect your care with us. If you are not satisfied with a decision we have made regarding your PHI, you may request an appeal.

OUR RESPONSIBILITIES

We are required to:

  • Maintain policies and practices that protect the security and privacy of your PHI
  • Promptly notify you if a breach occurs that may have compromised the privacy or security of your information
  • We must follow the duties and privacy practices described in this notice, until the law changes or this notice is amended.
  • We must give you a copy of this notice.
  • Notify you if we are unable to agree to a requested restriction, amendment, or appeal pertaining to your health information
  • Accommodate reasonable requests to restrict access to your PHI
  • Not use or share your PHI other than as described in this notice unless you tell us we can in writing. Even then, you may change your mind at any time. Let us know in writing if you change your mind.

USES AND DISCLOSURES

We will use and disclose your information for your treatment, payment, and health care operations of Arisa Health and its Affiliates. Examples are included for information purposes.

TREATMENT: We can use your health information and share it with other professionals who are treating you. Example: A doctor, such as your primary care physician (PCP) who is treating you asks another doctor who is also treating you about your overall health condition or specifics concerning your health condition.

PAYMENT: We can use and share your health information to bill and obtain payment from health plans or other entities. Example: We give information about you to your health insurance plan so that it will pay for your services. We may also provide information to other health care providers so they can receive payment for services provided to you.

HEALTH OPERATIONS: We can use and share your health information to run our organization, improve your care, and contact you when necessary. We can share PHI internally and with selected business associates to continually improve the quality and effectiveness care we provide. Example: We use health information about you to manage your treatment and services, assess your care received, and the outcomes of your care.

OTHER USES AND DISCLOSURES OF YOUR PHI WITHOUT YOUR WRITTEN PERMISSION

We are allowed or required to share your information in the following ways:

  • Public health activities such as to report the occurrence of communicable diseases.
  • For research purposes
  • To report information about victims of abuse, neglect, or domestic violence.
  • Health oversight activities, such as Medicare and Medicaid program activities.
  • Legal proceedings, such as in response to a subpoena or court order.
  • Law enforcement purposes such as with police or other law enforcement officials who are pursuing a criminal suspect.
  • To medical examiners, coroners, and funeral directors.
  • For organ and tissue donation purposes.
  • To avert a serious health or safety threat.
  • To comply with workers’ compensation laws.
  • For specialized government functions such as for the execution of a military mission, separation or discharge from military service, national security and intelligence activities, and correctional institutions.
  • For other purposes as required by law.

PERMISSIVE USES OR DISCLOSURES

We may use or disclose your PHI for any of the purposes described in this section unless you specifically request in writing that we do not. Your written request must be given to your care provider or the Privacy Officer.

  • We may contact you to remind you of an upcoming appointment or a missed appointment.
  • We may contact you to complete satisfaction surveys
  • We may contact you to tell you about or recommend treatment
  • We may contact you for fundraising efforts for Arisa Health, but you can tell us not to contact you again. We will care for you regardless of your decision to participate in fundraising activities. Fundraising is used to expand and improve the services and programs we provide to the community.
  • We may share your PHI with a friend, family member, personal representative, or any individual you identify who is involved in your care or payment for your care.
  • We may share your PHI with an entity legally authorized to assist in disaster relief

BUSINESS ASSOCIATES: On a limited basis, we use external parties to assist us with treatment, payment and healthcare operational functions. We require our business associates to protect the privacy of your PHI and exercise the same high standards of confidentiality that we do when handling your PHI.

MINIMUM NECESSARY: Even though we can lawfully use and disclose your health information under a variety of circumstances, we always try to limit the information to the minimum necessary. This sometimes requires the exercise of professional judgment.

USES AND DISCLOSURES REQUIRING YOUR WRITTEN PERMISSION

We will obtain your written permission for the following uses or disclosures of your PHI:

PSYCHOTHERAPY NOTES. We must obtain your written permission for most uses and disclosures of psychotherapy notes.

MARKETING. Before we receive financial payment for marketing activities using your PHI, we must obtain your written permission. We may, however, communicate with you about products or services related to your treatment, case management, care coordination, or alternative treatments, therapies, health care providers or care settings without your permission. Your permission is also not needed for small promotional items and face-to-face communications.

SALE OF PHI. We may not sell your PHI without your written permission, except that we may be paid our cost to provide PHI for certain purposes such as public health purposes and other purposes permitted by HIPAA.

REVOCATION OF YOUR AUTHORIZATION

If you give us written permission to use and disclose your PHI, you can take back (revoke) your permission at any time, as long as you tell us in writing. If you take back your permission, we will stop using or disclosing your PHI, but we will not be able to take back any information that we have already disclosed.

CHANGES IN OUR PRIVACY PRACTICES

We reserve the right to change this Notice and to make those changes applicable to all PHI that we maintain, including PHI compiled, obtained, or created before the effective date of the change. When we make a change to this Notice, have a new effective date, and will be posted in our clinics and on our websites:

https://www.arisahealth.org
https://caiinc.org
https://www.mshs.org/healthnet
https://www.pca-ar.org
https://www.ozarkguidance.org

COMPLAINTS

  • You can file a complaint with Arisa Health or its Affiliates by contacting the Privacy Officer, 2400 S. 48th Street, Springdale, AR 72762; (479) 750-2020 or emailing compliance. office@arisahealth.org
  • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting http://www.hhs.gov/ocr/privacy/hipaa/complaints/
  • We will not retaliate against you for filing a complaint.

Discrimination is against the Law. Arisa Health and its affiliates comply with applicable Federal civil rights laws and do not discriminate on the basis of race, color, national origin, age, disability, or sex. Please see our Non-Discrimination Policy and Client Rights and Responsibilities.