Notice of Privacy Practices

It is our policy to reasonably limit disclosures of, and requests for, protected health information for payment and health care operations to the minimum necessary. Cornerstone Montgomery limits which members of our staff may have access to personal health information for treatment, payment, and health care operations, based on those who need access to the information to do their jobs.

The following categories describe different ways that we use and disclose your PHI. We have provided you with examples in certain categories; however, not every permissible use or disclosure will be listed in this Notice.

Note that some types of PHI, such as HIV information, genetic information, alcohol and/or substance abuse records, and mental health records may be subject to special confidentiality protections under applicable state or federal law and we will abide by these special protections.

We will obtain your written authorization before using or disclosing your PHI for purposes other than those described in this Notice or otherwise permitted by law. You may revoke an authorization in writing at any time. Upon receipt of the written revocation, we will stop using or disclosing your PHI, except to the extent that we have already taken action in reliance on the authorization.

We will obtain your written authorization for the use or disclosure of psychotherapy notes, use or disclosure of PHI for marketing, and for the sale of PHI, except in limited circumstances where applicable law allows such uses or disclosure without your authorization.

Cornerstone Montgomery will disclose your PHI when required to do so by federal, state or local law. Except where prohibited by federal or state laws that require special privacy protections, we may use and disclose your PHI for treatment, payment and health care operations without your prior authorization as follows:

• Business Associates. We may contract with third parties to perform certain services for us, such as billing services, copy services or consulting services. These third party service providers, referred to as Business Associates, may need to access your PHI to perform services for us. They are required by contract and law to protect your PHI and only use and disclose it as necessary to perform their services for us.
• Coroners, Medical Examiners and Funeral Directors. We may release your PHI to coroners or medical examiners so that they can carry out their duties. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose PHI to funeral directors consistent with applicable law to enable them to carry out their duties.
• Correctional Institution. If you are or become an inmate of a correctional institution, we may disclose to the institution, or its agents, PHI necessary for your health and the health and safety of other individuals.
• Disaster Relief. We may use and disclose your PHI to organizations for purposes of disaster relief efforts.
• Electronic Searches. We may conduct an electronic search on the internet to access your public court records, social media accounts, or any other public information, as appropriate, without the your consent, in order to avert a serious threat to health or safety to staff, clients, or other community members.
• Fundraising. As permitted by applicable law, we may contact you to provide you with information about our fundraising programs. You have the right to “opt out” of receiving these communications and such fundraising materials will explain how you may request to opt out of future communications if you do not want us to contact you further for fundraising efforts.
• Health Care Operations. We may use and disclose your PHI for our health care operations. Health care operations are activities necessary for us to operate our health care businesses. For example, we may use your PHI to monitor the performance of the staff and clinicians providing treatment to you. We may use your PHI as part of our efforts to continually improve the quality and effectiveness of the health care products and services we provide. We may also analyze PHI to improve the quality and efficiency of health care, for example, to assess and improve outcomes for health care conditions. We may also disclose your PHI to other HIPAA covered entities that have provided services to you so that they can improve the quality and effectiveness of the health care  services that they provide. We may use your PHI to create deidentified data, which is stripped of your identifiable data and no longer identifies you.
• Health Oversight Activities. We may disclose your PHI to an oversight agency for activities authorized by law. These oversight activities include audits, investigations, inspections, and credentialing, as necessary for licensure and for the government to monitor the health care system, government programs and compliance with civil rights laws.
• Health or Safety Concerns. We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Homeless Management Information System (HMIS). Cornerstone Montgomery collects information about homeless individuals who accesses our services and enters it into the Homeless Management Information System (HMIS). The HMIS, is a shared human services database, which allows authorized personnel at homeless and human service provider agencies throughout Montgomery County Homeless, to enter, track, and report on information concerning their own clients and to share information, subject to appropriate interagency agreements, on common clients. The Montgomery County Department of Health and Human Services (MCDHHS) administers the HMIS. The HMIS is designed to collect and deliver quality data about services and homeless persons or persons at risk for being homeless. The information we collect and share in the HMIS helps us to efficiently coordinate the most effective services for you. It allows us to complete one universal intake per person; better understand homelessness in our community; and assess the types of resources needed in our local area. In compliance with all state and federal requirements regarding client/consumer confidentiality and data security, Cornerstone Montgomery will comply with all applicable federal and state laws regarding protection of client privacy, specifically with Federal confidentiality regulations as contained in the Code of Federal Regulations, 42 CFR Part 2, regarding disclosure of alcohol and/or drug abuse records, where applicable, the Health Insurance Portability and Accountability Act of 1996, 45 C.F.R., Parts 160 & 164, corresponding regulations established by the U.S. Department of Health and Human Services, and policies and procedures established by the Montgomery County Department of Health and Human Services pertaining to protection of client privacy.
• Judicial and Administrative Proceedings. If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process instituted by someone else involved in the dispute, but only if efforts have been made, either by the requesting party or us, to first tell you about the request or to obtain an order protecting the information requested.
• Law Enforcement. We may disclose your PHI for law enforcement purposes as required or permitted by law – for example, in response to a subpoena or court order, in response to a request from law enforcement, and to report limited information in certain circumstances.
• Maryland Health Information Exchange/CRISP. Cornerstone Montgomery has chosen to participate in the Chesapeake Regional Information System for our Patients, Inc. (CRISP), a regional health information exchange serving Maryland and the District of Columbia. As permitted by law, your health information will be shared with this exchange in order to provide faster access, better coordination of care and assist providers and public health officials in making more informed decisions. You may “opt-out” and prevent searching of your health information available through CRISP by calling 1-877-952-7477 or by completing and submitting an Opt-Out form to CRISP by mail, fax or through their website at www.crisphealth.org. You can also complete an opt out form and submit it to Cornerstone Montgomery, Utilization Management Department at 6040 Southport Drive, Bethesda, MD 20814 and Cornerstone will submit it for you.
• Military and Veterans. If you are a member of the armed forces, we may release PHI about you as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority.
• National Security, Intelligence Activities, and Protective Services for the President and Others. We may release PHI about you to federal officials for intelligence, counterintelligence, protection of the President, and other national security activities authorized by law.
• Notification. We may use or disclose your PHI to notify or assist in notifying a family member, personal representative, or another person responsible for your care, regarding your location and general condition.
• Organ or Tissue Procurement Organizations. Consistent with applicable law, we may disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.
• Payment. We may use and disclose your PHI in order to obtain payment for the health care products and services that we provide to you and for other payment activities related to the services that we provide. For example, we may contact your insurer, pharmacy benefit manager or other health care payor to determine whether it will pay for health care products and services you need and to determine the amount of your co-payment. We will bill you or a third-party payor for the cost of health care products and services we provide to you. The information on or accompanying the bill may include information that identifies you, as well as information about the services that were provided to you or the medications you are taking. We may also disclose your PHI to other health care providers or HIPAA covered entities who may need it for their payment activities.
• Public Health. We may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury, or disability, including the FDA. In certain circumstances, we may also report work-related illnesses and injuries to employers for workplace safety purposes.
• Research. We may use your PHI to conduct research and we may disclose your PHI to researchers as authorized by law. For example, we may use or disclose your PHI as part of a research study when the research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your information.
• Service Coordination. We may disclose to a family member, other relative, close personal friend, or any other person you identify, PHI directly relevant to that person’s involvement in your care or payment related to your care. Additionally, we may disclose PHI to your “personal representative.” If a person has the authority by law to make health care decisions for you, we will generally regard that person as your “personal representative” and treat him or her the same way we would treat you with respect to your PHI.
• Treatment. We may use and disclose your PHI to provide and coordinate the treatment, medications and services you receive. For example, we may disclose PHI to pharmacists, doctors, nurses, technicians and other personnel involved in your health care. We may also disclose your PHI with other third parties, such as hospitals, other pharmacies and other health care facilities and agencies to facilitate the provision of health care services, medications, equipment and supplies you may need. This helps to coordinate your care and make sure that everyone who is involved in your care has the information that they need about you to meet your health care needs.
• Victims of Abuse or Neglect. We may disclose PHI about you to a government authority if we reasonably believe you are a victim of abuse or neglect. We will only disclose this type of information to the extent required by law, if you agree to the disclosure, or if the disclosure is allowed by law and we believe it is necessary to prevent serious harm to you or someone else.
• Worker’s Compensation. To the extent necessary to comply with law, we may disclose your PHI to worker’s compensation or other similar programs established by law.

At Cornerstone Montgomery, we take confidentiality very seriously. Cornerstone Montgomery collects your health information and stores it in a paper chart and in a protected electronic health record. This is your medical record. Your medical record (your protected health information) is kept in a secure location and only those employees who need access to your medical record for treatment, payment or health care operations, have access to your medical record unless you sign an authorization.

• You have the right to inspect and copy your health information as applicable by state and local laws. You may incur charges for copies requested up to 20 cents per page.
• You have the right to direct Cornerstone Montgomery to send a copy of your records directly to another person or entity designated by you by completing and signing a Release of Information (ROI) authorization or submitting the request in writing, signed by you, and clearly identifying the designated person and where to send the PHI.
• You have the right to receive your health information through a reasonable alternative means or at an alternative location. This means that you could request information should be sent to you at an address other than your residence or through a non-traditional means such as fax.
• You have a right to request that Cornerstone Montgomery, Inc. amend your health information if you believe that information is incorrect or incomplete. If you disagree with the contents of your medical record, you may also request an amendment to your record. Cornerstone Montgomery will place that amendment in the medical record unless Cornerstone Montgomery did not create that part of the record or we believe the existing record is accurate and complete. If Cornerstone Montgomery grants the amendment, we will notify you and you may request that Cornerstone Montgomery provide the amendment to other programs and to programs that you identify to us as having already received your medical record. If Cornerstone Montgomery denies the amendment, we will give you specific reasons for the denial. You may then submit a statement of disagreement and Cornerstone Montgomery may submit a rebuttal. If you notify us in writing, Cornerstone Montgomery will attach your request for amendment and our denial to future disclosures of that part of your medical record.
• You have the right to request restrictions on certain uses and disclosures of your health information. Cornerstone Montgomery, Inc. is not required to agree to the restriction that you requested.
• You have a right to receive an accounting of disclosures made of your PHI by Cornerstone Montgomery, within the six years prior to the date of your request, to entities or individuals other than you. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting per year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months. To request an accounting, you must submit a request in writing to our Medical Records Department.

All records request can be sent to:

Cornerstone Montgomery – Medical Records Department
6040 Southport Drive, Bethesda, Maryland 20814
recordsrequests@cornerstonemontgomery.org

Cornerstone Montgomery must give access to the patient’s medical record within 30 days of the request. In the event that more time is required before the health information is released, Cornerstone Montgomery will give an explanation of the delay within that 30-day time frame, and the patient must be granted access to his medical record within 60 days.

Under certain limited circumstances, Cornerstone Montgomery may deny an individual’s request for access to all or a portion of the PHI requested. In some of these circumstances, an individual has a right to have the denial reviewed by a licensed health care professional designated by Cornerstone Montgomery who did not participate in the original decision to deny. Unreviewable grounds for denial, include, but not limited to:

• A request for psychotherapy notes*, or information compiled in reasonable anticipation of, or for use in, a legal proceeding.
• The requested PHI was obtained by someone other than a health care provider (e.g., a family member of the individual) under a promise of confidentiality, and providing access to the information would be reasonably likely to reveal the source of the information.

Reviewable grounds for denial, whereas a licensed health care professional has determined in the exercise of professional
judgment that:

• The access requested is reasonably likely to endanger the life or physical safety of the individual or another person. This ground for denial does not extend to concerns about psychological or emotional harm (e.g., concerns that the individual will not be able to understand the information or may be upset by it).
• The access requested is reasonably likely to cause substantial harm to a person (other than a health care provider)
  referenced in the PHI.
• The provision of access to a personal representative of the individual that requests such access is reasonably likely to
  cause substantial harm to the individual or another person.

If Cornerstone Montgomery denies access, in whole or in part, to PHI requested by the individual, a denial in writing will be provide to the individual no later than within 30 calendar days of the request (or no later than within 60 calendar days if the individual was notified of an extension). If the denial was based on a reviewable ground for denial and the individual requests review, Cornerstone Montgomery will promptly refer the request to the designated reviewing official. The reviewing official must determine, within a reasonable period of time, whether to reaffirm or reverse the denial. Cornerstone Montgomery will then promptly provide written notice to the individual of the determination of the reviewing official, as well as take other action as necessary to carry out the determination.

*Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

Patients can expect to be free from retaliation and will not be barred from services should they choose to submit a grievance to address their concerns. At any point during the grievance process, the patient maintains the right to utilize counsel or other representation.