Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can obtain access to this information. Please review it carefully.

Harrington Family Health Center (HFHC) is required by law to maintain the privacy of your protected health information (PHI), to provide you with this notice of HFHC’s legal duties and privacy practices with respect to your PHI, and to notify you in the event of a breach of any unsecured PHI HFHC maintains about you. While required to abide by the terms of the Notice that is currently in effect, HFHC reserves the right to change HFHC’s privacy practices at any time and make the new notice provisions effective for all PHI that it maintains about you. If HFHC’s privacy practices change, HFHC will provide you the opportunity to review an updated version at your next visit.

Uses and disclosures of your PHI when you authorization is not required:

Treatment, payment and healthcare operations:

For example:

  • Treatment: HFHC has an integrated medical record. This means that behavioral health, substance abuse and HIV related information is shared among medical and behavioral health providers on a need-to-know basis without additional written permission from patients. Your PHI may be used or disclosed between HFHC providers or with other health care providers and facilities involved in your care (including pharmacists, and medical equipment suppliers), to develop a diagnosis and treatment plan, to coordinate your care, to arrange for referrals, to send appointment reminders to you, and for other treatment related purposes.

  • Payment: HFHC may disclose your PHI to your insurance carrier, health plan or other third-party payors (Medicare, MaineCare) to secure payment on your behalf, and to determine your eligibility for coverage and benefits.

  • Operations: HFHC may use and disclose your PHI for health care operations purposes such as quality review and improvement activities, risk management activities, training and audit activities.

HealthInfoNet: HFHC shares information with Maine’s state-designated, state-wide electronic health information exchange called HealthInfoNet. HealthInfoNet allows HFHC and other participating Maine healthcare providers who treat you to share certain limited health information about you. However, the following information will not be disclosed to HealhInfoNet or made accessible to providers participating in HealthInfoNet without your specific authorization: (i) information maintained by substance abuse treatment programs (ii) certain information maintained by licensed mental health facilities and processionals, (iii) HIV information, and (iv) genetic test results. Health information stored on HealthInfoNet’s network may also be disclosed to governmental entities for certain required public health reporting purposes. HealthInfoNet’s computer system tracks everyone who electronically accessed your information. You can request a list of who accesses your information from HealthInfoNet.

Opting out of HealthInfoNet: You may opt out of having your information shared through HealthInfoNet. You may opt out by contacting HealthInfoNet (www.hinfonet.org) and completing an opt out form. HFHC can also provide you with this form. However, there are risks with not participating. Your healthcare providers may not have access to the most current and complete information about you when they need it to treat you or to coordinate your care in an urgent situation. Choosing to opt out could also increase your wait time for care due to the time it takes to get paper copies of your medical records to your treating healthcare provider. If you choose to opt out, you can opt in later. However, if you opt in later, the only healthcare information that will be made accessible to participating HealthInfoNet providers will be healthcare information created after the time you choose to participate. If you decide to opt out, HFHC will not deny care to you on the basis that you have opted out.

For more information: If you have any questions about HealthInfoNet, you may contact HFHC’s compliance officer. You may also contact HealthInfoNet at hinfonet.org, by email at info@hinfonet.org, by phone at 207-541-9250 or by mail at 125 Presumpscot St, Portland.

Business Associates: HFHC may disclose your PHI to contractors (called “business associates”) performing services on HFHC’s behalf when such contractors have agreed in writing to appropriately protect your PHI.

Uses and Disclosures Allowed by Law: HFHC may disclose PHI without your authorization as permitted or required by applicable law, including for any of the following circumstances:

  • For public health activities, including mandatory health reports to government agencies;

  • To comply with mandatory abuse and neglect reporting laws;

  • For health oversight activities by government agencies;

  • To comply with court orders, governmental subpoenas, or other lawful processes;

  • For certain research purposes provided that certain requirements are met;

  • To a coroner, medical examiner, or funeral director for purposes authorized by law;

  • For law enforcement purposes, such as to report gunshot wounds, crimes committed on HFHC premises, or crimes committed against HFHC personnel;

  • For cadaveric organ, eye, or tissue donation purposes;

  • To avert a serious threat to health or safety; or

  • For Workers’ Compensation purposes.

Specialized Government Functions: HFHC may use and disclose your PHI for specialized government functions when such uses or disclosures are authorized or required by applicable law, including any of the following circumstances: • For intelligence, counter-intelligence, and other national security activities authorized by the National Security Act and related Executive Orders;

  • For the provision of protective services to the President or other persons or for the conduct of investigations, authorized under applicable federal law;

  • For corrections and other law enforcement custodial situations, such as disclosures to a correctional institution or a law enforcement official having lawful custody of an inmate or other individual, of PHI about the inmate or other person when necessary (i) to provide health care to the inmate or person in custody, (ii) for the health and safety of the inmate or person in custody, (iii) for the health and safety of correctional personnel, (iv) for the health and safety of persons responsible for transporting the inmate or person in custody, (v) for law enforcement on correctional facility premises, and (vi) for administering and maintaining the safety, security and good order of the correctional institution;

  • With respect to persons who are members of the Armed Forces and of foreign military personnel, HFHC may use and disclose PHI for activities deemed necessary by appropriate military command authorities to assure the proper execution of a military mission; and

  • For purposes of reporting to the National Instant Criminal Background Check System the identity of an individual prohibited from possessing a firearm under federal law if certain requirements are met

Other uses and disclosures:

  • HFHC may disclose your PHI to notify, or assist in the notification of a family member, your personal representative or another person responsible for your care about your location, general condition, or death, if certain requirements are met. • HFHC may use PHI to provide information to you about treatment alternatives or other health services.

  • HFHC may disclose your PHI to family members, relatives, or close personal friends, or anyone else identified by you, involved in your care involved in securing payment for your care, or for notification purposes, if certain requirements are met.

  • HFHC may use and disclose your PHI to public or private entities authorized by law or its charter to assist in disaster relief efforts for certain notification purposes, provided certain requirements are met.

Except as described above, HFHC will not use or disclose your information outside of our organization, except with your written authorization. An authorization may be revoked by sending a revocation to HFHC in writing, except to the extent that HFHC has already acted in reliance on the authorization.

Uses and disclosures of your PHI when your authorization is required:

HFHC will obtain your written authorization for any use or disclosure of your PHI to sell or market products or services, except in limited circumstances (for example, in face-to-face marketing communications with you or a promotional gift of nominal value). HFHC will also obtain your written authorization any disclosure of your PHI that involves a sale of your PHI, unless an exception applies under applicable law. HFHC will not photograph or video record you, or use or disclose any photographs and video recordings of you, for nontreatment related purposes, for marketing or public relations purposes, without your written authorization, unless the creation, use or disclosure of such photographs or video recordings are authorized by law (e.g., for HFHC facility security surveillance purposes).

Special protections for certain types of PHI:

Certain Mental Health Information: If HFHC maintains PHI about you derived from mental health services provided to you by a psychiatrist, psychologist, clinical nurse specialist, social worker or counseling professional, HFHC will not disclose such mental health information to another health practitioner or facility outside of HFHC, for a diagnostic, treatment or continuity of care purpose, without your written authorization, unless such disclosure is:

  • Necessary in an emergency;

  • To a pharmacist for the purpose of dispensing medication; or

  • To a healthcare provider or facility, or to a third-party payor, for purposes of care management or coordination of care.

HFHC may use this information within HFHC for your diagnosis, treatment, and continuity of care.

HIV Information: If HFHC maintains any PHI regarding your HIV status (such as HIV test results or medical records containing HIV information), such information is afforded heightened protection under Maine law and HFHC will maintain the confidentiality and privacy of such information, and will not use or disclose such information, except as specifically authorized or required by Maine’s HIV confidentiality laws. Examples of permissible disclosures of HIV information that do not require an authorization, include:

  • Disclosures to the Maine Department of Health and Human Services’ Bureau of Health when necessary to carry out its statutory duties, including the duty to protect the public health and to notify individuals in at risk for the transmission of communicable diseases;

  • Disclosures pursuant to a court order;

  • Disclosures in proceedings held under Maine’s communicable disease laws;

  • Disclosures in proceedings held pursuant to Maine’s Adult Protective Services Act;

  • Disclosures in proceedings pursuant to Maine’s child protection laws;

  • Disclosures in proceedings held pursuant to Maine’s mental health laws; and

  • Disclosures to utilization review committees or peer review organizations for utilization review, audits, and program evaluation purposes.

Certain Substance Abuse Information: If HFHC possesses any substance abuse PHI about you that is subject to the heightened federal confidentiality protections afforded to certain substance abuse program records under 42 C.F.R. Part 2, or if HFHC acquires such PHI from another provider or facility, HFHC will maintain the confidentiality and privacy of such information, and will not use or disclose such information, except as specifically authorized or required by 42 C.F.R. Part 2. If HFHC creates, acquires or maintains any 50 East Main Street Harrington, ME 04643 Phone 207-483-4502 substance abuse information about you that is not from a Part 2 substance abuse program, HFHC will protect the confidentiality of such information and use and disclose such information in the same way.

Reproductive Health Care: Prohibited Uses and Disclosures: HFHC may not use or disclose your PHI for any of the following activities: (i) to conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care; (ii) to impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care; or (iii) to identify any person for any purpose described in (i) or (ii). For example, if you receive reproductive health care from HFHC that is lawful under Maine law and/or protected, required, or authorized by Federal law, under the circumstances in which it is provided, and a health oversight agency or a law enforcement official from another state were to request or subpoena your PHI related to such reproductive health care from HFHC for one of the above prohibited purposes, HFHC would not be authorized to disclose such PHI in response to the request or subpoena.

Uses and Disclosures Conditioned Upon an Attestation: Additionally, as specified under HIPAA, HFHC may not use or disclose PHI potentially related to your reproductive health care (i) to a health oversight agency, (ii) in the course of any judicial or administrative proceeding (e.g., in response to a court order, subpoena), (iii) to a law enforcement official, or (iv) to a coroner or medical examiner, unless HFHC obtains a valid written attestation from the person requesting your PHI related to reproductive health care. The attestation must verify that the requested use or disclosure of your PHI related to reproductive health care is not otherwise prohibited by HIPAA and complies with HIPAA’s requirements.

HFHC protects, uses, and discloses your other PHI. Examples of permissible disclosures of this information that do not require an authorization include disclosures:

  • Within HFHC for treatment purposes, such as to develop a diagnosis and treatment plan;

  • For HFHC’s healthcare operations, such as reviewing quality of care, if certain requirements are met;

  • To other HFHC personnel who have administrative control over the program within HFHC that has the information;

  • To contractors to perform services for HFHC, if those contractors agree to protect the information;

  • To law enforcement for reporting of crimes against HFHC personnel or on HFHC’s premises;

  • Under mandatory child abuse and neglect reporting laws;

  • Relating to the cause of death of a patient when made under laws requiring the collection of death or other vital statistics, or permitting inquiries into the cause of death, or to personal representatives of an estate or a deceased patient’s spouse or family member;

  • To a central registry or to a detoxification program to prevent multiple enrollments of a patient, if certain requirements are met;

  • For certain research purposes if certain requirements are met;

  • For certain medical emergencies and to the federal Food and Drug Administration when the health of an individual may be threatened by a product;

  • For certain audit, evaluation, and quality improvement activities;

  • Under a court order that meets certain requirements; or

  • When otherwise permitted or required by law.