“Protected health information” and “sensitive personal information” (PHI/SPI) is information that identifies a person or patient. This data can be your age, address, e-mail address, and medical facts. It can be about your past, present or future physical or mental health conditions. It also can be about sensitive health care services and other personal facts.

• Make sure that your PHI/SPI is kept private.
• Give you this notice of our legal duties and privacy practices. It describes the use and disclosure of your PHI/SPI.
• Follow the terms of the notice in effect now.
• Tell you about any changes in the notice.
• Notify you that your health information (PHI/SPI) created or received by Community is subject to electronic disclosure.
• Give you an electronic copy of your record within 15 days after you ask in writing. We can also give this to you another way if you ask for it. There are some exceptions to this rule.
• With exceptions, not sell any PHI/SPI.
• Disclose any breach of unencrypted PHI/SPI we think an unauthorized person might have.
• Train employees about our privacy practices. Training is no later than 60 days after their first day and at least every two years after.

We have the right to change this notice. The effective date is on the bottom of each page. You can get a copy from our Web site: CommunityHealthChoice.org. You can also call our Privacy Officer at 713.295.2268 and ask for a copy to be mailed to you.

Here are some examples of allowed uses and disclosures of your PHI/SPI. These are not the only ones.

• Treatment – Community will use and share your PHI/SPI to provide, coordinate or manage your health care and other services. We might share it with doctors or others who help with your care. In emergencies, we will use and share it to get you the care you need. We will only share what is needed.
• Payment – We can use and share your PHI/SPI to get paid for the health care services that you received.
• Health Care Operations – We can use or share your PHI/SPI in our daily activities. For example:
  • To call you to remind you of your visit
  • To conduct or arrange other health care activities
  • To send you a newsletter
  • To send news about products or services that might benefit you
  • To give you information about treatment choices or other benefits
• Business Associates – We can share your PHI/SPI with our Business Associates. They must also protect it. They must follow HIPAA privacy and security rules, HITECH rules, and Texas Privacy Laws. They can face fines and penalties. They have to report any breaches of unencrypted PHI/SPI.
• Required by Law – By law, sometimes we must use or share your PHI/SPI. Here are some examples:
  • Public Health Authorities
  • To prevent or control disease, injury or disability
  • To report births and deaths
  • To report child abuse or neglect
  • To report problems with medicines or other products
  • To notify authorities if we believe a patient has been the victim of abuse, neglect or domestic violence
• Communicable Diseases – We can share your PHI/SPI to tell a person they might have been exposed to a disease. We can tell a person they might be at risk for getting or spreading a disease or condition.
• Health Oversight Agencies and U.S. Food and Drug Administration – We will share your PHI/SPI when health oversight agencies ask for it.
• Legal Proceedings – We will share your PHI/SPI for legal matters. We must receive a legal order or other lawful process.
• Law Enforcement and Criminal Activity – We will share your PHI/SPI if we believe it helps solve a crime. We will share it to stop or reduce a serious threat. We can also share it to help law enforcement officers find or arrest a person.
• Coroners, Funeral Directors, and Organ Donations – We share PHI/SPI with coroners, medical examiners, and funeral directors. We can also share it to help manage organ, eye or tissue donations.
• Research – If Community agrees to be part of an approved research study, we will make sure that your PHI/SPI is kept private.
• Military Activity and National Security – We can share PHI/SPI of Armed Forces personnel with the government.
• Workers’ Compensation – We will share your PHI/SPI to follow workers’ compensation laws and similar programs.
• Inmate – We can use or share your PHI/SPI if you are a correctional facility inmate and we created or received your PHI/SPI while providing your care.
• Disclosures by the Health Plan – We will share your PHI/SPI to get proof that you are able to get health care. We will work with other health insurance plans and other government programs.
• Parental Access – We follow Texas laws about treating minors. We follow the law about giving their PHI/SPI to parents, guardians or other person with legal responsibility for them.
• For People Involved in Your Care or Payment for Your Care – We will share your PHI/SPI with your family or other people you want to know about your care. You can tell us who is allowed or not allowed to know about your care. You must fill out a form that will be part of your medical record.

The HITECH Act does not let Community receive any money for marketing communications.

Other laws protect PHI/SPI about mental health, alcohol and drug abuse treatment, genetic testing and HIV/AIDS testing or treatment. You must agree in writing to share this kind of PHI/SPI.

• Right to Inspect and Copy Your Health Information – In most cases, you have the right to look at your PHI/SPI. You can get a printed copy of the record we have about you. It can also be given to you in electronic form. There might be a charge for copying and mailing.
• Right to Amend Your Health Information – You can ask Community to change facts if you think they are wrong or not complete. You must do this in writing. We do not have to make the changes. If we deny your request, we will do so within 60 days.
• Right to an Accounting of Disclosures – You can ask for a list of certain disclosures of your PHI/SPI. The list will not include PHI/SPI shared before April 14, 2003. You cannot ask for more than six years. The list can only go back three years for electronic PHI/SPI. There are other limits that apply to this list. You might have to pay for more than one list a year.
• Right to Ask For Restrictions – You can ask us to not use or share part of your PHI/SPI for treatment, payment or health care operations. You must ask in writing. You must tell us (1) PHI/SPI you want restricted; (2) if you want to change our use and/or disclosure; (3) who it applies to (e.g., to your spouse); and (4) expiration date.
• If we think it is not best for those involved, or cannot limit the records, we do not have to agree. If we agree, we will only share that PHI/SPI in an emergency. You can take this back in writing at any time.
• If you pay in full for an item or service, you can ask a Provider to not share PHI/SPI with Community for payment or operations purposes. These are the main reasons we would need it. This does not apply if we need the PHI/SPI for treatment purposes.
• Right to Receive Confidential Communications – You can tell us where and how to give you your PHI/SPI. You can ask us to only call at a certain number. You can also give us another address if you think sending mail to your usual address will put you in danger. You must be specific and put this in writing.
• Right to Choose Someone to Act for You – If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure this person has this authority and can act for you before we take any action.
• Right to a Copy of this Notice – You can ask for and get a copy of this notice from at any time, even if you have received this notice previously or agreed to receive this notice electronically.
• Right to Withdraw an Authorization for Disclosure – If you have let us use or share your PHI/SPI, you can change your mind at any time. You must tell us in writing. In some cases, we might have already used or shared it.
• Right to be Notified of Breach – You will be told if we find a breach of unsecured PHI/SPI. The breach could be from either Community or a business associate of Community.

This notice of Privacy Practices is given to you as part of HIPAA. There are other privacy laws that also apply. Those include the Freedom of Information Act; Alcohol, Drug Abuse, and Mental Health Administration Reorganization Act; the Health Information Technology for Economic and Clinical Health Act (HITECH) and the Texas Privacy Law, Health and Safety Code, Section 181.

You can file a complaint if you believe your privacy rights have been violated. You can call Community’s privacy officer at 713.295.2268 or 1.888.760.2600. You can also file a complaint with the Department of Health and Human Services, Office of Civil Rights. Please refer to the Office of Civil Rights contact information at the end of this notice. We urge you to tell us about any privacy concerns. You will not be retaliated against in any way for filing a complaint.

Other than as stated above, we will not use or share your PHI/SPI without your written agreement. You can change your mind about letting us use or share your PHI/SPI at any time. You must tell us in writing.

The HITECH Act makes Community limit uses, disclosures, and requests of your PHI/SPI. We cannot ask for or share more than is needed.

This notice originally took effect April 14, 2003, and was updated September 23, 2013. This notice stays in effect until it is replaced by another notice.

If you have any questions or complaints:
Chief Compliance Officer
Community Health Choice, Inc.
4888 Loop Central Dr. Suite 600
Houston, TX 77081
Local: 713-295-6733
To report concerns anonymously please call toll-free: 1.877.888.0002

U.S. Department of Health and Human Services Office for Civil Rights
200 Independence Avenue, S.W.
Room 509F HHH Building
Washington, D.C. 20201
Phone: 1.877.696.6775
www.hhs.gov/ocr/privacy/hipaa/complaints
For more information, please see:
www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.