Frequently Asked Questions

St. Luke's House, Inc.
Notice of Privacy Practices
Your Rights to Confidentiality

We take confidentiality very seriously. We follow very strict rules from the United States and Maryland Governments about when we can release your medical record-your protected health information.

The Federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule establishes a foundation of Federal protection for personal health information, carefully balanced to avoid creating unnecessary barriers to the delivery of quality health care. The Rule generally prohibits this program from using or disclosing your protected health information unless authorized by you, except as follows:

First, we are required by law to disclose your protected health information in certain circumstances, for example, to report abuse and neglect, and to warn about dangerous behavior. Second, we are authorized to disclose your protected health information without your consent when we use that information for treatment, payment or the health care operations of the program.

• Treatment generally means the provision, coordination, or management of health care and related services among health care providers or by a health care provider with a third party, consultation between health care providers regarding a patient, or the referral of a patient from one health care provider to another.
• Payment" encompasses the various activities of health care providers to obtain payment or be reimbursed for their services.
• Health care operations" are certain administrative, financial, legal, and quality improvement activities of a program that are necessary to run its business and to support the core functions of treatment and payment.

The program will, without your authorization:

• Use or disclose your protected health information for its own treatment, payment, and health care operations activities. For example:

- We may use your protected health information to provide health care to you and may consult with other health care providers about your treatment.
- We may disclose your protected health information as part of a claim for payment to a health plan.

• We may disclose your protected health information for the treatment activities of any health care provider (including providers not covered by the Privacy Rule).
• We may disclose your protected health information to another health care provider (including providers not covered by the Privacy Rule) for the payment activities of the entity that receives the information.
• We may disclose your protected health information to another provider for certain health care operation activities of the provider that receives the information if:

- Each provider either has or had a relationship with you, and the protected health information pertains to the relationship; and
- The disclosure is for a quality-related health care operations activity or for the

Psychotherapy Notes. Your psychotherapy notes are maintained separately from the rest of your medical record. Psychotherapy notes are the record of the statements made during a counseling session and your therapist's analysis of those statements. (This does not include documentation of medications, the treatment rendered, tests, treatment plans, progress notes and statements of prognosis.) You may review and copy your psychotherapy notes only if consent is given to you by your therapist; unlike the rest of your medical record, you may not see your psychotherapy notes without the express permission of your therapist. Psychotherapy notes may be used by your therapist for your treatment without your authorization. The notes may also be used by the program without your authorization for certain other limited health care operations. Otherwise, the use and disclosure of your psychotherapy notes requires your written authorization.

Security. Your medical record (your protected health information) is kept in a secure location and only those employees or clinicians who need access to your medical record for treatment, payment or health care operations, have access to your medical record unless you sign an authorization.

It is our policy to reasonably limit disclosures of, and requests for, protected health information for payment and health care operations to the minimum necessary. We also limit which members of our workforce may have access to protected health information for treatment, payment, and health care operations, based on those who need access to the information to do their jobs.

We may also disclose information in order to contact you, for example to make appointments, to check with you about how you are doing, and to evaluate the services that we provide to you. We may also contact you and your family for our fund-raising efforts and send you and your family promotional materials, such as our newsletter.

Your rights to see your record.

You have the right to see your record (excluding any psychotherapy notes), or to receive a summary of you record. To do this, please contact HIPAA Compliance Officer at 6040 Southport Dr, Bethesda, MD 20814 or by telephone at (301) 493-4200 ext. 251.

You also have the right to ask us for an accounting of the persons or programs to whom we have disclosed your protected health information. (This does not include disclosures for treatment, payment or health care operations, or to persons authorized by you.) To receive this accounting, please contact HIPAA Compliance Officer at 6040 Southport Dr, Bethesda, MD 20814 by telephone at (301) 493-4200 ext. 251.

If you disagree with the contents of your medical record, you may also request an amendment to your record. We will place that amendment in the medical record unless we did not create that part of the record or we believe the existing record is accurate and complete. If we grant the amendment, we will notify you and you may request that we provide the amendment to other programs and to programs that you identify to us as having already received your medical record. If we deny the amendment, we will give you specific reasons for the denial. You may then submit a statement of disagreement and we may submit a rebuttal. If you notify us in writing, we will attach your request for amendment and our denial to future disclosures of that part of your medical record. Also, if you continue to disagree, you may file a complaint with HIPAA Compliance Officer at (301) 493-4200 ext. 251 and with the Secretary of Health and Human Services at the Region III office of the U.S. Department of Health and Human Services, Office for Civil Rights, 150 S. Independence Mall West, Suite 372, Public Ledger Building, Philadelphia, PA 19106. Main Line (215) 861-4441. Hotline (800) 368-1019. Fax (215) 861-4431. TDD (215) 861-4440.

How to file a complaint. If you believe that your protected health information has been released in violation of the law, you have the right to file a complaint. You may file a complaint with our program by contacting or submitted a letter to: HIPAA Compliance Officer at 6040 Southport Dr, Bethesda, MD 20814 or by telephone at (301) 493-4200 ext. 251. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, 150 S. Independence Mall West, Suite 372, Public Ledger Building, Philadelphia, PA 19106. Main Line (215) 861-4441. Hotline (800) 368-1019. Fax (215) 861-4431. TDD (215) 861-4440. You have our promise that our program will not retaliate against you if you choose to file a complaint.

If you want to send your protected health information to someone, you must sign an authorization. Authorizations may be obtained from St. Luke's House, Inc.

Updates. Over time, we may change this Notice of Privacy Practices. If we make changes, we will post the updated version on our web site, stlukeshouse.com, so that you can see a copy there.