Everest Recovery will comply with Federal Regulations, HIPAA and 42 CFR PART 2 (June 9, 1987) and all state regulations governing confidentiality. When Federal and state requirements on this subject differ, Everest Recovery will subscribe to the regulation that is most protective of the client’s privacy. Any information released about a patient to individuals, organizations, employers and/or agencies including third party payers and the justice system will be done so only with written consent of the patient.

All patients’ confidentiality will be protected in compliance with State and Federal Regulations.

Written Consent:

• Only information specified on a written consent from the patient will be given to another person.
• Each information request must have prior written consent. Federal Regulation HIPAA and 42 CFR (June 9, 1987) does not allow for verbal authorization or blanket consents.
• Everest Recovery will not disclose any information identifying a patient unless:

1. 1. Its purpose is for internal communication
   2. Information being disclosed has no patient identifying information
   3. There is written consent
   4. There is a Qualified Service Organization Agreement (QSOA)
   5. Everest Recovery will not engage in QSOAs or BAs with law enforcement agencies or other drug and alcohol treatment agencies.
   6. In a medical emergency where the client’s life is in immediate jeopardy, information can be released only to proper medical authorities and only for the purpose of treating the client – see 71 P. S. § 1690.108(b).
   7. With a court order from a court of common pleas after application showing good cause.
   8. For research and audit purposes
   9. A crime has been committed on the premises, only information relating to the incident, the treatment record continues to be protected – see 42 C.F.R. Part 2, Subpart B, § 2.12 (c) (5).
   10. To report suspected child abuse* or neglect only information relating to the incident of abuse or neglect, the treatment record continues to be protected – see 42 C.F.R. Part 2, Subpart B, § 2.12 (c)(5)

*”Applies only to initial reports of child abuse or neglect”. (legal Action Guide pg. 72)

Forms utilized for the purpose of consent to release of information must be filled out appropriately and completely, and a copy offered to the patient. No patient will be asked to sign a blank release. Acceptance or refusal by patient must be noted. Patients may revoke a release at any time. The patient must sign a release of information before any information can be given to anyone, including spouse, parents, children, friends, and other patients in addition to the more formal organizations.

Information to be filled out will include but not limited to:

• Name of the patient
• Dated signature of patient
• Name or general designation of the program that is making the disclosure
• Name, title, or organization to which disclosure is made
• Specific information disclosed
• Purpose of disclosure
• Dated signature of witness
• Expiration date of the consent should reflect the following: Time, date, and event of condition depending upon the nature of the information disclosed
• A revocation statement
• Date of Birth
• Witness signature
• A copy of the release will be offered to the patient and one will be filed in the record of the patient.

Consent to Release Information to the Media:

• When filling out a Release of Information that involved the Media the CEO must be contacted. The patient must speak to the CEO. The release of Information will be forwarded to the CEO prior to the disclosure of information.
• The Release of Information to the media will inherently include a re-disclosure to the public. Therefore, the Consent to Release Information must include a statement similar to the following: “I further authorize ABC Newspaper to re-disclose that information to the general public”.

In states where parental consent for treatment is required for minors the release would include the dated signature. (drug-free patients/pregnant patients) of the patient’s guardian.

Everest Recovery will adhere to 42 CFR Part 2, Subpart C – 2.15 (b) which states the following:

(b) Deceased patients—(1) Vital statistics. These regulations do not restrict the disclosure of patient-identifying information relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death.

If state law requires that certain information is disclosed for the purpose of collecting vital statistics, our clinics will comply.

If there is an inquiry into the cause of death of one of our deceased patients, our clinics will disclose that information to the individual/organization in the state that is authorized by law to conduct this inquiry.

If there is a request for information regarding a deceased person who was never a patient of Everest Recovery, this fact may be communicated to the party making the request.

The Program Director will ensure that information disclosed in compliance of 42 CFR Part 2, Subpart B – 2.15 (b) (regarding deceased patients) is made to the appropriate individual/organizations.

Duty to Warn Procedures

Everest Recovery is bound by 42 CFR Part 2 and HIPAA and there is no exception to report a “Duty to Warn” within 42 CFR Part 2 to an identifiable 3rd party in imminent danger as a result of a threat made by one of it’s patients, therefore we must consider the following options when confronted with this issue:

1. Ask the patient to sign a consent that would allow a Everest Recovery associate to disclose/warn the identified 3rd party they are imminent danger as result of a the threat . The release should not include reporting any information to law enforcement. Federal regulations 42 CFR Part 2 state that no patient identifying information can be used to initiate or substantiate any criminal charges against a patient or to conduct an investigation of a patient.
2. If the patient is not willing to sign a consent, we would then have one associate call the identified 3rd party and anonymously report (which means they cannot identify themselves by name or title, they cannot identify themselves as an associate of Everest Recovery and they cannot identify the person making the threat as a patient of Everest Recovery) to them they are in imminent dangers as a result of threats made by “the name of the person”. While one associate is making this call, we would have another associate witness the call being made. The associate would then call the police and report the threat in the same manner (for example – I can’t tell you who I am or where I am calling from however, Joe Smo is threatening to kill Mary Smo ). While one associate is making this call, another associate is witnessing the call being made.
3. After both calls have been completed, an unusual incident report would be completed and both associates would sign the report. Everest Recovery unusual incident reports identify patients by number and associates by title.
4. When anonymously reporting a “Duty to Warn”, no documentation should be placed in the patient’s record.
5. An Everest Recovery clinic that reports imminent danger to an identifiable 3rd party anonymously would not violate patient confidentiality/privacy, since one of the 9 allowable exceptions for disclosure under 42 CFR Part 2 is a disclosure that does not include patient identifying information.
6. When associates complete an incident report documenting an anonymous “Duty to Warn” call, they must follow the procedures in the policy of reporting a critical incident.

Prohibition on Redisclosure

Notice to accompany disclosure. Each disclosure made with the patient’s written consent must be accompanied by the following written statement:

This information has been disclosed to you from records protected by Federal confidentiality rules 42 CFR part 2. The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

Confidentiality Restrictions:

General: Patients records at Everest Recovery may be used only as permitted by 42 CFR Part 2 and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any Federal, State, or local authority. Any discloser made by Everest Recovery must be limited to that information which is necessary to carry out the purpose of the disclosure.

Unconditional compliance required: The restrictions on disclosure and use apply whether Everest Recovery believes that the person seeking the information already has it, has other means of obtaining it, is a law enforcement or other official, has obtained a subpoena, or asserts any other justification for a disclosure or use which is not permitted by 42 CFR Part 2.

Acknowledging the presence of patients: Responding to request. (1) The presence of an identified patient in a Everest Recovery or component of Everest Recovery which is publicly identified as a place where only alcohol or drug abuse diagnosis, treatment, or referral is provided may be acknowledged only if the patient’s written consent is obtained in accordance with 42 CFR Part 2 subpart C or if an authorizing court order is entered in accordance with 42 CFR Part 2 subpart E. 42 CFR Part 2 permits acknowledgement of the presence of an identified patient in a facility or part of a facility if the facility is not publicly identified as only an alcohol or drug abuse diagnosis, treatment or referral facility, and if the acknowledgement does not reveal that the patient is an alcohol or drug abuser. (2) Any answer to a request for a disclosure of patient records which is not permissible under 42 CFR Part 2 must be made in a way that will not affirmatively reveal that an identified individual has been, or is being diagnosed or treated for alcohol or drug abuse. An inquiring party may be given a copy of these regulations and advised that they restrict the disclosure of alcohol or drug abuse patient records, but may not be told affirmatively that the regulations restrict the disclosure of the records of an identified patient. 42 CFR Part 2 does not restrict a disclosure that an identified individual is not and never has been a patient.

Confidentiality Statement

All associates must review the confidentiality policies and sign a statement indicating their compliance to the same. Intentional violation of HIPAA or 42 CFR part 2 (June 9, 1987) is just cause for dismissal. All visitors will be asked to sign a confidentiality statement.

Patient access to record:

Everest Recovery is recognized as a healthcare facility under the HIPAA regulations. Patients will have access to records upon request in compliance with 45 CFR 164.524. Psychotherapy notes may be removed prior to patient review if determined to be a detriment.

Patients have the right to inspect my records subject to the following limitations:

• Patients may request in writing their desire to review their records
• All secondary information will be removed from the record prior to allowing the patient to review their record. This information must be placed back in the record immediately following the patients review.
• A clinical associate will supervise the review. Once the patient reviews their record, a note will be entered in PDAP format that the process was completed.
• Patients will be asked to sign a form that will verify they were allowed the right to inspect their record.
• Patients have the right to appeal a decision limiting access to the records through the grievance process.
• Patients have the right to request the correction of inaccurate, irrelevant, outdated or incomplete information from their records.
• Patients have the right to submit rebuttal data or memoranda to their own record.
• Patients have the right to request copies of their record and within 5 business days be provided with a copy. (a fee may be charged

Contact for Inquiries:

Patients may speak with the Program Director for information regarding their records and for any additional information regarding privacy. If they feel that the Program Director has violated their privacy, they may complete a Patient Grievance report located on the Everest Recovery Home Page.