Who this notice applies to
This notice applies to Empowering Minds Community Support Services and all of our workforce members, contractors, and Business Associates who handle your Protected Health Information (PHI) on our behalf. We are required by law to maintain the privacy of your PHI and to provide you with this notice of our legal duties and privacy practices.
Your rights under HIPAA
As a person we serve, you have the right to:
- Access your record. Request to inspect and get a copy of your medical and billing records.
- Request an amendment. Ask us to correct information you believe is incorrect or incomplete.
- Receive an accounting of disclosures. Request a list of certain disclosures we have made of your PHI.
- Request restrictions. Ask us to limit how we use or share your PHI for treatment, payment, or health care operations.
- Request confidential communications. Ask us to contact you in a specific way (for example, at a specific phone number or mailing address).
- Receive a paper copy of this notice. Request a paper copy at any time, even if you have received it electronically.
- Choose someone to act for you. Designate a personal representative authorized to make health care decisions on your behalf.
- File a complaint. Complain if you believe your privacy rights have been violated. You will not be retaliated against for filing a complaint.
How we use and disclose your information
We use and disclose Protected Health Information primarily for three permitted purposes under HIPAA:
- Treatment: coordinating and providing your behavioral health services, sharing information with members of your care team, and referring you to other providers.
- Payment: billing NC Medicaid or other funders for services provided, verifying eligibility, and obtaining authorization for services.
- Health care operations: quality improvement, training, licensing, audits, and administrative functions needed to run our agency.
Other uses and disclosures may be permitted or required by law — for example, mandatory reporting of suspected abuse or neglect, responding to court orders, or public health reporting. Uses and disclosures not covered by HIPAA permissions or by law require your written authorization, which you may revoke at any time in writing.
Uses and disclosures that require your authorization
Most uses and disclosures of psychotherapy notes, most uses and disclosures for marketing purposes, and disclosures that constitute a sale of PHI require your written authorization. You can authorize or withhold authorization at your discretion.
How we protect your information
We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of your PHI. These include:
- Encrypted systems: all electronic PHI is stored and transmitted in encrypted form.
- Workforce training: every team member receives HIPAA training at hire and annually.
- Access controls: only authorized staff with a legitimate need access your records.
- Business Associate Agreements: every vendor that handles PHI on our behalf operates under a signed BAA.
- Annual risk assessment: we conduct HIPAA Security Rule risk assessments as required by 45 CFR § 164.308.
- Breach notification: if a breach of your unsecured PHI occurs, we will notify you as required by law.
Our duties
We are required by law to:
- Maintain the privacy and security of your PHI
- Notify you promptly if a breach occurs that may compromise your PHI
- Follow the terms of the notice that is currently in effect
- Not use or share your PHI other than as described in this notice unless you tell us we can in writing
If you authorize a use or disclosure in writing, you may revoke that authorization at any time. We will honor the revocation going forward, except for disclosures we have already made under that authorization.
Changes to this notice
We reserve the right to change this notice. The new notice will apply to all information we have about you. We will make the updated notice available at our office, on our website, and upon request.
Contact our Privacy Officer
To exercise any of your rights, ask a question, or file a complaint, contact our Privacy Officer:
Email: privacy@empoweringmindsnc.org
Phone: [Privacy Officer phone]
Mail: [Office address]
Attn: Privacy Officer
You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr or by calling 1-800-368-1019. You will not be retaliated against for filing a complaint.
Effective date
This notice is effective [effective date to be set on final publication].