Click here to print this page.

NOTICE OF POLICIES AND PRACTICES UTILIZED BY THE
CLINICAL PSYCHOLOGY CENTER
TO PROTECT THE PRIVACY OF YOUR HEALTH INFORMATION

THIS NOTICE DESCRIBES HOW PSYCHOLOGICAL AND MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

I.   Uses and disclosures for treatment, payment and health care operations

The Clinical Psychology Center (CPC) may use or disclose your protected health information (PHI), for treatment, payment, and health care operations purposes with your consent.  To help clarify these terms, here are some definitions:

  • PHI refers to information in your clinical record that could identify you.

  • Treatment occurs when the CPC provides, coordinates, or manages your health care and other services related to your health care.  An example of treatment would be when your therapist at the CPC consults with another health care provider, such as your family physician or another psychologist.

  • Payment is when the CPC obtains reimbursement for your health care. Examples of payment are when the CPC discloses your PHI to your health insurer to obtain reimbursement for your health care or to determine eligibility or coverage.  However, note that at this time the CPC does not accept insurance.

  • Health care operations are activities that relate to the performance and operation of the CPC.  Examples of health care operations are quality assessment and improvement activities, business-related matters, such as audits and administrative services, and case management and care coordination.

  • Use applies only to activities within the CPC, such as sharing, employing, applying, utilizing, examining, and analyzing information that identifies you.

  • Disclosure applies to activities outside the CPC, such as releasing, transferring, or providing access to information about you to other parties.


II.   Uses and disclosures requiring authorization

The CPC may use or disclose PHI for purposes outside of treatment, payment, and health care operations when your appropriate authorization is obtained.  An authorization is written permission above and beyond the general consent that permits only specific disclosures.  In those instances when the CPC is asked for information for purposes outside of treatment, payment, and health care operations, we will obtain an authorization from you before releasing this information.  The CPC will also need to obtain an authorization before releasing your psychotherapy notes. Psychotherapy notes are notes made about your conversation during private, family, or group counseling sessions, and when these exist, they are kept separate from the rest of your clinical record.  These notes are given a greater degree of protection than the PHI.  Further, the CPC will need to obtain an authorization from you before using or disclosing PHI in a way that is not described in this Notice.

You may revoke all authorizations regarding PHI and/or psychotherapy notes at any time, provided such revocation is in writing.  You may not revoke an authorization to the extent that (1) the CPC has relied on that authorization, or (2) if the authorization was obtained as a condition of obtaining insurance coverage, and the law provides the insurer the right to contest the claim under the policy.  However, remember that the CPC does not currently accept insurance.

III.   Uses and disclosures with neither consent nor authorization

The CPC may use or disclose PHI without your consent or authorization in the following circumstances:

  • Child abuse.  If a therapist in the CPC has reasonable cause, on the basis of professional judgment and in the course of professional activity within the CPC, to suspect abuse of an identifiable child, the therapist is required by law to report this to the Pennsylvania Department of Public Welfare.

  • Adult and domestic abuse.  If a therapist in the CPC has reasonable cause to believe that an older adult is in need of protective services (in connection with abuse, neglect, exploitation, or abandonment), the therapist may report this to a local agency which provides protective services.

  • Judicial or administrative proceedings.  If you are involved in a court proceeding, and a request is made about the professional services you received in the CPC or the records thereof, such information is privileged under Pennsylvania law, and the CPC will not release the information without your written consent or a court order.  The privilege does not apply when you are being evaluated for a third party or when the evaluation is court ordered.  You will be informed in advance if this is the case.

  • Serious threat to health or safety.  If you express a serious threat or intent to kill or seriously injure an identified or readily identifiable person or group of people, and your therapist in the CPC determines that you are likely to carry out the threat, the therapist must take reasonable measures to prevent harm. Reasonable measures may include directly advising the potential victim of the threat or intent.

  • Workers’ compensation.  If you file a workers’ compensation claim, the CPC will be required to file periodic reports with your employer, which shall include, where pertinent, history, diagnosis, treatment, and prognosis.

  • As allowed under other sections of Section 164.512 of the Privacy Rule and Pennsylvania law.  This includes certain narrowly-defined disclosures to law enforcement agencies, to a health oversight agency (such as HHS or the Pennsylvania Department of Health), a coroner or medical examiner, for public health purposes related to disease or FDA-regulated products, or for specialized government functions such as fitness for military duty, eligibility for VA benefits, and national security and intelligence.

  • Records “converted” under FERPA.  Consistent with the Family Educational Records Protection Act (“FERPA”), the records of current students at the University of Pittsburgh may on rare occasion be “converted,” resulting in a decreased level of privacy protection.  This occurs when the records are used for purposes other than treatment of a physical or mental health disorder.  Records are most commonly “converted” when they are used for research purposes or when they are inspected by someone not involved in the student’s treatment, such as a parent, the student, or another party. After this occurs, those portions of the student’s CPC record that were used for purposes other than treatment fall under FERPA guidelines.  FERPA permits university officials to inspect records for cause and under some circumstances permits the student’s family member to inspect the records.


IV.   Client rights and CPC duties

CLIENT RIGHTS:

  • Right to request restrictions.  You have the right to request restrictions on certain uses and disclosures of PHI about you.  However, the CPC is not required to agree to a restriction you request.

  • Right to receive confidential communications by alternative means and at alternative locations.  You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations.  For example, you may not want a family member to know that you are being seen here.  In such a case, upon your request the CPC would send any communications to another address.

  • Right to inspect and copy.  You have the right to inspect or obtain a copy (or both) of such PHI in the CPC’s clinical and billing records as is used to make decisions about you, for as long as the PHI is maintained in the record.  The CPC may deny your access to PHI under certain circumstances, but in some cases you may have this decision reviewed.  On your request, CPC staff will discuss with you the details of the request and denial process.

  • Right to amend.  You have the right to request an amendment of PHI for as long as the PHI is maintained in the record.  The CPC may deny your request.  On your request, CPC staff will discuss with you the details of the amendment process.

  • Right to an accounting.  You generally have the right to receive an accounting of disclosures of PHI for which you have neither provided consent nor authorization (as described in Section III of this Notice).  On your request, CPC staff will discuss with you the details of the accounting process.

  • Right to a paper copy.  You have the right to obtain a paper copy of this Notice from the CPC upon request, even if you have agreed to receive the Notice electronically.

  • Right to restrict disclosures when you have paid for your care out-of-pocket.  You have the right to restrict certain disclosures of PHI to a health plan when you pay out-of-pocket in full for CPC services.  At present, however, the CPC does not accept any insurance.

  • Right to be notified if there is a breach of your unsecured PHI.  You have a right to be notified if: (a) there is a breach (a use or disclosure of your PHI in violation of the HIPAA Privacy Rule) involving your PHI; (b) that PHI has not been encrypted to government standards; and (c) the CPC risk assessment fails to determine that there is a low probability that your PHI has been compromised.


CPC DUTIES:

  • The CPC is required to maintain the privacy of PHI and to provide you with a Notice of its legal duties and privacy practices with respect to PHI.

  • The CPC reserves the right to change the privacy policies and practices described in this Notice.  Unless the CPC notifies you of such changes, however, it is required to abide by the terms currently in effect.

  • If the CPC revises its policies and procedures, it will provide clients with a revised Notice, either at the time of their next appointment or by mail.


V.   Complaints

If you are concerned that the CPC has violated your privacy rights, or you disagree with a decision made by CPC staff about access to your records, you may contact Jill M. Cyranowski, Ph.D., Director, CPC, at 412-624-2077.

You may also send a written complaint to the Secretary of the U.S. Department of Health and Human Services.  Dr. Cyranowski can provide you with the appropriate address upon request.

VI.   Effective date, restrictions, and changes to privacy policy

This revised notice is in effect as of August 8, 2019.


Click here to print this page.