I. INTRODUCTION
- CLCL Foundation is a nonprofit organization providing free mental health services to young people and families in crisis, is adopting this HIPAA Privacy Policy to protect the confidentiality of our participants.
- While we do not accept insurance or charge fees and are not a healthcare facility required to enact this policy, CLCL is committed to maintaining the privacy of all personal information provided by those served.
II. HIPAA COMPLIANCE
- CLCL Foundation and its staff, volunteers, interns, and Board and Council members, voluntarily comply with the Health
- Insurance Portability and Accountability Act of 1996 (HIPAA) to ensure the privacy and security of Protected Health Information (PHI) and Private Personal Information (PPI) that young people and families share with CLCL staff and counselors.
- CLCL is committed to upholding the rights and obligations established by HIPAA and its regulations.
III. DEFINITION
A. Breach: Unauthorized acquisition, access, use or disclosure of PHI or PPI in a manner not permitted by the Privacy Rule or Security Rule, compromising the security of such information. This excludes incidents described in 45 CFR Section 164.402.
B. Designated Record Set: A group of records maintained by or for the organization, including medical and billing records and other records used to make decisions about individuals, including Biopsychosocial reports, Psychological or Psychiatric Reports, Fire Evaluations, information provided by the NJ Division of Child Protection and Permanency (DCP&), Care Managing Organizations (CMOs), and other accrued medical, psychological,behavioral, and school information.
C. HIPAA: Health Insurance Portability and Accountability Act of 1996.
D. HIPPA Regulations: Regulations promulgated under HIPAA, including the Privacy Rule and Security Rule.
E. HITECH: Health Information Technology for Economic and Clinical Health Act.
F. Individual: The person who is the subject of the PHI and PII. Notice of Privacy Practices: Notice required by 45 CFR 164.520.
G. Privacy Rule: Standards for Privacy of Individually Identifiable Health Information at 45 CFR Parts 160 and 164.
H. Protected Health Information (PHI): Individually identifiable health information transmitted or maintained in any form.
I. Private Personal Information: Information that is considered sensitive and must be protected. This includes information like Social Security numbers, birth dates, address, school information, evaluations,and other details or documents.
J. Record: Any item, collection, or grouping of information that includes PHI and is maintained by or for an organization. Required by Law: As defined in 45 CFR 164.501.
K. Secretary: Secretary of the United States Department of Health and Human Services or designate.
L. Secretary Rule: Stands for Security for the Protection of Electronic PHI, codified as 45 CFR parts 160,162, and 164.
M. De-Identification: The process of de-identification, by which identifiers are removed from health information, data collection, and surveys to mitigate privacy risks to individuals and thereby support the secondary use of data for comparative effectiveness studies, policy assessment, life sciences research, and other endeavors.
IV. USES AND DISCLOSURES OF PHI OR PPI
A. We may use and disclose your PHI/PPI for the following purposes:
-
- Services: To provide, coordinate, or manage your mental health care, case management, and related services.
- Required by Law: To comply with federal, state, or local laws and regulations.
- Public Health Activities: For public health purposes, such as preventing disease outbreaks.
- Research: To provide nonidentifiable and confidential versions of gathered PPI and survey response data.
This is used to evaluate the effectiveness of programs and services.
- Legal Proceedings: In response to court or administrative order, or subpoena.
- Other Uses: With your written authorization, unless otherwise permitted or required by law.
V. YOUR RIGHTS
A. You have a right to:
-
- Request Restrictions: Request restrictions on certain uses and disclosures of your PHI/PPI.
- Confidential Communications: Request communication in a specific way or location.
- Assess and Amend PHI/PPI: Access and request amendments to your PHI/PPI.
- Accounting of Disclosures: Request a record of disclosures of your PHI/PPI.
- File a Complaint: File a complaint if you believe your privacy rights and confidentiality have been
violated. Provide it to the Executive Director (ED) and the Board of Directors (BoD).
VI. OUR RESPONSIBILITIES
We are required to:
- Maintain Privacy: Protect the privacy of your PHI/PPI.
- Provide Notice: Offer this notice detailing our privacy practices.
- Notify of Breach: Inform you of any breach involving unsecured PHI/PPI.
- Internal and Continuous Quality Improvement: Participant information is used internally for quality improvement purposes. Your identity will not be disclosed outside of CLCL Foundation.
Dr.Jeffrey Waid of University of Minnesota School of Social Work will evaluate de-identified information.
VII. INTERNAL AND CONTINUOUS QUALITY IMPROVEMENT
A. Participant information is used internally for quality improvement purposes and externally for program evaluation and assessment. Your identity will not be disclosed outside of CLCL Foundation.
VIII. FREE SERVICES
A. All our services are provided free of charge, ensuring accessible support without financial barriers.
IX. SAFEGUARDS AND REPORTING
A. Safeguards: Implement administrative, physical, and technical safeguards to protect the confidentiality,integrity, and confidentiality of PHI/PPI.
B. Reporting: Report any security incidents within 24 hours. In the event of a breach, provide a written report within 5 business days, including details of the incident and steps taken to mitigate harm.
X. CHILD ABUSE AND NEGLECT
A. Maintain the confidentiality of reports of child abuse or neglect, as required by NJSA 9:6-8:10a. Disclosure is permitted only under specific exceptions.
XI. BUSINESS ASSOCIATE OBLIGATIONS
A. Use of PHI/PPI: Use PHI/PPI solely for service provision and evaluation. Subcontractors must adhere to the same terms.
B. Notification: Inform participants of any changes in privacy practices or restrictions affecting PHI/PPI use or disclosure.
XII. LEGAL PROTECTIONS
A. Waivers: Nothing in this policy waives Section E of the New Jersey Tort Claims Act, NJSA 59:1-1 et seq., as they apply to CLCL Foundation.
XIII. CHANGES TO THIS POLICY
A. We reserve the right to modify this policy. Participants will be informed of significant changes.
XIV. CONTACT INFORMATION
A. For questions about this policy or our other confidentiality and privacy practices, please contact the
ED or BoD.
XV. ATTESTATION
The Board of Directors of Choose love. Celebrate life. A Foundation for Youth and Families, Inc. has adopted this policy on October 24, 2024. This policy will be effective January 1, 2025, and will remain in effect until changed or revoked by unanimous consent of the Board of Directors