How BCFR May Use and Disclose Health Information About You

BCFR may use and disclose your protected health information to physicians, nurses, dietitians, therapists, or others who are involved in your care and who will provide you with treatment or services. Protected health information includes information that we create or receive that identifies you and your past, present or future health status or care, the provision of care, or payment for that health care. The primary reasons for which we may use and disclose your protected health information are as follows:

1. To provide treatment or services to you. This refers to the provision and coordination of your care by your Support Coordinator, or your doctor, therapist or other health care provider. For example, if you need assistance with your speech, we may contact a speech therapist to arrange services for you.
2. For payment of services provided to you. Your protected health information will be used to obtain payment for services you receive. This may include information that your health insurance plan may require before it approves or pays for health care services. For example, obtaining approval for a hearing aid may require that your health information be disclosed to Medicaid. We may also provide your health information to our billing department to prepare a bill to send to your insurance company, including Medicare or Medicaid, for payment for services provided.
3. For healthcare operations. We may use or disclose your protected health information to support the business activities of our offices, including quality assessment, employee review activities, compliance reviews, and accreditation surveys. These activities are referred to as “health care operations”. For example, BCFR may perform an internal quality assessment audit that may include the review of your health information to ensure compliance with regulatory and agency standards.

The following are circumstances where BCFR may use or disclose your health information without first obtaining your Authorization for purposes other than treatment, payment, or health care operations:

1. For Permitted or Required by Law Activities
   We will disclose health information about you when required to do so by federal, state or local law.
2. Appointment Reminders/ Other Health Services: We may use or disclose your health information to contact you at the address and/or telephone number you give us to provide appointment reminders, information about treatment alternatives or other health-related benefits and services that may be of interest to you. We may also use and disclose your health information for other marketing activities. For example, your name and address may be used to send you a newsletter about the services we offer. We may also send you information about products or services that we believe may be beneficial to you.
3. Communication with Family or Personal Representative: Unless you object, we may disclose to a member of your family, a relative, a close friend or a person you identify, your health information that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. In the event of your death, we may share your health information with family members and others who were involved in your care, unless you have previously expressed your wish that we not do so.
4. Emergencies: We may use or disclose your health information in an emergency treatment situation. If this happens, we shall try to obtain your consent as soon as reasonably practicable after the delivery of treatment.
5. Communication Barriers: We may use and disclose your health information if we attempt to obtain consent from you but are unable to do so due to substantial communication barriers and we determine, using professional judgment, that you intend to consent to use or disclosure under the circumstances.
6. Public Health: As required by law, we may disclose your health information to a public health or legal authority charged with preventing or controlling disease, injury or disability. For example, we may be required to disclose the fact that you have a communicable disease.
7. Health Oversight: We may disclose health information to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.
8. Abuse or Neglect: We may disclose your health information to the governmental entity or agency authorized to receive such information if we believe that you have been a victim of abuse, neglect or domestic violence.
9. Food and Drug Administration: We may disclose your health information to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, track products; to enable product recalls; to make repairs or replacements, or to conduct post marketing surveillance.
10. Legal Proceedings: We may disclose health information about you in response to an order of a court or administrative tribunal.
11. Law Enforcement: We may disclose limited health information for law enforcement purposes to identify or locate a victim, suspect, fugitive or material witness, a missing person, or for reporting a crime that occurred on our property or that may have caused a need for emergency services.
12. Coroners, Funeral Directors, and Organ Donation: We may disclose health information to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose medical/health information to a funeral director to permit the funeral director to carry out his lawful duties. We may disclose such information in reasonable anticipation of death. Health information may be used and disclosed for cadaveric organ, eye or tissue donation purposes.
13. Workers’ Compensation: Your health information may be disclosed by us as authorized to comply with workers’ compensation laws and other similar legally-established programs.
14. Serious Threat to Health or Safety: We may use or disclose health information if we believe in good faith that it is necessary to lessen or prevent a serious and imminent threat to the health and safety of a person or the public.
15. Specialized Government Functions: Your personal health information may be disclosed to other entities that are covered by this law that are government programs providing public benefits. For example, we may share information with the Department of Social Services to determine your spenddown requirements, or with the Department of Health and Senior Services to coordinate care for a child with special health needs.
16. Inmates: If you are an inmate of a correctional institution or in the custody of law enforcement, we may release health information about you as may be necessary for the institution to provide care to you, to protect your health and safety or the health and safety of others, or for the safety and security of the institution.
17. Immunization Records: We may disclose proof of immunizations to schools; however, we will seek to obtain the written or oral agreement of the parent, guardian, emancipated minor, or person acting in loco parentis.

The following are circumstances where BCFR may use or disclose your health information only after obtaining your authorization:

1. Most Uses and Disclosures of Psychotherapy Notes: Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group or family counseling session that are kept separately from the rest of your health record. These notes will typically not be used or disclosed without your Authorization. However, psychotherapy notes do not include medication prescription and monitoring, the times of your counseling session, the type/s of treatment furnished, results of clinical tests, or a summary of your diagnosis, functional status, treatment plan, symptoms, prognosis and progress, which are subject to restrictions that apply to the use or disclosure of those records.  BCFR would be required to disclose your health information discussed in this paragraph when required to do so by law, pursuant to a federal investigation to determine BCFR’s compliance with HIPAA or may disclose your health information pursuant to governmental health agency oversight investigations, audits or related activities pursuant to §164.512(d).
2. Marketing: If BCFR wants to include a photograph of you or to obtain a quote from you for inclusion in the Agency’s annual report, or on its website, social media or in other media presentations, we will ask for your Authorization to do so. We will also obtain your Authorization before communicating with you about a health-related product or service in a situation in which BCFR will receive payment in exchange for the communication, with the exception of communications with you about government, government-sponsored or government funded programs or general health promotions.
3. Communication with Others Who May Not Be Covered by the Federal Privacy Law:
   1. To refer you to other agencies that may be able to provide services that you express an interest in receiving such as Vocational Rehabilitation, and the City of Columbia.
   2. To provide your attorney with information you would like to share with him/her.
   3. To communicate with the public schools to coordinate school-related goals with your plan of care.
   4. To discuss your needs with a member of the Missouri General Assembly for the purpose of education related to funding for programs.
4. Sale of Protected Health Information: To communicate with others regarding your protected health information if BCFR or one of its Business Associates will receive direct or indirect payment in exchange for the disclosure of your protected health information. This does not apply to public health activities, for purposes related to your treatment or for payment of services provided by BCFR, for research purposes if the payment is cost-based, for services rendered by a Business Associate if the payment is cost-based, for providing you access to your protected health information, or as required by law.

You may revoke an authorization, in writing, at any time except to the extent that we have already taken action in good faith relying on the authorization. Any other uses and disclosures not specified in this Notice require an authorization.

BCFR Terms and Conditions Agreement – External Communications Through Electronic Services and Applications

The use of electronic applications or services, including, but not limited to Zoom, that have contracted with Boone County Family Resources “BCFR” for external communications between persons served or family members and BCFR is completely voluntary. The use of any electronic application or other electronic service for communication with BCFR is not required for receipt of BCFR services.

Declining participation in any or all of the electronic applications or services associated with BCFR external communications to persons served or families will not, in any way, impact an individual’s eligibility for supports or services or impact the supports or services assigned to, approved or received by an individual served by BCFR. By accessing, registering for and/or using the electronic applications or services associated with BCFR external communications in any manner, you are agreeing to comply with the terms of use and services of each respective entity and are acknowledging that BCFR does not exercise control over the external entities or the terms of use of such software, applications, or electronic services.

To facilitate individual choice and communication to individuals served and their families in a variety of means, Boone County Family Resources has contracted with external entities offering HIPAA Compliant Communication Services. Because the internet is not a completely secure environment, Boone County Family Resources cannot ensure the security of any information that you transmit electronically or guarantee that the information that you transmit electronically to BCFR or receive from BCFR through electronic applications such as Zoom or other applications may not be accessed, disclosed, altered, and/or destroyed by breach of any of the physical, technical and/or managerial safeguards established by these external entities. BCFR is not responsible for the practices employed by any external websites, applications, and/or services linked to and/or from the websites associated with electronic applications.

To promote the protection of your private information, BCFR has entered into Business Associate Agreements in recognition of the Health Insurance Portability and Accountability ACT (HIPAA) regulations and has created internal safeguards such as firewalls and data encryptions in an effort to protect your personal information. BCFR encourages all users to take steps to keep personal information safe by not disclosing or sharing your passwords and by taking precautions in maintaining security of all of your personal accounts. Further, BCFR shall have no responsibility for unauthorized access to your personal email accounts, phone accounts or other electronic accounts, and/or automatic forwarding of messages and/or viruses (caused by viruses or otherwise).

By electing to communicate with BCFR through these electronic applications and services, you are acknowledging these inherent risks associated with communicating via the internet and the possible security concerns associated and discussed herein. To the fullest extent permitted by applicable law, BCFR shall have no liability arising from or related to an individual or family member’s use or inability to use such electronic services or applications. Further, users shall agree to indemnify, defend and hold harmless BCFR and its officers, directors, and employees from and against any and all losses, damages, claims, costs, fines, or expenses of any kind, arising from or relating to use of such electronic applications. BCFR assumes no responsibility for the content that users submit or make available through the electronic services. Should an individual served by BCFR or their family initially choose to communicate with BCFR through such electronic applications and services and later decide to no longer communicate in such means, the individual or their family member shall notify the Coordinator assigned and provide directives on how the individual or their family members would like to receive future communication. Alternatively, you may contact BCFR’s Privacy Officer at (573) 874-1995.

Your Rights Regarding Protected Health Information BCFR Maintains About You

Following is a statement of your rights and how you may exercise these rights.

You have the right to inspect and copy your protected health information

You may inspect and obtain a copy of health information about you that is contained in a designated record set for as long as we maintain the health information. A “designated record set” contains medical and billing records about you that we maintain and any other records that we use for making decisions about you. You may be charged a fee for the costs of copying, mailing or other such costs associated with your request. Under federal law, however, you may not inspect or copy the following records; psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding, and health information that is subject to law that prohibits access to health information. If your request for access is denied, you may request that the decision be reviewed. Requests for access should be directed in writing to the Privacy Officer listed in this notice.

If the protected health information that you are requesting to copy is maintained electronically, you may request an electronic copy of such information and we will provide you with access in the electronic form and format requested if it is readily producible in such form and format. If it is not, we will produce it in a readable electronic form and format as we mutually agree. We will act on your request within 30 days of receipt, unless it becomes necessary to request an additional 30-day extension. We will let you know the reason for the delay and the expected date of completion.

If you request transmittal of an electronic copy of your health information to another person, you must designate in a written document signed by you the person to receive such information and where to send the information.

BCFR may charge a reasonable cost-based fee for the supplies to create a paper copy or portable electronic media, the cost of postage if you want the portable media mailed to you. BCFR will not charge fees for handling and retrieval.

You have the right to request a restriction of your health information

This means you may ask us not to use or disclose any part of your health information for the purposes of treatment, payment or healthcare operations. You may also request that any part of your health information not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice of Privacy Practices. Your request must state the specific restriction requested and to whom you want the restriction to apply. We are not required to agree to a restriction that you may request, except as stated below. If we believe it is in your best interest to permit use and disclosure of your health information, your health information will not be restricted. If we do agree to the requested restriction, we may not use or disclose your health information in violation of that restriction unless it is needed to provide emergency treatment. To request a restriction, you must make your request in writing. You must tell what information you want to restrict; whether you want to limit our use, disclosure or both; and to whom you want the restrictions to apply. We will not agree to restrictions on uses or disclosures that are legally required.

If you request a restriction on the disclosure of protected health information to a health plan, and the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law, and the information pertains solely to a health care item or service for which you or a person on your behalf paid the covered entity out-of-pocket in full, we will restrict the disclosure of protected health information, but it is your responsibility to notify other providers with whom we may disclose your information of this restriction.

You have the right to request to receive confidential communications from BCFR by alternative means or at an alternative location

Communications involving personal health information may be provided to you at an alternative location or by an alternative means of communication. We will accommodate reasonable requests if you clearly state on the request that disclosure could endanger you. To request confidential communications, you must make your request in writing to our Privacy Officer and specify how or where you wish to be contacted.

You may have the right to request an amendment to your health information

If you believe your personal health information is incorrect or that an important part of it is missing, you may request an amendment of health information about you for as long as we maintain this information. You must request the amendment in writing and specify the reason for your request. We may deny your request if the information was not created by us, is not part of the information that you are permitted to inspect and copy, it is accurate and complete. In we deny your request, you have the right to file a statement of disagreement with us, and we may prepare a rebuttal to your statement and will provide you with a copy of such rebuttal. Requests should be directed to our Privacy Officer.

You have the right to receive an accounting of certain disclosures we have made, if any, of your protected medical/health information

This right applies to disclosures for purposes other than treatment, payment or healthcare operations as described in this Notice of Privacy Practices. It excludes disclosures we may have made to you, to family members or friends involved in your care, or for notification purposes. You have the right to receive specific information regarding these disclosures that occurred during the six years prior to the date of the request, or such shorter time period as you may request. The right to receive this information is subject to certain exceptions, restrictions and limitations.

You have the right to opt-out of receiving communications to raise funds for BCFR when your protected health information would be used for the purpose of raising funds

BCFR does not solicit funds from its clients and does not anticipate that it will do so. Should the agency decide to engage in fundraising in the future, you will have the opportunity to let us know that you do not wish to receive communications for the purpose of raising funds for BCFR.

The following are circumstances where BCFR may not use or disclose your health information:

1. To conduct (or to identify any person for the purpose of conducting) a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.  For example, BCFR is prohibited from using or disclosing your health information pursuant to a request from a law enforcement agency for the purposes of prosecuting a protected reproductive health activity.
2. To impose (or identify any person for the purpose of imposing) criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.  For example, BCFR is prohibited from using or disclosing your health information pursuant to a court order if the purpose is to impose criminal, civil, or administrative liability.

The prohibition on use and disclosure of health information described above applies only where the relevant activity is in connection with any person seeking, obtaining, providing, or facilitating reproductive health care as defined by federal law, and the covered entity or business associate that received the request for health information has reasonably determined that the reproductive health care was lawful under the law of the state in which such health care was provided under the circumstances in which it was provided, the reproductive health care was presumed lawful, or the reproductive health care was protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care was provided, regardless of the state in which it was provided.

BCFR requires a valid attestation pursuant to §164.509(b) to be executed prior to use or disclosure of health information to persons other than covered entities or business associates when requested in relation to or for the following purposes:

1. Health oversight agencies for oversight activities authorized by law;
2. Judicial and Administrative proceedings (for example, associated with a criminal charge);
3. Law enforcement purposes (for example, pursuant to an investigation);
4. Disclosures about decedents (for example, disclosing health information to a coroner).

BCFR will not use or disclose substance use disorder treatment records received from programs subject to 42 CFR part 2, or testimony relaying the content of such records in civil, criminal, administrative, or legislative proceedings against you unless based on written consent, or a court order after notice and an opportunity to be heard as required by law. 

Any health information used or disclosed by BCFR as permitted by law or pursuant to a valid authorization to do so may be subject to re-release and/or re-disclosure by the recipient and no longer protected by federal or state confidentiality or privacy laws.

You have the right to be notified if there is a breach of unsecured protected health information about you

We are required by law to maintain the privacy of your protected health information. If we use or disclose your unsecured protected health information in a way that is considered to be a breach, as defined by law, you will receive a notification of the breach of your unsecured protected health information from us.

You have the right to obtain a paper copy of this notice from us

Upon request, even if you have agreed to accept this notice electronically.

If you wish to exercise any of these rights, please contact Jessica Porter, at 573-874-1995 BCFR, 2700 W Ash Street, Columbia, MO 65203.

If you wish to exercise any of these rights or have any questions related to the prohibited uses and disclosures of your health information referenced above, please contact BCFR’s Privacy Officer or Coordinator of Training & Quality Assurance, at 573-874-1995, BCFR, 2700 West Ash, Columbia, MO 65203 or submitting an email to compliance@bcfr.org.

You Have the Right to File a Complaint

If you believe that your privacy rights have been violated, there are several avenues for submitting a complaint. BCFR will not retaliate or penalize you for filing a complaint.

If you have questions or would like additional information, or if you believe your privacy rights have been violated, you may contact BCFR’s Coordinator of Training and Quality Assurance or Privacy Officer at 573-874-1995, BCFR, 2700 W Ash Street, Columbia, MO 65203 or compliance@bcfr.org for assistance or for further information about the complaint process.

If you are receiving services available through the Department of Mental Health, you may contact and file a complaint with the Department’s Office of Constituent Services. You may do so online at at Constituent Rights | dmh.mo.gov or email constituentsvcs@dmh.mo.gov or contact their toll-free number at 800-364-9687. You may write to the Department of Mental Health at Department of Mental Health, Attn: Constituent Services 1706 E. Elm Street, Jefferson City, MO 65101.

All persons also have the right to file a complaint with the Office for Civil Rights, U.S. Department of Health and Human Services. Privacy Complaints must be filed in writing by mail, fax, e-mail or via the OCR Complaint Portal at U.S. Department of Health & Human Services – Office for Civil Rights. Complaints should be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180-day period if you can show “good cause”.

To file a complaint via email, open and fill out the Health Information Privacy Complaint Form package-PDF located at Civil Rights and Conscience and Religious Freedom Discrimination Complaint Form Package and email the completed complaint and consent forms to OCRComplaint@hhs.gov.

To file a complaint with OCR via mail, open and fill out the Health Information Privacy Complaint Form package-PDF located at Civil Rights and Conscience and Religious Freedom Discrimination Complaint Form Package and print out the completed form and send to:  Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Room 509F HHH Bldg., Washington, D.C. 20201.

A complaint may also be filed without utilization of the Health Information Privacy Complaint Package by following the directions provided at HIPAA Complaint Process | HHS.gov.

A Security Rule complaint may be filed by contacting the Midwest Region of the Office of Civil Rights, U.S. Department of Health and Human Services electronically via the OCR Complaint Portal at U.S. Department of Health & Human Services – Office for Civil Rights or using the Health Information Privacy Complaint Package-PDF at Civil Rights and Conscience and Religious Freedom Discrimination Complaint Form Package and emailing, mailing or faxing it to the Midwest Region office located at Office of Civil Rights, U.S. Department of Health and Human Services, 233 N. Michigan Ave., Suite 240, Chicago, IL 60601.  The fax number for the OCR Midwest Region office is (202) 619-3818.

If you need help filing a complaint or have a question about the complaint form, please call the Office for Civil Rights Midwest Region number at 1-800-368-1019 or TDD 1-800-537-7697.

If special accommodations are necessary for you to communicate a question or complaint, please let us know by contacting BCFR’s Coordinator of Training and Quality Assurance or BCFR’s Privacy Officer at (573) 874-1995, BCFR, 2700 West Ash, Columbia, MO 65203 or compliance@bcfr.org.