Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information.

This Notice of Privacy describes how we may use and disclose your Protected Health Information (PHI) to carry out treatment, payment, or healthcare operations for other purposes that are permitted or required by law. It also describes your rights to access and control your PHI. PHI is about you, including your demographic information, that may identify you and relates to your past, present, or future physical or mental health or condition and related health care services.

We are required by law to abide by the terms of this Notice of Privacy Practices and provide you with information regarding CSAS, Inc.’s privacy policies and practices. We may change the terms of our notice at any time. The new notice will be effective for all PHI that we maintain at that time. We will post the new notice at our offices and on our website. You can also request that a revised copy be mailed to you or obtain one at your next appointment.

1. Your Rights

• You have the right to inspect and copy your PHI
• You have the right to request a restriction of your PHI
• You have the right to request to receive confidential communications from CSAS, Inc. by alternative means and at an alternative location.
• You have the right to request your clinician amend your PHI
• You have the right to receive an accounting of certain disclosures CSAS, Inc. has made, if any, of your PHI.
• You have the right to obtain a paper copy of this notice from us.

1. Complaints

   You may file a complaint with CSAS, Inc. by notifying our Recipient Rights person of your concern regarding the handling of your PHI. We will not retaliate against you for filing a complaint. You may contact our Recipient Rights person for further information about this process. You may file a complaint with the Secretary of Health and Human Services if you believe we have violated your privacy rights.

2. Uses and Disclosures based on your written consent

• Physicians and providers of health, mental health, or social and welfare services involved in your care, treatment, or rehabilitation.

• Individuals to whom you have given consent in writing to have the information disclosed.
• Persons legally representing you.
• Persons authorized by a court order.
• Persons doing research or maintaining health statistics, in keeping with CSAS, Inc.’s policies and procedures on research and confidentiality.
• Governmental or law enforcement personnel if necessary to return you to services in response to a court order for treatment or evaluation.
• Family members who are actively involved in your treatment and to whom you have given written permission to be provided with your PHI.
• A person appointed by the Court to act on your behalf under state and/or federal law.
• A governmental agency or competent professional in order to comply with state and/or federal law regarding court appointed guardians.
• A Human Rights Committee established under state and/or federal law.

The following are some examples of the types of uses and disclosures of your PHI that CSAS, Inc. is permitted to make after you have signed the consent form. These examples are not meant to include all possible uses of your PHI, but to describe potential uses and disclosures that may be made by our office once you have given your consent.

Treatment: We will use and disclose your PHI to coordinate health care and related services.

Payment: Your PHI will be used, as needed, to obtain payment for health care services.

Healthcare Operations: We may use or disclose your PHI to support CSAS, Inc. business activities, like quality assessment, employee review, risk management, staff training, licensing and accreditation. For example we regularly review the content of the clinical chart to ensure that documentation meets the regulatory requirements that we operate under. Or we may call you by name in the waiting room when your counselor is ready to see you. We may also use your demographic information in aggregation with other consumer demographic information to produce reports about CSAS, Inc. operations to regulatory or funding bodies.

Other uses and disclosures of PHI based on your written authorization

Other uses and disclosures of your PHI will be made only with your written release, unless otherwise permitted or required by law as described below. You may revoke this release or authorization at any time in writing or verbally, with the exception of information already released. You have the opportunity to consent or object to the release of your PHI.

We may disclose your PHI in the following instances. You have an opportunity to agree or object to the use or disclosure of all or part of your PHI.

Page 3

CSAS, Inc. program lists: Unless you object we will use and disclose in our program list the program and location you are receiving treatment in. This list is available only to CSAS, Inc. employees.

Emergencies: We may use or disclose your PHI in an emergency treatment situation. If this happens, your clinician will try to obtain your consent as soon as possible. We will also follow state and federal guidelines regarding confidentiality of those persons receiving substance abuse treatment.

We may use or disclose your PHI in the following situations without your consent or authorization:

• Required by law (but maintaining federal substance abuse confidentiality protections)
• Public health for purpose of disease control, injury, or disability
• Regulatory bodies for the purpose of notifying persons who may be at risk of contracting or spreading disease.
• Abuse or neglect to make reports of child or vulnerable person’s abuse/neglect or if you have been the victim of abuse or neglect.
• Health oversight to government officials that oversee healthcare systems, benefit programs or civil rights laws.
• In response to a court order.
• Law enforcement-as required to comply with legal processes, limited information for identification and location purposes, or in the event a crime occurs on or in CSAS, Inc. property.
• Coroners, funeral directors, and organ donation for identification purposes or determination of cause of death.
• Research to comply with CSAS, Inc. approved and reviewed research.
• Criminal activity to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Required uses and disclosures

Uses and disclosure of your PHI with your permission

Uses and disclosures not described in this Notice of Privacy Practices will generally be made only with your written permission called a "release" or "authorization." You have the right to revoke a release at any time. If you revoke your authorization we will not make any further disclosures of your PHI under that authorization, unless we have already taken an action relying upon the uses or disclosures you have previously authorized.

Confidentiality of Substance Abuse Records

For individuals who have received treatment, diagnosis or referral for treatment from our drug or alcohol abuse programs, federal law and regulations (42 CFR Part 2) protect the confidentiality of drug or alcohol abuse records. In general we may not tell a person outside the programs that you attend any of the programs, or disclose any information identifying you as an alcohol/drug user/abuser, unless:

Page 4

• The disclosure is permitted by court order
• The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation standards.
• You threaten to commit a crime either at the program site or against any person who is employed by CSAS, Inc.

Federal law and regulations governing confidentiality permit us to report suspected child abuse or neglect (also for vulnerable adults) under state law to appropriate state authorities. Please see 42 CFR, Part 2 for federal regulations governing confidentiality of alcohol and drug abuse clinical records. A copy is available for your review.

Who will follow this notice? This notice of Privacy Practices will be followed by all CSAS, Inc. personnel and is applied to all sites operated by CSAS, Inc. In addition, these sites or employees may share health information with each other for treatment, payment, or health care operation purposes.