instED, Inc. (www.insted.us)
Effective Date: May 18, 2021
HIPAA Notice of Patient Privacy Practices
The HIPAA Privacy Rule gives individuals a fundamental right to be informed of the privacy practices of their health plans and of most of their health care providers, as well as to be informed of their privacy rights with respect to their personal health information. Health plans and covered health care providers are required to develop and distribute a notice that provides a clear explanation of these rights and practices. The notice is intended to focus individuals on privacy issues and concerns, and to prompt them to have discussions with their health plans and health care providers and exercise their rights.
This notice describes how your medical information may be used and disclosed and how you can get access to this information.
instED is required by law to protect your medical information.
We are committed to protecting your medical information. This medical information may be about healthcare provided to you and/or about payment for healthcare provided to you.
We are required by law to provide you with this Notice of Privacy Practices explaining our legal duties and privacy practices with respect to medical information. We are only allowed to use and disclose medical information in the manner that is described in this Notice.
We reserve the right to make changes and to make the new Notice effective for all medical information we maintain. If we make a material change to the Notice, copies of the updated Notice are made available upon request and on our website, by the effective date of the material change. We send you the updated Notice, or information about the material change and how to obtain the revised Notice, in the next annual mailing.
The rest of this Notice will:
- Describe how we may use and disclose your medical information, including behavioral health information;
- Explain your rights with respect to your medical information, including behavioral health information; and
- Describe how and where you may file a privacy-related complaint.
If you have questions about the information in this Notice, please contact the compliance hotline: 1-866-457-4953.
SECTION 1: Uses and Disclosures of Your Medical Information Without Your Prior Authorization
This section of our Notice explains how we may use and disclose your medical information, including behavioral health information, without your authorization in order to provide healthcare, obtain payment for that healthcare, and operate our business efficiently. This section also mentions several other circumstances in which we may use or disclose your medical information. For more information about any of these uses or disclosures, or about any of our privacy policies, procedures, or practices, contact the compliance hotline 1-800-826-6762.
The instED model of care requires working together with physicians and other care providers (including nurses, paramedics, behavioral and mental health professionals, long-term support coordinators, pharmacies, and others) to provide medical services. instED professional staff, physicians, and other care providers have access to your Electronic Health Record (where your medical information is stored and maintained) and share protected health information (PHI), including behavioral health information, with each other as needed to perform treatment, payment, and healthcare operation activities as permitted by law.
For Treatment: We may use and disclose medical information, including behavioral health information, to provide, coordinate, or manage your healthcare and related services. This may include communicating with other healthcare providers regarding your treatment and coordinating and managing your care with others.
Example: You are being discharged from a hospital. The instED team may seek your medical information, including behavioral health information, to make sure you get the services you need after discharge from the hospital.
For Payment: We may use and disclose your medical information, including behavioral health, to obtain payment for healthcare services that you received.
For Healthcare Operations: We may use and disclose your medical information, including behavioral health information, to perform a variety of business activities that allow us to administer the benefits you are entitled to under your health plan with us. For instance, we may use or disclose your medical information, including behavioral health information, in performing the following activities:
- Reviewing and evaluating the skills, qualifications, and performance of healthcare providers treating you
- Reviewing and improving the quality, efficiency, and cost of care that instED provides to you and our other patients
- Cooperating with other organizations that assess the quality of the care of others, including government agencies and private organizations
- Mailing information containing your medical information to the address you have provided
Example: We may use health information about you to manage your treatment, develop better services for you, or monitor the quality of care and make improvements where needed.
Required by Law:
- We will use and disclose your medical information, including behavioral health and substance use disorder treatment records, whenever we are required by law to do so. For example, Massachusetts law requires us to report suspected elder abuse. We will comply with any state and other applicable laws regarding these disclosures.
- We are required by law to notify you if your protected health information is affected by a privacy or security breach.
- Prohibited by law: instED does not engage in underwriting; but, if we did, we would be prohibited by law from using your genetic information for underwriting purposes.
Federal Government Uses and Disclosures: When permitted by law, we may use or disclose your medical information, including behavioral health and substance use disorder treatment records, without your authorization for various activities by the federal government.
- Threat to health or safety: We may use or disclose your medical information if we believe it is necessary to prevent or lessen a serious threat to health or safety. For example, we may use or disclose your medical information to help with a product recall or to report adverse reactions to medications.
- Public health activities: We may use or disclose your medical information, including de-identified substance use disorder treatment information, for public health activities. Public health activities require the use of medical information as well as de-identified substance use disorder treatment information for various reasons, including, but not limited to, activities related to investigating diseases, reporting child abuse and neglect, monitoring drugs or devices regulated by the Food and Drug Administration, and monitoring work-related illnesses or injuries. For example, if you have been exposed to a communicable disease, we may report it to the state and take other actions to prevent the spread of the disease.
- Abuse, neglect, or domestic violence: We may disclose your medical information to a government authority if you are an adult and we believe that you may be a victim of abuse, neglect, or domestic violence.
- Health oversight activities: We may disclose your medical information to a health oversight agency, which is an agency responsible for overseeing the healthcare system or certain government programs.
- Court proceedings: We may disclose your medical, behavioral health, or substance use disorder treatment information in response to a court order. Medical information may also be disclosed in response to a subpoena.
- Law enforcement: We may disclose your medical information to a law enforcement official for specific law enforcement purposes. For example, we may disclose limited medical information about you to a police officer if the officer needs the information to help find or identify a missing person.
- Coroners and others: We may disclose your medical information to a coroner, medical examiner, or funeral director or to organizations that help with organ, eye, and tissue transplants.
- Workers’ compensation: We may disclose your medical information in order to comply with workers’ compensation laws.
- Research organizations: We may use or disclose your medical information, including substance use disorder treatment records, to research organizations if the organization has satisfied certain conditions about protecting the privacy of your medical information.
- Certain government functions: We may use or disclose your medical information for certain government functions, including but not limited to military and veterans’ activities and national security and intelligence activities.
Persons Involved in Your Care: We may disclose your medical information to a relative, close personal friend, or any other person you identify if that person is involved in your care and the information is relevant to your care.
We may also use or disclose your medical information to a relative, another person involved in your care, or possibly a disaster relief organization (such as the Red Cross) in an emergency if we need to notify someone about your location or condition.
You may ask us at any time not to disclose your medical information to persons involved in your care. We will agree to your request and will not disclose the information except in certain limited circumstances such as emergencies.
Example: If you ask us to share your medical information with your spouse, we will disclose your medical information to him or her.
Massachusetts Immunization Information Systems: Vaccinations received during your visit are reported to the Massachusetts Immunization Information System (MIIS) as required by law. The MIIS is a statewide system to keep track of vaccination records and is managed by the Massachusetts Department of Public Health (MDPH). If you do not want your MIIS records shared with other healthcare providers, you must submit an Objection to Data Sharing Form to:
Massachusetts Immunization Information System (MIIS)
Massachusetts Department of Public Health
305 South Street
Jamaica Plain, MA 02130
SECTION 2: Other Uses and Disclosures Requiring Your Prior Authorization
Other than the uses and disclosures described above, we will not use or disclose your medical or behavioral health information without your or your personal representative’s authorization (or signed permission). Substance Use Disorder (SUD) treatment records may be used and disclosed for treatment, payment, or healthcare operations with written authorization from you or your personal representative. Authorization to use and disclose SUD treatment records is only required once and that will then authorize all such future uses or disclosures for purposes of treatment, payment, and healthcare operations until such time as the patient revokes such consent in writing. In some instances, we may wish to use or disclose your medical, behavioral health, or substance use disorder treatment information and we may contact you to ask you to sign an authorization form. In other instances, you may contact us to disclose medical behavioral health or substance use disorder treatment records and we will ask you to sign an authorization form.
If you sign a written authorization asking us to disclose your medical, behavioral health, or substance use disorder treatment information to a third party, you may later revoke (or cancel) your authorization. If you would like to revoke your authorization, you must do so in writing. If you revoke your authorization, we will follow your instructions except to the extent that we have already relied upon your authorization to disclose your medical information, or as required by law.
- Use or disclosure for marketing purposes: We may only use or disclose your medical information for marketing purposes if we have your explicit approval and authorization.
- Sale of your protected health information: instED does not sell your health information. If we did, we may only engage in the sale of your information to a third party if we have your authorization.
- Marketing communications paid for by a third party: We will only send you communications on behalf of a third party for the purpose of marketing of products or services if we have your authorization.
- Use and disclosure of psychotherapy notes: We may only use or disclose your psychotherapy notes if we have your prior authorization or as required by law.
SECTION 3: You Have Rights with Respect to Your Medical Information
You have certain rights with respect to your medical information.
Right to Choose Someone to Act for You: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your medical information. We verify that this person has this authority and can act for you before we take any action.
Right to a Copy of This Notice: You have a right to have a paper copy of our Notice of Privacy Practices at any time, even if you agreed to receive the Notice electronically. If you would like to have a copy of our Notice, contact 1-800-826-6762.
Right to Access to Inspect and Copy: You have the right to inspect (see or review) and receive a copy or summary of your medical information that instED maintains. If we maintain your medical records in an Electronic Health Record system, you may obtain an electronic copy of your medical records. You may also instruct us in writing to send an electronic copy of your medical records to a third party. If you would like to inspect or receive a paper or electronic copy of your medical information, you must provide us with a request in writing.
We may deny your request in certain circumstances. If we deny your request, we will explain the reason for doing so in writing. We will inform you in writing if you have the right to have the decision reviewed by another person.
If you would like a copy of your medical information, we may charge you a fee to cover the costs of the copy. The fees for electronic copies will be limited to the direct labor costs associated with fulfilling your request.
Right to Have Medical Information Amended: If you believe that we have information that is either inaccurate or incomplete, you have the right to request an amendment, correction, or supplementation of your medical information that instED maintains. Your request must be in writing and include an explanation.
We may deny your request to amend, correct, or supplement your medical information in certain circumstances. If we deny your request, we will explain our reason for doing so, in writing, within sixty (60) days. You may send us a statement of disagreement. With any future disclosures, we will provide an accurate summary of the request and our denial.
Right to an Accounting of Disclosures We Have Made: You have the right to receive an accounting (which means a detailed listing) of disclosure other than for treatment, payment, and healthcare operations we have made for the previous six (6) years. If the information is contained in an electronic health record, the accounting is for the previous three (3) years. We’ll provide one (1) accounting per year for free but may charge a reasonable, cost-based fee if you ask for another one within twelve (12) months. For substance use disorder treatment record disclosures in which patients have consented to disclose their patient identifying medical information using a general designation, upon request, patients must be provided a list of entities to which their information has been disclosed pursuant to the general designation. Accounting of disclosures for substance use disorder treatment record disclosures is limited to disclosures made within the last two (2) years. All requests for accounting of disclosures must be made in writing.
Right to Request Restrictions on Uses and Disclosures: You have the right to request that we limit the use and disclosure of your medical, behavioral health, and substance use disorder treatment information for treatment, payment, and healthcare operations, but instED may not agree to the restriction. Under federal law, instED must agree to your request to restrict disclosures of medical information if:
- The disclosures are for purposes of payment or healthcare operations and are not otherwise required by law, and
- The medical information pertains solely to healthcare items or services for which you, or another person on your behalf (other than instED), have paid in full.
If we agree to your request, we must follow your restrictions, except if the information is necessary for emergency treatment. You may cancel the restrictions at any time by writing to us. In addition, we may cancel a restriction at any time as long as we notify you of the cancellation and continue to apply the restriction to information collected before the cancellation.
Right to Opt Out of Fundraising Communications: You have the right to request that we or our authorized agents do not contact you for fundraising activities.
Right to Request an Alternative Method of Contact: You have the right to request to be contacted at a different location or by a different method. For example, you may prefer to have all written information mailed to your work address rather than to your home address.
We will agree to any reasonable request for alternative methods of contact. If you would like to request an alternative method of contact, you must provide us with a request in writing.
SECTION 4: You May File a Complaint About Our Privacy Practice
If you believe your privacy rights have been violated, you may file a written complaint either with instED or with the federal government.
instED will not take any action against you or change the treatment of you in any way if you file a complaint.
To file a written complaint with or request more information from instED, contact:
30 Winter Street
Boston, MA 02108
To file a written complaint with the federal government, please use the following contact information:
U.S. Department of Health and Human Services Office for Civil Rights
200 Independence Avenue, S.W.
Room 509F, HHH Building
Washington, D.C. 20201