Notice of Privacy Practices

We have updated our privacy practices to reflect new protections. This includes expanded patient rights, enhanced security measures, new information on reproductive health records, and language that aligns 42 CFR part 2 more closely with HIPAA and the HITECH Act.

PLEASE REVIEW CAREFULLY.

This Notice is available in other languages and alternate formats that meet the guidelines for the Americans with Disabilities Act (ADA).

For questions or additional information contact the County Privacy Officer:

HHS Compliance Hotline: (888) 413-9462
Hearing Impaired/TTY: (415) 473-3344
Para obtener más información, por favor llame (888) 413-9462
Để biết thêm thông tin xin vui lòng gọi (888) 413-9462

The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) is a law requiring the County of Marin to make sure your personal medical and other treatment information is kept private. The County of Marin is also required to give you this notice, so that if the County has any of your personal health information, you will know how the County may use it, or whether and how the County may give your protected health information (“PHI”) to others.

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, addresses the privacy and security concerns associated with the electronic transmission of health information, through several provisions that strengthen the civil and criminal enforcement of the HIPAA rules.

County of Marin programs and services are already keeping your personal medical information private. HIPAA establishes the minimum standards for these protections.

The NPP explains how we may legally use and disclose your PHI, who can access it, where to file a complaint if you think your PHI was mishandled, when a signed authorization is needed for certain disclosures, and other privacy rights you have. We are required to follow all the terms of this notice. We reserve the right to change the provisions of this notice and make it effective for all PHI we maintain.

This notice applies to all HHS programs and services. For a full list of programs and services currently run by HHS, visit the Marin County HHS website.

How We May Use and Disclose Your PHI:

The County of Marin-HHS prioritizes the confidentiality of our clients' PHI. Our physicians, clinicians, and employees are mandated to uphold this confidentiality. We have established policies, procedures, and safeguards to protect your PHI from unauthorized use and disclosure. Below is a brief description of the uses and disclosures of your PHI, along with some examples. Please note that not every use or disclosure in a category is listed. The ways we use and disclose HIV/AIDS, reproduction, and substance and alcohol abuse information will be separately described later in this notice.

Treatment. We may use and disclose your PHI to provide treatment, case management, and care coordination or to direct or recommend health care and any related services such as government services or housing. We may also share your health information with community resources and providers in the county who may be involved in your case or treating you.
Payment. We may use or disclose your PHI to determine HHS’s responsibility to pay for or to permit us to bill and collect payment for the treatment and health-related services. For example, we may include information with a bill to Medi-Cal or Medicare that identifies you, your diagnosis, and services provided to receive payment.
Health Care Operations. We may use and disclose your PHI to support the business activities of HHS. For example, we may use your PHI to review and evaluate our treatment, or to improve the care and services we offer. In addition, we may disclose your health information to other staff or business associates who perform billing, consulting, behavioral health and health services, auditing, licensing, accreditation, investigatory, and other services for HHS.
Required by Law. We may use and disclose your PHI when required by federal, state, or local law. For example, the Secretary of the U.S. Department of Health and Human Services (DHHS) may review our compliance efforts, which may include accessing your PHI.
Business Associates. We sometimes use outside companies, known as “business associates (BAs)” to provide certain services. These services may include payment processing, healthcare operations, and treatment services. BAs are required to protect your PHI. We only share the minimum amount of PHI necessary for them to carry out their services. We also require these business associates to properly safeguard your information. Examples of BAs include subcontractors that handle PHI on behalf of HHS, billing companies, E-Prescribing Gateways, Health Information Exchanges, behavioral health service providers, and Electronic and Personal Health Record Vendors.
Health Oversight Activities. We may disclose your PHI to federal or state agencies that may conduct audits, investigations, oversight activities, and inspect government health benefit programs.
Public Health Activities. We may use and share your PHI with public health authorities or government agencies to report specific diseases, injuries, conditions, illnesses, and events as mandated by law. For instance, we might share your medical information with a local government agency to aid in a disease outbreak in the area, or to adhere to state laws governing workplace safety.
Victims of Abuse, Neglect, or Domestic Violence. We may share your PHI information with government agencies to report suspected abuse, neglect, or domestic violence. We will only disclose this information if the law requires us to do so, or when it is necessary to protect someone from serious harm.
Lawsuits and legal actions. We may use and disclose your PHI in response to a court or administrative order, certain subpoenas, or other legal processes. We may also use and disclose PHI to the extent permitted by law without your authorization, such as in defending against a lawsuit or arbitration.
Law Enforcement. We may disclose your PHI to help locate or identify a missing person, suspect, or fugitive. This may also occur when there is suspicion that death has occurred because of criminal conduct, to report a crime that happens at our clinics or offices, or to report certain types of wounds, injuries, or deaths that may be the result of a crime. This information may be disclosed to authorized officials such as the police, sheriff, or FBI for law enforcement purposes and in response to legal processes, such as a search warrant or court order.
Coroners, Medical Examiners, and Funeral Directors. We may share your PHI with funeral directors, coroners, and medical examiners to help identify a body, determine the cause of death, or for official duties.
Organ, Eye, and Tissue Donation. We may disclose your PHI to organizations responsible for organ, eye, or tissue donations and transplants.
Research. We may use and share your PHI for research purposes if it is approved by an Institutional Review Board (IRB). An IRB is a committee that is responsible for reviewing and approving research involving human participants to protect their safety and the confidentiality of their PHI by federal law.
To Stop a Serious Threat to Health or Safety. We may use or disclose your PHI if we believe it is necessary to prevent a serious threat to your health or safety or to someone else’s health or safety.
Inmates. As an inmate of a correctional institution or in custody of a law enforcement official, you may not receive a notice of privacy practices. We may disclose your PHI to the correctional institution or the law enforcement official for specific purposes, such as protecting your health and safety or that of someone else.
Military Activity and National Security. We might disclose the PHI of armed forces personnel to the relevant military authorities to carry out military missions. Additionally, we may disclose your PHI to authorized federal officials when it is necessary for national security and intelligence activities or the protection of the president, other government officials, and dignitaries.
Government Programs for Public Benefits. We may use or disclose your PHI to assist you in qualifying for government benefit programs such as Medicare, Medi-Cal, Supplemental Security Income, or other available benefits or services. We may also reach out to inform you about potential treatment options, health-related benefits, and services.
Workers’ Compensation. We may use and share your PHI to comply with workers’ compensation laws or similar programs that provide benefits for work-related injuries or illnesses. For instance, we may disclose your medical information about a work-related injury or illness to claims administrators, insurance carriers, and other parties assessing your claim for workers’ compensation benefits.
Family and Friends Involved in or Paying for Your Care. We may share your PHI with a friend, family member, or anyone else involved in your care or responsible for payment.
Disclosures in Case of Disaster Relief. We may share your name, city of residence, age, gender, and overall condition with a public or private disaster relief organization for necessary medical assistance or to aid in reuniting you with family members.
Disclosures to Parents as Personal Representatives of Minors. In most cases, we may disclose your minor child’s PHI to you. In some situations, however, we are permitted and sometimes required by law to deny you access to your minor child’s PHI. An example of when we must deny such access, based on the type of healthcare, is when a minor who is 12 years old or older seeks care for a communicable disease or condition. Another situation when we must deny access to parents is when minors have adult rights to make their own healthcare decisions. These minors include, for example, married minors or who have a declaration of emancipation from a court.
Appointment Reminders. We may use the PHI to remind you of your upcoming appointments for treatment or other necessary health care.
Immunization Records. With written or verbal authorization from a parent, guardian, or other person acting in place of a parent, or from an emancipated minor, we may disclose proof of your child’s immunization to a school and provide information about a child who is or will be a student at the school as required by state or other laws.
Identity Verification. We may take a photograph of you for identification purposes and store it in your medical record.
Reproductive Health Records. HIPAA Privacy Rule supports reproductive health care privacy. We are committed to protecting your reproductive health information. County of Marin is prohibited from using or disclosing your PHI related to lawful reproductive health care for purposes of criminal, civil, or administrative investigations or proceedings. This includes information about contraception, fertility treatments, and pregnancy related care.
Health Information Exchange (HIE). The County of Marin participates in Health Information Exchanges (HIEs), including an HIE operated by the California Mental Health Services Authority (CalMHSA). The HIE is an electronic system that allows healthcare providers to share patient information while complying with federal and state privacy laws. The exchange of your health information can be done electronically through the HIE and can provide faster access, better coordination of care, and assist healthcare providers and public officials in making informed decisions. Your health information may be shared through HIEs with hospitals, behavioral health providers, county health programs, physicians, social workers, and other HIE participants who may provide health or behavioral health services to you. Certain types of your health information, such as substance use disorder records, will not be shared unless you authorize these disclosures. Other types of health information may be shared without your authorization. a. Note: Behavioral Health and Recovery Services (BHRS) Clients Only: If you do not want us to share your health information with HIE participants via the CalMHSA HIE, you may opt out by contacting BHRS Medical Records at: OUEFZrqvpnyErpbeqf@ZnevaPbhagl.Tbi Opting out will prevent future sharing of your health information via the CalMHSA HIE, but HIE participants may still be able to access information about you from other sources. Unless you notify us otherwise, we will share your health information electronically with your participating healthcare providers as needed for treatment. Patient health information that requires a signed authorization by law will not be transmitted to the HIE without your consent. Some types of health information, such as certain substance use disorder records, will not be shared unless you authorize these disclosures; other types may be shared without your authorization. You may opt out of the HIE at any time, in person where you receive Marin County health services, or by obtaining the appropriate form through the Marin County HHS website.
Electronic Health Records (EHR). We may use an electronic health record to store and retrieve your health information. One of the advantages of the EHR is the ability to share and exchange health information among personnel and other community healthcare providers involved in your care. When we enter your information into the EHR, we may share that information by using shared clinical databases or health information exchanges. We may also receive information about you from other healthcare providers involved with your care by using shared databases or health information exchanges. If you have any questions or concerns about the sharing or exchange of your PHI discuss with your provider.
Communications with Family, Friends, and Others. In situations where you are unable to give consent due to an emergency or lack of capacity, we may need to disclose your PHI to family members or those involved in your care. We will use our professional judgment to determine if it is in your best interest to do so, and we will only disclose the information that is directly relevant to the person’s involvement in your healthcare. For instance, we may share information about potential exposure to an infectious disease if it requires immediate attention.

Uses and Disclosures of Your PHI Requiring Your Written Authorization:

We are required to obtain your written authorization to use or disclose your PHI, with limited exceptions, for the following reasons:

Sale of PHI. We do not sell patient PHI.
Marketing. We will request your written approval to use or disclose your PHI for marketing purposes.
Psychotherapy Notes. We will request your written approval to use or disclose your psychotherapy notes with limited exception. For example, for certain treatment, payment, or healthcare operation functions.
1. All other uses and disclosures of your PHI not described in this Notice will be made only with your written approval. You may take back your approval at any time. The request to take back approval must be in writing. Your request to take back approval will go into effect as soon as you request it. There are two cases it won’t take effect as soon as you request it. The first case is when we have already taken actions based on past approval. The second case is before we receive your written request to stop.

Uses and Disclosures of HIV/AIDS Information:

In California, there are strict laws regarding the protection of HIV/AIDS information. Generally, we need your written authorization to disclose the results of an HIV/AIDS test each time we need to share the information. However, in certain cases, we may be required to disclose your HIV/AIDS test results without your authorization for public health investigation, control, or surveillance purposes. Your healthcare provider may also have access to this information for the purpose of diagnosis, care, or treatment without needing specific authorization from you. If your physician orders an HIV test, they may share the results with your other healthcare providers related to your diagnosis, care, or treatment.

Uses and Disclosures of Your Substance and Alcohol Use Disorder Records:

Your records related to substance use disorder (SUD) are protected by federal law under 42 CFR Part 2. This law provides extra confidentiality protections and requires a separate patient consent for the use and disclosure of SUD counseling notes. Each disclosure made with patient consent must include a copy of the consent or a clear explanation of the scope of the consent. 42 CFR Part 2 allows patients to sign a single consent form for all future uses and disclosures for SUD treatment, payment, and other health care operations. Disclosure of these records requires your explicit written consent, except in limited circumstances. You may revoke this consent at any time.

Medical Emergencies: Only to the extent needed to treat your emergency.
Reporting Crimes on Program Premises.
Child Abuse Reporting: In connection with incidents of suspected child abuse or neglect to appropriate state or local authorities.

Prohibitions on Use and Disclosure of Part 2 Records

The new rule expands prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, or legislative proceedings conducted against a patient unless the patient provides consent, or a court order is issued.
A separate consent is required and must specifically address the use and disclosure of SUD counseling notes. Consent cannot be combined.

Your Rights Regarding Your PHI:

Right to Access Health Information. You have the right to access and obtain a copy of your health information held by the covered entity, including electronic records with a few exceptions. This includes any information related to your care, decisions about your care, or payment for your care. You can access your records in any format maintained by the County of Marin and request them to be sent to a third party.
Right to Request Corrections. You have the right to request corrections to inaccurate or incomplete information. Your request must be in writing, and it should explain the corrections or additions you are requesting, along with the reasons they should be made. We will respond to your request within 60 days and may extend this period once by 30 days if we provide a written explanation for any delay. If your request is approved, we will make the necessary corrections or additions to your PHI.
1. We may deny your request if it is not in writing or does not include a reason to support the request. We may also deny your request if:
  1. The information in your record is correct and accurate.
  2. The information in your record was not created by HHS, or the person who created it is no longer available to make the amendment, or
  3. The information is not part of the records you are permitted to view and copy.
  4. If we deny your request for a change, we will inform you why and explain your right to submit a written statement of disagreement. Your statement should not exceed five pages. Please notify us in writing if you want us to include your statement of disagreement, your original request for a change, and our written denial in future disclosures of that part of your medical records.
Right to Request Restrictions on Uses and Disclosures of your PHI. You have the right to request restrictions on how your PHI is used or disclosed for treatment, payment, or healthcare operations. We will comply with these requests unless prohibited by law. For example, you can request restrictions on the information you share with someone involved in your care or with your spouse. We may not be obligated to agree to your request, except if you have the right to limit the sharing of information with a health plan or insurer for payment or healthcare operations or with a BA if you pay out of pocket in full for the healthcare item or service at the time of the request for restriction.
Right to Request Confidential Communications. You have the right to request how we communicate with you about your PHI and where we send communications. For example, you can ask us to only call you at your work number or send mail to a specific address. Your request must be in writing and clearly state your preferred method or location for communication. We will accommodate all reasonable requests. If your PHI is stored electronically, you can request a copy of the records in an electronic format provided by HHS. You can also submit a written request for the electronic copy to be sent to a designated third party. If fulfilling your request costs more than a reasonable amount, we may charge you for the excess costs.
Right to Revoke an Authorization. You have the right to revoke your written authorization to use and disclose your PHI at any time. You must inform us of the revocation in writing. If you revoke your written authorization, we will stop sharing your PHI. However, any information already used or shared while the authorization was valid cannot be taken back. HHS is required by law to keep a record of the medical treatment you receive, regardless of whether you give us written permission to use or share it. You do not have the right to have information removed from your record.
Right to a Paper Copy of this Notice. Unless you are incarcerated, you have the right to request a paper copy of this notice at any time.
Right to Receive Notifications. You have the right to notifications about how your health information is used and shared.
Right To Make Decisions on Information Sharing. You have the right to make decisions about specific uses and disclosures of your PHI. You can request restrictions on how your information is used or disclosed, and covered entities must comply with these requests unless prohibited by law.
Breach Notification. In the event of a breach of your unsecured PHI, you have the right to be notified without unreasonable delay and no later than 60 days following our discovery of the breach.
Right to File a Complaint. If you have questions about this notice, your privacy rights, or believe your privacy rights have been violated, you may call the County Privacy Officer or fill out a complaint form online. You have the right to file a complaint directly with the Office for Civil Rights - U.S. Department of Health and Human Services (DHHS) via the following methods: • Email: BPECevinpl@UUF.Tbi (for health information privacy or patient safety inquiries)
- BPEZnvy@UUF.Tbi (for non-privacy related inquiries).
- Phone Number: (800) 368-1019 or TDD (800) 537-7697
- Fax Number: (202) 619-3818
- OCR Compliant Portal: OCR Complaint Portal
- Mailing Address:
  - Office for Civil Rights – U.S. DHHS
  - 200 Independence Ave., SW Room 509F, HHS Building
  - Washington, D.C. 20201

The complaint must be submitted in writing and sent by mail, fax, or electronically via email within 180 days of discovering the violation. County of Marin respects your right to voice concerns about your privacy. You are protected from any form of punishment, threat, or penalty when asking questions or filing a complaint.

Our Responsibilities:

We are required by law to maintain the privacy and security of your protected health information.
We will let you know promptly if a breach occurs that may have compromised the privacy and security of your information.
We must follow the duties and provide a clear and concise explanation of our privacy practices and inform you of any changes to these practices. We must provide you a copy.
We will not use or share your information other than as described here unless you tell us we can in writing. You may change your mind at any time. Let us know in writing.

Material Changes to the Terms of This Notice

We are obligated to adhere to the terms of this notice while it is in effect. We maintain the right to modify this notice and our privacy practices at any time. Additionally, we will display and provide access to the new notice at HHS Program/Services sites and clinics, in the waiting areas, or at the reception desk.

Notice of Nondiscrimination [AFFORDABLE CARE ACT (ACA) 45 CFR 92]

HHS complies with applicable federal civil rights laws and does not discriminate based on race, color, national origin, age, disability, or sex. We provide the following services:
Free aids and services for people with disabilities to help them communicate with us, such as qualified sign language interpreters and written information in alternative formats (such as large print, audio, and accessible electronic formats).
Free language services for individuals whose primary language is not English, including qualified interpreters and information in other languages.

Discrimination Based on Disability in HHS Programs or Activities

Effective May 1, 2024, County of Marin complies with the Discrimination Based on Disability in Health and Human Service Programs or Activities for people with disabilities under Section 504 of the Rehabilitation Act. The “Rehab Act” protects disabled people from discrimination of all ages.

Genetic Information Nondiscrimination Act (GINA)

Section 105 of Title 1 of GINA provides enhanced privacy protections for genetic information, ensuring individuals are not disadvantaged based on their genetic predispositions.
Genetic information must be treated with the same confidentiality as PHI, and only specific entities, such as medical researchers or law enforcement (under limited circumstances), may receive access.