Notice of Privacy Practices

Our Commitment to Your Privacy

Health Alliance Integrated Care (hereinafter “HAIC,” “we,” “us,” or “our”) is committed to protecting the privacy and security of your protected health information (PHI) in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HIPAA Privacy Rule (45 CFR Parts 160 and 164), the Minnesota Health Records Act (Minnesota Statutes Section 144.291–144.298), and Title 42 of the Code of Federal Regulations Part 2 (42 CFR Part 2) governing the confidentiality of substance use disorder patient records. This Notice of Privacy Practices explains how we collect, use, disclose, and safeguard your PHI and informs you of your rights regarding that information.

---

Information We Collect

In the course of providing integrated behavioral health, psychiatric, and care coordination services, we collect and maintain the following categories of protected health information: demographic information (name, date of birth, address, contact information); insurance and billing information; clinical assessment and diagnostic information; treatment plans, progress notes, and outcome measurement data; psychiatric medication records; substance use disorder treatment records (subject to heightened 42 CFR Part 2 protections); crisis safety plans; referral and care coordination communications with your authorized providers; and intake forms and consent documents.

---

How We Use and Disclose Your Information

Treatment: Your PHI is shared among the members of your authorized clinical team at HAIC (therapist, psychiatric prescriber, care coordinator, social worker) for the purpose of coordinating your integrated treatment plan. When you authorize care coordination with external providers (your primary care physician, specialist, or community partner organization), we share relevant clinical information necessary to support coordinated care. All internal treatment disclosures are governed by our minimum necessary standard, meaning each team member accesses only the information relevant to their role in your care.

Payment: We may use and disclose your PHI to bill your insurance plan, process claims, obtain prior authorizations, and conduct utilization review activities necessary to obtain reimbursement for services provided to you.

Healthcare Operations: We may use your PHI for quality improvement activities, clinical training and supervision, accreditation processes, and program evaluation. Information used for these purposes is de-identified or aggregated whenever possible.

Required by Law: We may disclose your PHI when required by federal, state, or local law, including mandatory reporting of suspected child abuse or neglect, suspected abuse or neglect of vulnerable adults, and situations involving imminent danger to yourself or others as required by the Minnesota Duty to Warn statute.

---

Psychotherapy Notes

Psychotherapy process notes maintained by your individual therapist are afforded special protections under the HIPAA Privacy Rule. These notes are kept separate from the standard clinical record and are not disclosed to insurance companies, other members of your care team, or any third party without your specific written authorization, except as required by law. Your authorization to release psychotherapy notes is always voluntary and may be revoked at any time.

---

Substance Use Disorder Records

If you receive substance use disorder treatment at HAIC, your records related to that treatment are protected by 42 CFR Part 2, which provides heightened confidentiality protections beyond standard HIPAA requirements. These records may not be disclosed without your specific written consent except in limited circumstances defined by federal regulation (medical emergency, qualified audit/evaluation, court order meeting specific regulatory criteria, or communication between qualified service organization personnel). A general authorization for the release of medical records is not sufficient to release substance use disorder treatment records.

---

Telehealth Privacy

Telehealth sessions are conducted using a HIPAA-compliant, end-to-end encrypted video platform with a signed Business Associate Agreement. We do not record telehealth sessions. Clinical documentation for telehealth appointments is maintained in the same electronic health record system as in-person visits and is subject to the same privacy and security protections. We recommend that patients participate in telehealth sessions from a private location and use a personal device with current security updates. HAIC is not responsible for privacy breaches resulting from patient-side device or network security.

---

Your Rights

Under HIPAA and Minnesota law, you have the following rights regarding your protected health information:

• Right to Access: You may request to inspect and obtain a copy of your clinical records maintained by HAIC.
• Right to Amend: You may request that we amend your records if you believe they contain an error.
• Right to an Accounting of Disclosures: You may request a list of disclosures we have made of your PHI in the preceding six years.
• Right to Request Restrictions: You may request that we limit certain uses or disclosures of your PHI.
• Right to Confidential Communications: You may request that we communicate with you using a specific method or at a specific location.
• Right to Revoke Authorization: You may revoke any previously granted authorization for disclosure at any time by providing written notice to our Privacy Officer.

---

Data Security & Zero Data Selling

HAIC maintains administrative, physical, and technical safeguards to protect your PHI from unauthorized access, use, or disclosure. These include role-based access controls, encryption of electronic records at rest and in transit, secure physical storage of paper records, staff training on HIPAA and privacy requirements, and regular security risk assessments. We never sell your protected health information to any third party for any purpose, including marketing, data analytics, research, or commercial purposes. We do not use your PHI for targeted advertising and do not share patient data with data brokers or marketing firms.

---

Privacy Officer Contact

If you have questions about this Notice of Privacy Practices, wish to exercise any of your rights, or believe your privacy has been violated, please contact our Privacy Officer:

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint. This Notice of Privacy Practices is effective as of January 1, 2024, and will remain in effect until replaced by an updated notice.

© 2024 Health Alliance Integrated Care. 501(c)(3) EIN: 41-3829104. All rights reserved.