Privacy Policy
PURPOSE: To protect the privacy of the client's identity and any medical information gathered by BeBold Recovery in accordance with the HIPAA act of 1996, Federal Regulations on Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2, Health-General Article, and General Provisions Article, §4-101.
POLICY: BeBold Recovery upholds confidentiality to the highest degree and in order to maintain confidentiality, BeBold Recovery adopts the definition of and procedures of the American Counseling Association (ACA).
In the course of delivering its services and programs, BeBold Recovery collects personal information from each client. Personal information means any information that could be used on its own, or with other information, to establish the identity of a client, the service provider or the client's substitute decision maker. Personal information also includes any other information about a client including information that is contained in a client's record.
BeBold Recovery collects, uses and shares client's personal information for the following purposes:
- Providing quality programs and services to each client.
- Providing information to other people or organizations with consent of the client (for example, making a referral for service).
- Reviewing each client's files to ensure high quality of service and documentation.
BeBold Recovery may also collect, use and share personal information with consent or as permitted or required by law.
BeBold Recovery is committed to protecting the privacy of its clients and ensuring that:
- The personal information it receives from clients is kept safe, secure, confidential, accurate and up to date.
- Each client understands why their personal information is collected by BeBold Recovery.
- BeBold Recovery obtains consent before collecting, using, sharing or releasing client's information, except as set out in this policy or permitted or required by law.
- Only the personal information necessary for the purposes listed above is collected from clients, unless otherwise consented to by the client or permitted or required by law.
- Access to the client's information is limited to BeBold Recovery’s employees, volunteers and students involved in delivering services to the clients.
- Any external agents to whom BeBold Recovery releases information must have a need to know and only use and disclose client's information for the purposes for which it was originally provided.
- Clients can withdraw their consent at any time for the collection, use, and disclosure of their personal information.
- Clients have access to their record, except where BeBold Recovery’s entitled to refuse an access request, and may copy or correct their record and ask questions about BeBold Recovery’s privacy policies and procedures.
- Complaints about BeBold Recovery’s privacy policies and procedures are handled efficiently and effectively.
- All legal and regulatory requirements regarding client's information are met and maintained.
The assigned Privacy Officer is the Clinical Director.
Procedure:
All staff that work for BeBold Recovery are expected to uphold the ACA code of ethics and confidentiality requirements outlined below:
1. Obtaining, Withholding, Limiting and Withdrawing Consent
A. As BeBold Recovery’s programs often involve collaboration and consultation among employees, BeBold Recovery’s employees will discuss the following with new clients:
- The nature and extent of consultation and collaboration in BeBold Recovery’s program or service which the new clients are accessing.
- The personal information that BeBold Recovery may collect.
- The purposes for which BeBold Recovery collects, uses and shares personal information, as listed above.
B. The client's rights and responsibilities including rights related to keeping client's personal information private will be reviewed with all new clients at their first appointment following intake.
C. Each client will be asked to use a form indicating that BeBold Recovery’s privacy policies have been discussed and that he/she consents to the collection, use and sharing of personal information for the purposes listed in this policy. A note will be made in the client's electronic record that the form has been signed. In cases where it is not possible or practical to obtain the written acknowledgement (e.g., telephone only service), verbal acknowledgment that BeBold Recovery’s privacy practices have been explained to and accepted by the client will be recorded in an activity note in the client's record.
D. Consent will be given by the client. All information gained must relate to the personal information of the client and not be obtained through deception or coercion. A consent to the collection, use or sharing of personal health information about an individual is only valid if it is reasonable in the circumstances to believe that the individual knows, (a) the purposes of the collection, use and/or disclosure, as the case may be; and (b) that the individual may give or withhold consent.
E. In cases where the withholding, limiting or withdrawal of consent will limit or prevent BeBold Recovery from continuing to deliver services, employees will discuss with the client's the consequences of their withholding, limiting or withdrawal of consent.
In the event employees are concerned that a client does not have the capacity to consent to the collection, use and disclosure of his or her personal information, employees should:
- Consider whether the client understands the decision they are being asked to make
- Question whether the person understands the reasonably foreseeable consequences of the decision or lack of decision
- Consult with their supervisor
F. Clients have the right to stipulate who will have access to their personal information. This means that they can withhold, limit or withdraw their consent to the collection, use or disclosure of personal information. The request may cover all or a specific part of a client's record. When this happens, staff will implement the following “lock-box” procedure.
With electronic records: BeBold Recovery employee receiving the client's request to withhold, limit or withdraw their consent will:
- Record the verbal instructions by the client in an activity note in the client's electronic record
- Scan any written instructions by the client into the client's electronic record
- Notify all staff through immediate confidential email and update a living document containing current consents and revocations.
Paper records: If the client's also has a paper file:
The client's file (either in whole or in part depending on the client's instructions) to which access is to be limited will be placed inside an envelope that will be sealed with the instructions from the client's stapled to the outside of the file. If the client's request is to withdraw consent, the file will be safeguarded by BeBold Recovery’s Privacy Officer. If the client's request is to withhold or limit consent, the supervisor responsible for the program will determine how best to comply with the client's request.
2. Higher Levels of Confidentiality (Use of Aliases)
A. BeBold Recovery will serve clients periodically that require a higher level of confidentiality. For example: public figures; staff of BeBold Recovery funding sources; former staff, students and volunteers, who may not wish it to be known that they are accessing services through BeBold Recovery.
B. In such situations, programs will provide client's an opportunity to select and use an alias. The alias will be used in the client's record and in the client's interactions with BeBold Recovery.
C. A list of the aliases, clients’ real names and file numbers will be confidentially maintained by a designated person in each department with a copy to BeBold Recovery’s Privacy Officer.
D. A higher level of confidentiality designation does not invalidate the normal legal limits to confidentiality, which includes subpoenas, search warrants and the right of government funders to audit a client's records. The client must be informed of these limitations on confidentiality.
E. The Human Resources Department will provide names of new staff members, volunteers and students to BeBold Recovery’s Privacy Officer so that a check of the client's database can be completed. If the individual has received services from BeBold Recovery in the past, an alias will be assigned to the record in order to maintain the privacy of the new staff member, volunteer or student.
3. Release of Information with Client's Consent
A. Personal information, whether all or part of a client's record, will not be released to third parties without the written consent of the client or the client's substitute decision maker, where applicable. Clients are required to complete BeBold Recovery’s Release Information Form. Consents provided on these forms are valid for one year, unless otherwise limited or withdrawn by the client in advance of that date. BeBold Recovery may disclose a client's personal information, provided that the disclosure, to the best of BeBold Recovery's knowledge, is for a lawful purpose.
B. Reports from third parties contained in a client's record may not be released without the written consent of the third party. A client will be encouraged to pursue access to this information directly with the third party.
C. In exceptional circumstances, where written consent is not possible, the oral consent of the client to the release of personal information will be accepted and will be recorded in the client's file.
D. In response to requests to release information to third parties, BeBold Recovery service providers will ensure that the client understands the purpose for which the information is being released and to whom the information is being released. BeBold Recovery service provider will also explain that BeBold Recovery cannot guarantee the confidentiality of the information once it has been released.
4. Confidential Administrative Records
A. BeBold Recovery will assign its Privacy Officer the responsibility of record keeping. This will include personnel records, sensitive and protected information, any legal information that pertains to the clients and/or BeBold Recovery, and BeBold Recovery’s contracts, budgets, any billing information, and any and all records of donations and donors.
B. The Privacy Officer will be responsible for keeping all records safe, secure, confidential, accurate and up to date.
C. All confidential administrative hard copies will be stored in locked cabinets and any information stored electronically will be protected by password. Access to BeBold Recovery's electronic database and hard copies will be limited on a need-to-know basis for added security.
5. Safeguarding of Personal Information
A. Client's information stored electronically is protected by password. Access to BeBold Recovery's electronic database is limited on a need-to-know basis for added security.
B. Client's information collected in hard copy form is stored in locked cabinets accessible only by the counselors or other organization employees, students and volunteers providing service to the client, and the relevant program managers.
C. Access to a client's information will be limited to those who need to know the information for the purposes set out in the client's consent or as otherwise permitted or required by law.
D. BeBold Recovery’s employees will never leave a client’s personal information, in paper or electronic form, unattended or exposed to anyone other than the client.
E. BeBold Recovery will not send confidential personal information to a client by email without the client's prior consent. Personal information sent to a client or about a client will employ secure email. (Note that secure email ensures messages are encrypted. BeBold Recovery's regular email program is not secure email.)
F. Web-based counseling will use an encrypted website to protect a client's privacy and confidentiality.
G. BeBold Recovery requires external agents, such as third-party auditors, to maintain the confidentiality of client's information and to refrain from using client's information for any purpose other than the purposes for which consent was provided by the client. Where appropriate and necessary, BeBoldRecovery will obtain the consent of the client to disclose information to external agents. (External agents are persons or companies with which BeBold Recovery has contracts and that may come into contact with personal information.)
H. When disposal is permitted or required, records containing client's personal information will be disposed of in a secure manner such that reconstruction of the records is not reasonably foreseeable in the circumstances.
6. Notice to clients for Theft, Loss, Unauthorized Access, Use or Disclosure of Personal Information
A. Employees are required to report to their supervisor and to BeBold Recovery’s Privacy Officer any theft, loss, unauthorized access, use or disclosure of personal information of BeBold Recovery's clients. In programs where funders require it, managers will file a serious occurrence report in this situation.
B. In the event of such theft, loss, unauthorized access, use or disclosure of personal information of an organization’s client, BeBold Recovery will notify the client as soon as possible.
C. Oral contact with the clients will be logged in the client's record and will be followed up by a letter, which will be included in the client's record.
D. In the case of former clients, contact will be made orally, if possible, and also in writing, at the last known address for the client recorded in BeBold Recovery’s database.
7. Client's Access to and Correction of Personal Information
A. A client wishing to review their records should contact BeBold Recovery’s service provider, relevant Director or Privacy Officer.
B. Within 30 days of any such request, an appointment will be made for the client to review his/her personal information in a confidential manner on BeBold Recovery's premises, in the presence of BeBold Recovery's employee, unless BeBold Recovery is entitled to refuse the request, in which case written notice will be given. A client may bring a support person to this appointment if they wish. Up to 60 days may be required in the case of complex searches for records. In exceptional circumstances (e.g., a client is unable to come to BeBold Recovery’s office due to health issues), a copy of the record may be sent to the individual with consent.
C. BeBold Recovery is required to retain a client's personal information that is the subject of a request for access for as long as necessary to allow the client to exhaust any recourse under the Personal Health Information Protection Act, 2004 that he or she may have with respect to the request. This may require BeBold Recovery to maintain the record for longer than the typical client's record retention period.
D. A client who wishes an explanation of their records may contact the service provider, the relevant program manager or BeBold Recovery’s Privacy Officer.
E. A client will not be permitted to access third party records without the consent of the third party. In such cases, BeBold Recovery service providers will direct the client to obtain the requested information directly from the third party.
F. A person wishing to correct information in their file shall provide the correction in writing to BeBold Recovery. The written correction will be included in the client's record and, within three weeks of receipt, BeBold Recovery will notify the client of its response to the correction.
8. Appointment of Privacy Officer
A. The Privacy Officer for BeBold Recovery is the Clinical Director.
B. The name and contact information for the Privacy Officer is available on BeBold Recovery's website, in the “Notice of Privacy Practices” statement.
C. The duties of the Privacy Officer include:
- Maintaining knowledge of privacy legislation and regulations
- Ensuring that all employees and volunteers have training on the privacy policy
- Monitoring employee compliance with BeBold Recovery's privacy policy
- Responding to privacy-related complaints and concerns
- Responding to requests for access and correction
- Responding to inquiries from the public about BeBold Recovery's privacy practices
- Liaising with other organizations, the public and government, as necessary, on privacy-related issues
9. Inquiries and Complaints
A. Questions, comments or complaints about BeBold Recovery's privacy policies and procedures or about the collection, use or disclosure of personal information will be directed to the Privacy Officer.
B. The Privacy Officer will follow the procedures set out in the policy in responding to, resolving, and recording privacy-related complaints.
C. If the client is not satisfied with the response provided by the Privacy Officer, the client may follow the grievance and complaint procedure outlined in “Client Rights & Grievances” policy.Counselors and therapists recognize that trust is a cornerstone of the counseling-therapist relationship.
Counselors and therapists aspire to earn the trust of clients by creating an ongoing partnership, establishing, and upholding appropriate boundaries, and maintaining confidentiality. Counselors and therapists communicate the parameters of confidentiality in a culturally competent manner.
Contact our team today to learn more.
Phone: 757-921-8111
Email: Info@beboldrecovery.com