Department of Behavioral Health and Intellectual disAbility Services

HIPAA Notice of Privacy Practices

Download Notice of Privacy Practices (PDF)

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We are required by law to protect the privacy of our patients’ protected health information (“PHI”). We are also required to give you this Notice, which explains when we may use PHI and when we can give PHI out or “disclose” it to others. You also have rights regarding your PHI that are described in this Notice.

We are required to abide by the terms of the Notice currently in effect. We reserve the right to change the terms of this Notice and to make a new Notice effective for all PHI we maintain. You can obtain a copy of a new notice at www.phila.gov/privacypolicy/ or by contacting the DBHIDS HIPAA Privacy Officer.

HOW DO WE USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION?

We may use and disclose your PHI without your permission for your treatment, to get paid for your health care, and to operate our business:

Payment: We may use and disclose your PHI in order to pay for treatment and services you receive from health care providers, to determine your eligibility for benefits and our responsibility to pay benefits for claims submitted for your treatment, including coordination of other benefits you may have. For example, we may tell your doctor if you are eligible for coverage and what percentage of the bill may be covered. We also may share your PHI with other government programs such as Medicaid and Medicare to coordinate benefits.

Treatment: We may use and disclose your PHI in connection with your treatment or the coordination of your care. For example, we may disclose information to your physicians or hospitals to help them provide medical care to you.

Health Care Operations: We may use and disclose your PHI for certain internal business activities. For example, we may review information from your health care providers to evaluate how well our programs are working or to determine the need for and quality of health care services we provide.
.
Reminders and Other Information: We may use your PHI to remind you about your appointments or to give you information about treatment alternatives or other health-related benefits and services.

Business Associates: Sometimes we arrange with individuals and businesses that are not part of DBHIDS to perform certain functions on our behalf. These individuals and businesses are known as “business associates. We require these business associates and their subcontractors to follow appropriate safeguards to protect your PHI.

Other Uses and Disclosures: We may also use and disclose your PHI, in most cases without your permission, in the following circumstances:

• When required to do so by law;
• For certain public health activities that are authorized by law (such as reporting for COVID-19 or other disease outbreaks);
• For reporting abuse, neglect, or domestic violence to government authorities authorized by law to receive such information;
• To a health oversight agency for the purpose of conducting health oversight activities authorized by law;
• In the course of any judicial or administrative proceeding, including an involuntary commitment proceeding; in response to a court or administrative tribunal’s order, subpoena, discovery request, or other lawful process;
• To the County Administration or designee responsible for overseeing behavioral health services and must receive information regarding the City’s behavioral health operations to carry out those responsibilities.
• To a law enforcement official for certain law enforcement purposes, such as providing limited information to locate a missing person or report a crime;
• To a coroner, medical examiner, or funeral director for purposes of carrying out their duties;
• To organ donation organizations to facilitate donations and transplants of organs, eyes, and tissues;
• For research purposes, such as research related to the prevention of disease or disability, if the research study meets certain requirements designed to protect your privacy;
• To avert a serious threat to the health or safety of you or any other person;
• For specified government functions, such as military or veterans’ activities, national security or intelligence activities, and your care if you are imprisoned;
• As authorized by and to the extent necessary to comply with laws and regulations related to workers’ compensation or similar programs;
• To persons involved in your care or who help pay for your care, such as a family member;
• To notify or assist in notifying a family member or personal representative of your location and general condition; or
• To a disaster relief organization, if you are unavailable or unable to object and we believe the disclosure is in your best interest.
• DBHIDS is required to disclose PHI about you when you or your personal representative requests it; or the U.S. Department of Health and Human Services requests information to assess whether DBHIDS is complying with privacy laws.

Other Uses and Disclosures that Require Your Written Authorization:

Except as outlined above, we will not use or disclose your PHI unless you sign a written authorization that gives us permission to do so. If you later change your mind, you may revoke that authorization but your doing so will not require us to take back any PHI we already disclosed.

We do not market or sell your PHI.

WHAT ARE YOUR RIGHTS?

You have the right to:

• See and get a copy of your medical and billing records and other health information about you held by DBHIDS in a designated record set. In certain situations, your request to see and copy your PHI may be denied. For example, you may not get access to information compiled in reasonable anticipation of a trial or administrative proceeding;
• Request that DBHIDS correct certain of your records if you believe the information is incorrect or incomplete. If we decide to make an amendment, we may also notify others who have copies of the information about the change. Note that even if we accept your request, we may not delete any information already documented in your medical record;
• Receive a list (accounting) of times DBHIDS has shared your PHI, who it shared it with, and why. We will include all disclosures except those for treatment, payment, or health care operations, and certain other disclosures (such as any you asked DBHIDS to make). An accounting will include disclosures made in the six years prior to the date of a request;
• Get a paper copy of this Notice upon request;
• Be notified of an unauthorized acquisition, access, use, or disclosure of your PHI that compromises the security or privacy of the PHI;
• Ask DBHIDS to restrict its uses and disclosures of your PHI. You will be required to provide specific information as to the disclosures that you wish to restrict and the reasons for your request. If we agree, we will comply with your request unless we notify your otherwise or the information is needed to give you emergency treatment. We are required to honor your request to restrict disclosure of your PHI to a health plan when the PHI relates solely to a health care item or service that you have fully paid for, or another person (other than an insurance company or health plan) has paid for fully on your behalf, unless otherwise required by law;
• Ask DBHIDS to contact you in a specific way (for example, on your home or office phone) or to send mail to a different address. Your request must be in writing and specific how or where you wish to be contacted. We will accommodate reasonable requests; and
• Certain administrative rules may apply to these individual rights. For example, you may be required to submit a request in writing or on a specific form, and you may be charged the cost of copying and postage. Your right to make a request does not necessarily mean that your request will be approved. Where a response to your request is appropriate, it will ordinarily be provided to you in writing.

ADDITIONAL INFORMATION

DBHIDS Information Contact: If you would like to exercise any of your rights under HIPAA you may contact:

DBHIDS Privacy Officer,
1101 Market Street, 7th Floor
Philadelphia, PA 19107
(215) 685-4768
DBHIDS.HIPAA@phila.gov

Submitting a complaint: If you believe that your privacy rights have been violated, you may submit a complaint with the City by contacting the City HIPAA Privacy Officer. The City HIPAA Privacy Officer may be reached at:

City HIPAA Privacy Officer
City of Philadelphia Law Department
1515 Arch Street, 15th Floor
Philadelphia, PA 19102
(215) 683-5404
HIPAAprivacy@phila.gov

You may also file a complaint with the Secretary of the US Department of Health and Human Services (“HHS”) at https://www.hhs.gov/hipaa/filing-a-complaint/complaint-process/index.html
If you have questions for HHS, you can email the Office of Civil Rights (“OCR”) at OCRMail@hhs.gov or call toll-free at: 1-800-368-1019, TDD: 1-800-537-7697.

A complaint must be made in writing. It is safe to file a complaint. No one may hold it against you.

Effective Date. This Notice is effective on January 1, 2026.

Download Notice of Privacy Practices (PDF)