Privacy Policy

Policy for Secure Websites

Community Care is strongly committed to protecting your privacy. When you use our secure sites, you are asked to provide certain identifying information that allows us to assure that you are a Community Care member, the guardian of a member or provider. That identifying information is protected and is never disclosed by Community Care to any third party.

Introduction

Our secure websites allow you to access information about our company. We will also provide you with opportunity to data enter and store information about yourself on our site. By data entering information on our site, you are giving Community Care permission to review and store that information in our secure, private server. You are not giving us permission to share your information with any unrelated third party.

As part of the service that we offer to you, you may choose to share certain information that you data enter on this site with a provider or another user of this site. By selecting the option to share your data and selecting an individual with which to share your information, you are giving us permission to allow that user to see that specific information only when they are on our site. You may change your sharing preference at any time and there is no penalty for doing so.

A provider may ask a member to share certain information however the member is under no obligation to do so.

A member may choose to use any of the questionnaires or assessments on the site however some of the instruments may be focused on a specific diagnosis or level of care that pertains to the member. When you create a record, you are the custodian of that record. A custodian has full control over a record, including who else gets to view it. Some of the information stored in the records you manage may be highly sensitive, so you need to consider carefully with whom you choose to share the information.

To protect your security and privacy, we will not provide a user with any information that the user did not provide us with initially. We will not disclose any information from any of our other systems through this site.

Collection Of Your Personal Information: Members

To sign into the site, you are asked to enter your Medicaid ID and some additional information. The purpose of our request for that information is to make sure that we can identify the correct member in our web data base and make the correct association. We need to do this because the MA ID is a unique identifying number which all of our members must have.

The first time you sign in to the site, you are asked to create an account. To create an account, you must provide some additional personal information, date of birth, e-mail address, etc. We do not share this information with unrelated third parties nor do we use it in any way except to help us identify you in our enrollment database to assure that we are connecting your account to the correct party.

Collection Of Your Personal Information: Providers

There are two types of provider enrollment that this site offers. One is for providers who are individually contracted by Community Care (CI) while NCI providers are those who are not individually contracted but who work for an approved facility that is contracted by Community Care. If you are unsure of which type of account to use, you can access the Help function on the site, call the Provider Relations line or check with your supervisor in your agency.

CI providers are persons who have submitted a credentialing application to Community Care, had that application reviewed through the credentialing committee and received both approval and a contract to provide services to Community Care's members. NCI providers are persons who provide services to Community Care members within a contracted facility in Community Care's network. Non-par providers are not eligible to use this site.

For contracted providers, we use the credentialing data base to authenticate your identity when you attempt to create an account. For non-individually contracted providers, we require that your employer register with us and formally accept responsibility for authenticating employees. We have created an automated process that allows us to obtain assurance from your employer that the NCI providers are actually employed by contracted facilities in the Community Care network.

We will use the e-mail address you provide when you create your account to send you an e-mail requesting that you validate your account.

Community Care Use Of Data Entered On The Site

When a member enters information via a survey on our website, he/she is able to request that a specific provider who has registered for the site be granted permission to view those data elements.

Anytime a member completes an assessment or survey on the site, Community Care staff may use that information. We will store the records in a database that has a direct association between the member's ID number and the information that is entered on the site. We will not use any information on the site to decide if a requested service is medically necessary. We may use the information to determine if specific services are helpful to specific members or by putting the information together with other people's information (aggregation) to determine how effective a set of services or specific provider may be. Our intent for this is to be able to see what types of services work best for our members.

Community Care Behavioral Health Organization Notice Of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Si Ud necesita la versión en Español, por favor solicite uno a este telefono 1-866-229-3187

Our Commitment To Safeguarding Your Medical Information

Community Care is committed to keeping your personal medical information private and secure. This Notice of Privacy Practices tells you about the ways we may use and disclose (share) medical information about you. Not every use or disclosure may be listed. Your rights and our obligations regarding the use and disclosure of your medical information will also be explained in this Notice. Except in specified circumstances, we will use or disclose only the minimum necessary medical information needed to do our job.

We are required by the Health Insurance Portability and Accountability Act of 1996 to:

Make sure the information that identifies you is kept private
Give you this Notice that describes our legal duties and privacy practices regarding your medical information
Follow the terms of the Notice currently in effect

How We May Use and Disclose Information For Treatment, Payment and Health Care Operations

Community Care may use and disclose your medical information for a variety of reasons. The law provides that we are permitted to make certain uses/disclosures without your consent or authorization for treatment, payment and the operations of Community Care. The list below tells you about the different ways your information may be used for these purposes and gives you examples of those uses.

For Treatment: We may use medical information about you to coordinate and manage your behavioral health care. Assuring that you receive the appropriate treatment in the right setting is one of our top priorities. For example, if you need to be admitted to the hospital, Community Care collects information from your doctor about your medical condition and your need to be in the hospital, and then authorizes your admission, if medically necessary. Whenever you visit a doctor for outpatient therapy sessions, your doctor sends us updated information to let us know how you are progressing in treatment.

For Payment: We may use and disclose your medical information for any activities that we undertake to reimburse your provider for health care services provided to you. Your provider provides information to Community Care about services recommended for you in order to obtain prior approval or to determine whether the recommended treatment is covered by your Plan. Your provider then sends us a bill describing the services that he provided, and if those services were authorized, we submit the information to our claims vendor for payment to your doctor.

For Health Care Operations: We may use and disclose medical information about you for basic business activities that are necessary to operate our business. These uses and disclosures are necessary to run Community Care. These activities may include, but are not limited to, receiving and responding to member complaints, conducting compliance audits, and ongoing monitoring of the quality of provider services in order to assure that our members are receiving quality care. For example, if you file a complaint with us against your provider, we will investigate your complaint and share the information with certain government agencies that monitor our response to your concerns.

Other Uses and Disclosures Not Requiring Consent or Authorization: In addition to the disclosures for treatment, payment and health care operations described above, the law provides that we may use/disclose your medical information without your written consent or authorization in certain other circumstances. The following list outlines the types of uses and disclosures that may be made without your permission. Not every use or disclosure is listed.

When required by law. We may disclose information about you when federal, state, or local law requires us to do so.
For public health activities. We may disclose information about you to authorities for public health purposes. These activities generally include the following:
- To report child abuse or neglect
- To report reactions to medications or problems with products
- To notify the appropriate government authority if we believe you have been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree or when we are required or authorized by law
Health Oversight Activities: We may disclose your medical information to federal, state, or county agencies that oversee our activities. Health oversight activities are necessary for government agencies such as the Pennsylvania Department of Health, the Pennsylvania Department of Public Welfare and the Pennsylvania Insurance Department to monitor the health care system, government programs, and compliance with civil rights laws. These activities include audits and other investigations.
Lawsuits and Disputes: We may disclose medical information about you if you are involved in a lawsuit or dispute and we must respond to a court or administrative order. Only the medical information expressly authorized by the order will be disclosed. Information about you may also be disclosed in response to a subpoena, discovery request, or other lawful process initiated by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
For Law Enforcement or Specific Government Functions: We may disclose medical information in response to a request by a law enforcement official made through a court order, subpoena, warrant, summons or similar process. We may disclose medical information about you to federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
Coroners, Medical Examiners, Funeral Directors, and Organ Donation: We are permitted to release your medical information to a coroner, medical examiner or funeral director. This disclosure may be necessary, for example, in determining the cause of death. Although Community Care does not generally have information pertaining to organ donation, if we do posses such information, disclosure is permitted.
Research Purposes: Under certain circumstances, we may use and disclose medical information about you for research purposes. All research projects are subject to a special review process that is designed to balance the research needs with your privacy interests. Before your medical information is used or disclosed for research, the project will have been reviewed and approved through this process. We will usually ask for your specific written permission if the researcher will be involved in your care. No identifiable personal information will be released without your written permission.
Serious Threats to Health or Safety: As permitted by applicable law and standards of ethical conduct, we may use or disclose your medical information when necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person or the public.
Military and Veterans: If you are a member of the armed forces, we may release medical information about you as required by military command authorities. We may also release information about foreign military personnel to the appropriate foreign military authority.
Workers Compensation: We may release medical information about you for workers' compensation or similar programs that provide benefits for work-related injuries or illness.
Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release information about you to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution

Your Authorization in Certain Circumstances

Some uses and disclosures of information, as identified in this Notice, specifically require your written permission. This permission is provided through an authorization form. If you give us permission to use or disclose information about you, you may revoke (cancel) that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose information about you for the reasons covered by your written permission. We would be unable to take back any disclosures, however, that we already made with the original authorization.

Community Care's Internal Protection of Oral, Written, and Electronic PHI

Community Care uses a variety of safeguards to ensure the confidentiality of your protected health information. If we use information for reasons other than those described above, we change or remove any portion of the information that could allow someone to identify a member, or we contact the member in order to obtain an authorization.

Community Care's Privacy Officer, (Director of Compliance), along with the Security Officer, oversees the organization's policies and procedures regarding Confidentiality, Privacy, and the internal protection of oral, written, and electronic member information.

All Community Care employees are required to sign a Statement of Confidentiality, which, indicates that an employee having access to sensitive and confidential information has agreed not to access information from any source(s) that are not needed to perform his or her job duties. The Statement of Confidentiality also requires employees to access only the minimum information necessary to perform his or her job duties. Community Care's Compliance and Information Systems Departments will oversee and monitor employees' access to member confidential information across the organization.

Community Care also maintains an array of security provisions to protect confidential data and information. These provisions include:

Restricted computer access based on job duties
Physical lock and key arrangements
Electronic security systems
Mandatory compliance with the Employee Statement of Confidentiality

All physical media, including but not limited to paper, magnetic, and optical, used to store confidential data and information must be stored under a double lock system. All desks or secured storage areas must be in areas with keyed entry, maintaining a minimum of a dual key system. All electronic media containing confidential information must be password protected.

Confidential data and information no longer required for legitimate business purposes must be destroyed in a secure manner. Paper records must be thoroughly shredded. Magnetic files must be deleted in a manner that does not permit the files to be undeleted; for example, by reformatting a floppy disk using the "secure" format option. Optical storage media must either have the files securely deleted or, if this is not possible, the storage media must be destroyed.

Your Rights Regarding Your Medical Information

You have the following rights regarding the medical information that we maintain about you:

Right to Request Restrictions on the Uses and Disclosures of Medical Information. You have the right to ask that we limit how we use or disclose your medical information. We will consider your request, but are not legally bound to agree to the restriction. To the extent that we do agree to any restrictions on our use or disclosure of your information, we will put the agreement in writing and abide by it except in emergency situations. We cannot agree to limit uses or disclosures that are required by law.

To request restrictions, you must make your request in writing to the Director of Compliance of Community Care at the address below. In your request, you must tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply, for example, disclosure to your spouse.

Right to Choose How We Contact You: You have the right to ask that we send you information only at a certain location or in a certain way. For example, you can ask that we only contact you at home by telephone or by mail.

To request confidential communications, you must make your request in writing to the Director of Compliance at Community Care at the address below. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests.

Right to Inspect and Copy your Medical Information: Unless your access is restricted for clear and documented treatment reasons, you have the right to inspect and copy your medical information if you put your request in writing. We will respond to your request in 30 days.

To inspect and copy your medical information, you must submit your request in writing to the Director of Compliance of Community Care at the address below. If you request a copy of the information, we may charge a fee for the costs of copying, mailing, or other costs associated with your request. You have a right to choose what portions of your information you want to be copied and to obtain prior information on the cost of copying.

We may deny your request to inspect and copy your medical information in certain limited circumstances. If you are denied access to your information, you may request a review of that decision. Another health care professional chosen by Community Care will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

Right to Request an Amendment of Your Medical Information: If you believe that there is a mistake or missing information in our record of your medical information, you may request that the information be amended. You have the right to request an amendment for as long as Community Care keeps the information.

To request an amendment, your request must be made in writing and submitted to the Director of Compliance of Community Care at the address below. You must provide a reason for your request.

We may deny your request for an amendment if it is not in writing. We may also deny your request if it does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
Is not part of your medical information kept by Community Care;
Is not part of the information which you would be permitted to inspect and copy; or
Is accurate and complete.

Right to an Accounting of Disclosures: You have a right to request a list of when, to whom, for what purpose, and what content of your medical information has been released, other than disclosures for treatment, payment, and operations. The list will also not include any disclosures made for national security purposes, to law enforcement officials, or correctional facilities, or before April 14, 2003.

To request an accounting of disclosures, you must submit your request in writing to the Director of Compliance of Community Care at the address below. Your request must state a time period not longer than 6 years, and the time period cannot extend to dates before April 14, 2003. The first list you request within a 12 month period will be free. For additional lists, we may charge you for the costs of providing the list.

Right to a Paper Copy of This Notice: You have the right to a paper copy of this Notice, and you may ask us to give you a copy at any time. To obtain a paper copy of this Notice, send a request in writing to the Community Care Director of Compliance at the address below.

Address for Submission of all Requests Described in this Section:

Director of Compliance
Community Care Behavioral Health Organization
339 Sixth Avenue
Suite 1300
Pittsburgh, PA 15222

Changes to This Notice

Community Care reserves the right to change this Notice and to make the revised Notice effective for medical information we already have and for any information we receive in the future. The current copy of the Notice is posted on our website at: www.ccbh.com.

How to Complain about our Privacy Practices

If you think your privacy rights have been violated, or you disagree with a decision we have made about access to your medical information, you may file a complaint with the Community Care Complaints Specialist at the address above. All complaints must be filed in writing. You will not be penalized for filing a complaint.

You may also file a complaint with:

The Secretary of Health and Human Services
200 Independence Ave. S.W.
Washington D.C. 20201

Questions and Requests For Further Information

If you want additional information about your privacy rights or have any questions about this Notice, please submit your request in writing to:

Director of Compliance
Community Care Behavioral Health Organization
339 Sixth Avenue
Suite 1300
Pittsburgh, PA 15222

Requests for confidential information may also be referred to your health care provider responsible for providing you with your medical information.

Effective Date

The effective date of this Notice is April 14, 2003.