ECHO COMMUNITY HEALTH CARE, INC.
Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
ATTENTION: Free English language assistance services are available to you. Appropriate auxiliary aids and services to provide information in accessible formats are also available free of charge. Please speak to the front desk or your provider.
Effective June 2025
This Notice of Privacy Practices (“Notice”) applies any health care professional authorized to enter information into or consult your medical record or who provides treatment to you while you are at or in the facility including but not limited to, physicians, mid-level providers, students, interns, social workers, other staff members of ECHO Community Health Care, Inc. (ECHO), and any other physician or health care provider that is involved in your care at any ECHO facility. ECHO entities, sites and locations may share health information with each other for treatment, payment or operations purposes described in this Notice.
OUR OBLIGATIONS TO YOU
The federal Health Insurance Portability and Accountability Act (“HIPAA”) requires us to safeguard the privacy of information we have about you. This Notice tells you how we protect your information, how we may use and disclose it, and your rights regarding it. We are required to give you a copy of this Notice and to comply with its terms. We reserve the right to make changes to this Notice and to make them effective for information we may already have about you. If we make a material change, we will post the revised Notice on our websites and at our facilities.
HOW WE MAY USE AND DISCLOSE YOUR INFORMATION
We may use and disclose your information for the following reasons without obtaining your permission.
For Treatment, Payment and Health Care Operations Purposes – We use and disclose your information to treat you, obtain payment for our services, and for our health care operations purposes. For example:
- We use your information to provide health care services for you and may disclose your information to other health care providers to coordinate your care.
- We submit claims to insurers to obtain payment for our services.
- We perform quality assessment and internal audits to improve our services.
Federal law permits ECHO and its substance use disorder treatment programs to use and disclose substance use disorder treatment records for treatment, payment, and health care operations, consistent with HIPAA and 42 CFR Part 2, when authorized by the patient. This includes care coordination, billing, quality improvement, and health care operations activities.
To Provide Appointment Reminders, Treatment Alternatives, and Health Related Benefits and Services Information – We may use and disclose your information to contact you to remind you that you have an appointment with us and to tell you about treatment alternatives or health-related benefits and services that may be of interest to you.
To Third Parties Who Perform Services on Our Behalf – We use third parties to provide services for us that require them to use your information (called “Business Associates”). For example, ECHO discloses your information to DHS EPIC, the electronic medical record provider, to maintain the information on our behalf and make it available to you and your other health care providers outside of ECHO to coordinate your care. We have agreements with our Business Associates, including DHS EPIC, that obligate them to protect your information in the same manner we do.
To Others Involved in Your Care – In some cases, we may disclose your information to a member of your family, a relative, a close friend, or other person you identify who is directly involved in your health care or payment of bills related to your health care. If you are seriously injured and unable to make a health care decision for yourself, we may disclose your information to a family member if we determine it is in your best interest.
When Required by Law – We may disclose your information when the law requires it. For example, we may disclose your information to a person who has authority under the law to act on your behalf; to report suspected victims of abuse, neglect, or domestic violence; for judicial and administrative proceedings; and to law enforcement officials to assist them in their law enforcement duties to the extent permitted by law subject to the further restrictions specified in this Notice.
For Public Health Activities – We may disclose your information to a public health authority authorized by law to collect or receive information to prevent or control disease, injury, or disability or to report vital statistics; to a government authority authorized by law to receive reports or child neglect or abuse; and to the Food and Drug Administration for its reporting and tracking requirements.
For Health Oversight Activities – We may disclose your information to a health oversight agency for oversight activities authorized by law including audits; civil, administrative, or criminal proceedings or actions; or other activities necessary for oversight of the healthcare system and government benefit programs.
For Research – We may use or disclose your information for limited research purposes, but only if steps required by law are taken to protect your privacy and as otherwise in compliance with our research policies and practices.
To Avert a Serious Threat to Health or Safety – To the extent permitted by law and ethical conduct, we may disclose your information to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
For Specialized Government Functions – We may use or disclose your information as necessary for certain government functions including intelligence, national security, or security clearance activities.
For Workers Compensation – We may disclose your information to workers compensation programs which provide benefits for work-related injuries.
To Defend the Organization – We may use or disclose your information to defend ECHO in the event of legal action or other proceeding brought by you.
USES AND DISCLOSURES REQUIRING YOUR EXPRESS AUTHORIZATION
Other than as described above, we must obtain your express written authorization to use or disclose your information, including with some exceptions, to use or disclose psychotherapy notes, if any, we have about you; for marketing purposes; and for any sale of your information. Information disclosed pursuant to an authorization may be redisclosed by the recipient only as permitted by HIPAA and other applicable law. You may revoke your authorization in writing at any time, but we cannot retrieve disclosures we have already made based on your prior authorization.
ADDITIONAL PRIVACY FOR SUBSTANCE USE DISORDER (SUD) TREATMENT
ECHO Beacon Recovery Services is a substance use disorder treatment program (a “SUD Program”). In addition, we may receive information from another SUD Program about your treatment. Substance use disorder treatment information is protected by federal law and may be used or disclosed only as permitted by the Health Insurance Portability and Accountability Act (HIPAA) and 42 CFR Part 2, including for treatment, payment, and health care operations, or as otherwise authorized or required by law.
Federal law prohibits discrimination against individuals based on substance use disorder treatment information. This information may not be used to discriminate against you in health care, employment, housing, education, access to social services, or in civil or criminal proceedings.
You are not required to authorize disclosures of substance use disorder treatment information beyond those permitted by law. Your decision regarding authorization will not affect your ability to receive treatment, except as permitted by law.
In addition, if we use this information to raise funds for our benefit, we must first provide you with a clear and conspicuous opportunity to elect not to receive any fundraising communications.
YOUR RIGHTS REGARDING YOUR INFORMATION
You have the following rights regarding your information. If you would like to exercise any of these rights, please submit your requests in writing to the Privacy Officer at the address on the last of this Notice.
Right to Request Restrictions – You can request restrictions on how we use and disclose your information for treatment, payment, and health care operations purposes. We are not required to agree to your request unless, and except as otherwise required by law, your request pertains solely to a health care item or service for which you have paid for out-of-pocket in full.
Right to Receive Confidential Communications or Communications by Alternative Means or at an Alternative Location – You can request us to communicate with you in a certain way or at an alternate address. We are required to accommodate reasonable requests. You should tell us if the disclosure of all or part of your information by nonconfidential communications could endanger you. To request confidential communications, you must make your request in writing to the ECHO Privacy Officer. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to Inspect and Copy – You can inspect and receive a copy of certain information we maintain about you. We may charge you a reasonable fee for the cost of producing and mailing the copies. In certain situations, we may deny your request. You may have the right to ask for a review of the denial. If we maintain the information electronically, you can request that we provide an electronic copy to you or to someone you designate. If the information is not in the form or format you request and is not readily producible in such form and format, we will provide you with the information in our standard electronic format. We may charge you a reasonable, cost-based fee for the labor associated with transmitting the information.
Right to Amend – You can request that we amend certain information we maintain about you if you believe the information is incorrect or incomplete, but you need to explain why the information is inaccurate or incomplete. We may deny your request in certain limited cases. If this occurs, you will be notified of the reason for the denial and provided an opportunity to appeal the denial.
Right to Receive an Accounting of Disclosures– You have the right to request a list of certain disclosures we have made of your information (called an “accounting”). The accounting lists those instances where we or our Business Associates have disclosed some portion of your information and to whom that disclosure was made other than disclosures for treatment, payment, and health care operations purposes; disclosures made to you or pursuant to your authorization; and certain other disclosures.
Right to Request a Paper Copy of this Notice – You may request another copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of the Notice. You may obtain a copy of the Notice at our web site www.echochc.org or contact the ECHO Privacy Officer.
Right to Receive a Notice of Certain Breaches – We will notify you in the event of a breach of your protected health information, including substance use disorder treatment records, in accordance with the HIPAA Breach Notification Rule and applicable federal law.
YOU ALSO HAVE THE RIGHT TO COMPLAIN
If you believe your privacy rights have been violated, or if you have concerns regarding our policies and procedures regarding how we use or disclose your information, you may file a complaint with the Privacy Officer. You may also submit your complaint to the Secretary of the United States Department of Health and Human Services at www.hhs.gov. We will not retaliate or discriminate against you or otherwise withhold services, payment, or privileges from you because you file a complaint.
To file a complaint with ECHO, contact the ECHO Privacy Officer. All complaints must be submitted in writing.
If you have any questions about this Notice, please contact:
ECHO Privacy Officer
401 John Street, Evansville, IN 47713
812-602-2159 or tschaber@echochc.org
