HIPAA Notice of Privacy Practices
We keep a record of the health care services we provide you. You may ask us to see and copy that record. You may also ask us to correct that record. We will not disclose your record to others unless you direct us to do so or unless the law authorizes or compels us to do so. You may see your record or get more information about it at 16000 Bothell-Everett Hwy, #360, Mill Creek, WA 98012 or by emailing records@millcreekfamilyservices.com.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Your health record contains personal information about you and your health. State and Federal law protect the confidentiality of this information. Protected Health Information (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical and mental health condition and related health care services. If you suspect a violation of these legal protections, you may file a report with the appropriate authorities in accordance with Federal and State regulations.
We are required by law to maintain the privacy of your PHI and to provide you with notice of our legal duties and privacy practices with respect to your PHI. This Notice of Privacy Practices describes how we may use and disclose your PHI in accordance with applicable law and describes your rights regarding your PHI. We are required to abide by the terms of this Notice.
We reserve the right to change the terms of this Notice at any time. Any new Notice will be effective for all PHI that we maintain at that time. We will make available a revised Notice by sending you an electronic copy, providing one in person, or sending a copy by mail upon request.
How We are permitted to Use and Disclose Your PHI
For Treatment. We may use medical and clinical information about you to provide you with treatment services.
For Payment. We may use and disclose medical information about you so that we can receive payment for the treatment services provided to you.
For Healthcare Operations. We may use and disclose your PHI for purposes related to the operation of our professional practice, including supervision, consultation, quality assurance, training, and administrative activities.
Without Your Authorization. State and Federal law permit us to disclose PHI without your authorization in certain limited situations, such as pursuant to a valid court order or as otherwise required by law.
With Authorization. We must obtain written authorization from you for other uses and disclosures of your PHI. You may revoke such authorizations in writing in accordance with 45 CFR. 164.508(b)(5).
Incidental Use and Disclosure. We are not required to eliminate all risk of incidental use or disclosure of PHI. Uses or disclosures that occur incident to an otherwise permitted use or disclosure are allowed provided reasonable safeguards are in place and the minimum necessary information is disclosed.
Substance Use Disorder (SUD) Records
SUD records are protected by 42 CFR Part 2 (the federal law governing the confidentiality of substance use disorder treatment records) and may be subject to more stringent rules (“Part 2 Records”). Any use and/or disclosure of Part 2- records for treatment, payment or healthcare operations generally requires your written consent, unless a specific Part 2 exception applies.
Redisclosure: Some of your health information may be protected by 42 CFR Part 2. When these records are disclosed with your written consent or as otherwise permitted by law, the recipient may re-disclose the information in accordance with the HIPAA Privacy Rule. However, re-disclosure is limited to purposes permitted under HIPAA, and certain protections and restrictions may continue to apply. We will not use or disclose your substance use disorder records in a way that would violate applicable federal law.
Legal Proceedings: Part 2 records (or testimony relaying their contents) generally cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless the disclosure/use is pursuant to your written consent or pursuant to a qualifying court order consistent with the standards of 42 CFR Part 2.
Fundraising and Marketing: You have the right to choose not to receive fundraising and marketing communications from me. We will not use information from your SUD records for fundraising or marketing purposes.
Examples of How We May Use and Disclose Your PHI
Listed below are examples of the uses and disclosures that we may make of your PHI. These examples are not meant to be a complete list of all possible disclosures, rather, they are illustrative of the types of uses and disclosures that may be made.
Treatment. Your PHI may be used and disclosed by us for the purpose of providing, coordinating, or managing your health care treatment and any related services. This may include coordination or management of your health care with a third party, consultation or supervision activities with other health care providers, or referral to another provider for health care services.
Payment. We may use your PHI to obtain payment for your health care services. This may include providing information to a third party payor, or, in the case of unpaid fees, submitting your name and amount owed to a collection agency.
Healthcare Operations. We may use or disclose your PHI in order to support the business activities of our professional practice including; disclosures to others for health care education, or to provide planning, quality assurance, peer review, or administrative, legal, financial, or actuarial services to assist in the delivery of health care, provided we have a written contract with the business that prohibits it from re-disclosing your PHI and requires it to safeguard the privacy of your PHI. We may also contact you to remind you of your appointments.
Other Uses and Disclosures That Do Not Require Your Authorization
Required by Law. We may use or disclose your PHI to the extent that the use or disclosure is required by law, made in compliance with the law, and limited to the relevant requirements of the law. Examples of this type of disclosure include healthcare licensure related reports, public health reports, and law enforcement reports. Under the law, we must make certain disclosures of your PHI to you upon your request. In addition, we must make disclosures to the US Secretary of the Department of Health and Human Services for the purpose of investigating or determining our compliance with the requirements of privacy rules.
Health Oversight. We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies and organizations that provide financial assistance to the program (such as third-party payors) and peer review organizations performing utilization and quality control. If we disclose PHI to a health oversight agency, we will have an agreement in place that requires the agency to safeguard the privacy of your information.
Abuse or Neglect. We may disclose your PHI to a state or local agency that is authorized by law to receive reports of abuse or neglect. However, the information we disclose is limited to only that information which is necessary to make the required mandated report.
Deceased Clients. We may disclose PHI regarding deceased clients for the purpose of determining the cause of death, in connection with laws requiring the collection of death or other vital statistics, or permitting inquiry into the cause of death.
Research. We may disclose PHI to researchers if (a) an Institutional Review Board reviews and approves the research and a waiver to the authorization requirement; (b) the researchers establish protocols to ensure the privacy of your PHI; and (c) the researchers agree to maintain the security of your PHI in accordance with applicable laws and regulations.
Criminal Activity or Threats to Personal Safety. We may disclose your PHI to law enforcement officials if we reasonably believe that the disclosure will avoid or minimize an imminent threat to the health or safety of yourself or any third party..
Compulsory Process. We may be required to disclose your PHI if a court of competent jurisdiction issues an appropriate order, and if the rule of privilege has been determined not to apply. We may be required to disclose your PHI if we have been notified in writing at least fourteen days in advance of a subpoena or other legal demand, no protective order has been obtained, and a competent judicial officer has determined that the rule of privilege does not apply.
Essential Government Functions. We may be required to disclose your PHI for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs.
Law Enforcement Purposes. We may be authorized to disclose your PHI to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official’s request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person’s death, if we suspect that criminal activity caused the death; (5) when we believe that protected health information is evidence of a crime that occurred on our premises; and (6) in a medical emergency not occurring on our premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.
Psychotherapy Notes. If kept as separate records, we must obtain your authorization to use or disclose psychotherapy notes with the following exceptions. We may use the notes for your treatment. We may also use or disclose, without your authorization, the psychotherapy notes for our own training, to defend ourself in legal or administrative proceedings initiated by you, as required by the Washington Department of Health or the US Department of Health and Human Services to investigate or determine our compliance with applicable regulations, to avoid or minimize an imminent threat to anyone’s health or safety, to a health oversight agency for lawful oversight, for the lawful activities of a coroner or medical examiner or as otherwise required by law.
Uses and Disclosures of PHI With Your Written Authorization
Other uses and disclosures of your PHI will be made only with your written authorization. We will not use or disclose psychotherapy notes, use your PHI for marketing purposes, or sell your PHI without your authorization. You may revoke an authorization in writing at any time, except to the extent we have already relied on it.
Your Rights Regarding Your PHI
You have the following rights regarding PHI that we maintain about you. Requests must be made in writing.
Right of Access to Inspect and Copy. You may inspect and obtain a copy of your PHI contained in a designated record set for as long as we maintain the record. We may charge a reasonable, cost-based fee. In limited circumstances, access may be denied, and you may have the right to appeal that decision.
Right to Amend. You may request that we amend your PHI. We may deny such requests in certain circumstances. If denied, you may submit a statement of disagreement.
Right to an Accounting of Disclosures. You may request an accounting of certain disclosures of your PHI made during the previous six years, excluding disclosures made for treatment or pursuant to your authorization.
Right to Request Restrictions. You may request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations, or to family members involved in your care. We are not required to agree to all requested restrictions, except as required by law, including requests to restrict disclosures to a health plan when you pay out of pocket in full for services.
Right to Request Confidential Communication. You may request that we communicate with you by alternative means or at an alternative location. Reasonable requests will be accommodated.
Right to a Copy of this Notice. You may obtain a copy of this Notice at any time.
Right to Opt Out of Fundraising Communications You have the right to opt out of receiving fundraising communications. Mill Creek Family Services does not engage in fundraising communications.
Right to Notice of Breach. You have the right to be notified following a breach of unsecured PHI.
Contact Information
Our Privacy and Security Officer is designated below. If you have any questions about this Notice of Privacy Practices, please contact that person. The contact information is:
Courtney Greene
16000 Bothell-Everett Hwy, # 360, Mill Creek, WA 98012
phone: 425.357.9111 ext. 601
Complaints
If you believe we have violated your privacy rights, you may file a complaint in writing with our Privacy Officer, as specified above. You also have the right to file a complaint in writing to the Washington Department of Health or to the US Secretary of Health and Human Services. We will not retaliate against you in any way for filing a complaint.
Effective date of this notice: February 11, 2026