Privacy Policy

​This Notice of Privacy Practices is provided to you as a requirement of the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. It describes how we may use or disclose your protected health information, with whom that information may be shared, and the safeguards we have in place to protect it. This notice also describes your rights to access and amend your protected health information. You have the right to approve or refuse the release of specific information outside of our system except when the release is required or authorized by law or regulation.

 

ACKNOWLEDGEMENT OF RECEIPT OF THIS NOTICE

 

You will be asked to provide a signed acknowledgment of receipt of this notice. Our intent is to make you aware of the possible uses and disclosures of your protected health information and your privacy rights. The delivery of your health care services will in no way be conditioned upon your signed acknowledgement. If you decline to provide a signed acknowledgment, we will continue to provide your treatment, and will use and disclose your protected health information for treatment, payment and health care operations when necessary.

 

WHO WILL FOLLOW THIS NOTICE

This notice describes the practices of Potomac Case Management Services, Inc., d/b/a Potomac Community Services (“PCS”), regarding your protected health information. For this notice, PCS includes the following:

 

• All PCS staff authorized to enter information in your file.

• Any oversight authority from which eligibility for treatment must be obtained.

• Any facility or entity involved in the continuity of your care (these may include hospitals, treatment facilities, behavioral health providers and all individual providers/staff that operate under their auspices).

• Identified entities (such as Maryland Health Partners) responsible for reimbursement of services or from whom payment is received.

All of these entities are bound to follow the terms of the Notice of Privacy Practices. Potomac Community Services is part of the continuum of care in Washington County and the treatment facilities within the county, all of which follow the Notice of Privacy Practices requirements.

 

OUR DUTIES TO YOU REGARDING PROTECTED HEALTH INFORMATION

 

“Protected health information” is individually identifiable health information. This information includes demographics, for example, age, address, e-mail address, and relates to your past, present, or future physical or mental health or condition and related health care services. PCS is required by law to do the following:

 

• Make sure that your protected health information is kept private.

• Give you this notice of our legal duties and privacy practices related to the use and disclosure of your protected health information.

• Follow the terms of the notice currently in effect.

• Communicate any changes in the Notice to you.

​

We reserve the right to change this notice. Its effective date is at the top of the first page and at the bottom of the last page. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. We will make the revised notice available upon request, at our office, and on our website on or before the effective date of the revision. You may obtain a Notice of Privacy Practices by calling the PCS Privacy Officer at 301-791-3087, ext. 203 and requesting a copy or by asking for a copy at your next appointment.

 

HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION

 

Following are examples of permitted uses and disclosures of your protected health information. These examples are NOT exhaustive.

Treatment
We may use your protected health information to provide you with case management and other health care services. For example, information obtained by a case manager will be recorded in your record and used to determine the course of treatment that should work best for you. We may also disclose protected health information to other providers involved in your treatment.

​

Payment
Your protected health information will be used, as needed, to obtain payment for your health care services. This may include certain activities PCS might complete before it undertakes services recommended for you such as determining eligibility or coverage for benefits, reviewing services provided to you, and undertaking utilization review activities. For example, obtaining approval for services requires that your relevant protected health information be disclosed to obtain authorization for services to begin.

​

Health Care Operations
We may use or disclose, as needed, your protected health information to support the daily activities related to case management or health care. These activities include, but are not limited to, quality assessment activities, investigations, oversight or staff performance review, training of new staff or students, licensing, communications about services provided and conducting or arranging for other case-management-related activities.

​

For example, we may disclose your protected health information to intern students providing services at PCS. We may call you by name in the waiting room when your case manager is ready to see you. We may use or disclose your protected health information, as necessary, to contact you to remind you of your appointment.

​

We will share your protected health information with third-party “business associates” who perform various activities (for example, billing, community team planning) for or with PCS. The business associates will also be required to protect your health information and will sign a contract with PCS attesting to the same. Text messaging originator opt-in data, mobile number and consent will not be shared with any third parties.

​

We may use or disclose your protected health information, as necessary, to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you. For example, your name and address may be used to send you information about PCS treatment programs or health-related services. Any communications that constitute marketing under HIPAA will only be made with your prior written authorization.

​

Required by Law
We may use or disclose your protected health information if federal, state, or local law or regulation requires the use or disclosure.

​

To Avert a Serious Threat to Health or Safety
We may use and disclose your protected health information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Such disclosure would be to those persons who would be able to prevent or manage such a serious situation.

​

Public Health
We may disclose your protected health information to a public health authority which is permitted by law to collect or receive the information. The disclosure may be necessary to do the following:

 

• Prevent or control disease, injury, or disability

• Report child abuse, neglect, or exploitation

• Report elder abuse, neglect, or exploitation

• Report reactions to medications

• Notify proper authorities if we believe you have been a victim of domestic violence

​

Health Oversight
We may disclose protected health information to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. These health oversight agencies might include government agencies that oversee the mental health care system, government benefit programs, or government regulatory programs and civil rights laws.

​

Food and Drug Administration
We may disclose your protected health information to a person or company required by the Food and Drug Administration to do the following:

 

• Report adverse events, product defects, or problems and biologic product deviations

• Enable product recalls

​

Legal Proceedings
We may disclose protected health information during any judicial or administrative proceeding, in response to a court order or administrative tribunal (if such a disclosure is expressly authorized), and in certain conditions in response to a subpoena, discovery request, or other lawful process.

​

Law Enforcement
We may disclose protected health information for law enforcement purposes, including the following:

 

• Responses to legal proceedings

• Information requests for identification and location

• Circumstances pertaining to victims of a crime

• Deaths suspected from criminal conduct

• Crimes occurring at any Potomac Community Services site

• Medical emergencies (not on PCS premises) believed to result from criminal conduct

​

Coroners, Funeral Directors, and Organ Donations
We may disclose protected health information to coroners or medical examiners for identification, to determine the cause of death, or for the performance of other duties authorized by law. We may also disclose protected health information to funeral directors consistent with applicable law and, if necessary, to carry out their duties with respect to the decedent. We may also use or disclose protected health information to organ procurement organizations to facilitate organ, eye, or tissue donation and transplantation.

​

Research
We may disclose protected health information to researchers when authorized by law, for example, if their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your protected health information.

​

Criminal Activity
Under applicable Federal and state laws, we may disclose your protected health information if we believe that its use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual.

​

National Security and Intelligence Activities
When the appropriate conditions apply, we may use or disclose protected health information to Federal officials for conducting national security and intelligence activities, including protective services to the President or others legally authorized to receive such services. We may also disclose protected health information to authorized Federal officials for the conduct of lawful intelligence, counterintelligence, and other national security activities authorized by the National Security Act.

​

Military and Veterans
If you are a member of the armed forces, we may use or disclose protected health information about you as required by military command authorities. We may use or disclose protected health information about foreign military personnel to the appropriate military authority.

​

Workers’ Compensation
We may use or disclose protected health information about you for workers’ compensation to comply with compensation laws and other similar legally established programs. These programs provide benefits for work-related injuries or illnesses.

Inmates

​

Inmates
We may use or disclose your protected health information if you are an inmate of a correctional facility, and PCS created your protected health information while providing care to you. The disclosure would be necessary (1) for the institution to provide you with health care, (2) for your health and safety or health and safety of others, or (3) for the safety and security of the correctional institution.

​

Parental Access
Some state laws concerning minors permit or require disclosure of protected health information to parents, guardians, and persons acting in a similar legal status. We will act consistently with the laws of Maryland and make disclosures following such law.

 

USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION

REQUIRING YOUR PERMISSION

 

In some circumstances, you have the opportunity to agree or object to the use or disclosure of all or part of your protected health information. Following are examples in which your agreement or objection is required.

​

Individuals Involved in Your Health Care
Unless you object, we may disclose to a member of your family, a relative, a close friend, or any other person you identify, your protected health information that directly relates to that person’s involvement in your health care. We may also give information to someone who helps pay for your care. Additionally, we may use or disclose protected health information to notify or assist in notifying a family member, personal representative, or any other person who is responsible for your care, of your location, general condition, or death. Finally, we may use or disclose your protected health information to an authorized public or private entity to assist in disaster relief efforts and coordinate uses and disclosures to family or other individuals involved in your health care.

​

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

You may exercise the following rights by submitting a written request to the PCS Privacy Officer. Depending on your request, you may also have rights under the Privacy Act of 1974. The PCS Privacy Officer can guide you in pursuing these options. Please be aware that PCS may deny your request; however, you may seek a review of the denial.

 

Right to Inspect and Copy
You may inspect and obtain a copy of your protected health information that is contained in a “designated record set” or file for as long as we maintain the protected health information. A designated record set/file contains medical and billing records and any other records that PCS used for making decisions about you.

​

This right does not include inspection and copying of the following records: psychotherapy notes; information compiled in reasonable anticipation of or use in, a civil, criminal, or administrative action or proceeding; and protected health information that is subject to a law that prohibits access to protected health information.

 

PCS RETAINS THE RIGHT NOT TO RELEASE INFORMATION OBTAINED FROM A THIRD PARTY WHERE SUCH WITHHOLDING IS PERMITTED UNDER APPLICABLE LAW.  INFORMATION THAT IS NOT PART OF YOUR DESIGNATED RECORD SET MAY NEED TO BE REQUESTED FROM THE SOURCE OF ORIGIN.

 

If you request a copy of information, a reasonable, cost-based fee for copying and/or other costs associated with your request may be charged. Copies will be released directly to you or an identified source, which must be put in writing to the Privacy Officer of PCS.

​

Right to Request Restrictions
You may ask us not to use or disclose any part of your protected health information for treatment, payment, or health care operations. Your request must be made in writing to the PCS Privacy Officer where you wish the restriction instituted. Restrictions are not transferable. In your request, you must tell us (1) what information you want restricted; (2) whether you want to restrict our use, disclosure, or both; (3) to whom you want the restriction to apply, i.e., disclosures to your spouse; and (4) an expiration date. Please note that we are required to agree to a request to restrict disclosure of your protected health information to a health plan if the disclosure is for payment or health care operations purposes and the protected health information pertains solely to a health care item or service for which you have paid PCS in full out of pocket.

​

 

Right to Request Confidential Communication
You may request that we communicate with you using alternative means or at an alternative location. We will not ask you the reason for your request. We will accommodate reasonable requests, when possible.

​

Right to Request Amendment
If you believe that the information we have about you is incorrect or incomplete, you may request an amendment to your protected health information as long as we maintain this information. While we will accept requests for amendment, we are not required to agree to the amendment.

​

Right to an Accounting of Disclosures
You may request that we provide you with an accounting of the disclosures we have made of your protected health information. This right applies to disclosures made for purposes other than treatment, payment, or health care operations as described in this Notice of Privacy Practices. You may request an accounting of disclosures made within the six (6) years prior to your request. The right to receive this information is subject to additional exceptions, restrictions and limitations as described earlier in this notice.

 

Right to Obtain a Copy of this Notice
You will receive a paper copy of this notice from PCS during your intake process to begin treatment. A copy of this notice will be available upon request from employees of PCS.

​

Federal Privacy Laws
The PCS Notice of Privacy Practices is provided to you as a requirement of the Health Insurance Portability and Accountability Act (HIPAA). There are several other privacy laws that also apply including the Freedom of Information Act, the Privacy Act, the Alcohol, Drug Abuse, and Mental Health Administration Reorganization Act, and the federal regulations governing the Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2). These laws have not been superseded and have been taken into consideration in developing our policies and this notice of how we will use and disclose your protected health information.

​

Changes to this Notice
Potomac Community Services reserves the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in our office. The notice will contain on the first page, in the top right-hand corner, the effective date.

​

Complaints
If you believe these privacy rights have been violated, you may file a written complaint with the PCS Privacy Officer or the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, or by calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/. No retaliation will occur against you for filing a complaint. You will not be penalized for filing a complaint.

​

Contact Information
You may contact the PCS Privacy Officer or the Security Officer for further information about the complaint process or for further explanation of this document.

 

Potomac Case Management Services, Inc.
DBA Potomac Community Services
Data Privacy Policy

 

Introduction

Potomac Community Services (“PCS,” “we,” “our,” or “us”) values the privacy and security of personal information shared with us. We are committed to protecting the data of our program participants, donors, volunteers, and community partners. In the event of a breach of unsecured protected health information, PCS will notify affected individuals as required by the HIPAA Breach Notification Rule and Maryland law. This policy outlines our practices for collecting, using, storing, and sharing information, particularly regarding communications through text messages.

 

1. Data Collection

We collect personal information necessary for our programs and services and as required by our federal and state funders, including names, phone numbers, email addresses, income information, and other details. Data is collected only with the participant's explicit consent, typically through sign-up forms, program registrations, donations, or other interactions with PCS.

 

2. Use of Personal Information

We use personal information to communicate with participants about relevant services, updates, events, and opportunities. Text messages may be used to send reminders, alerts, and other important program-related information. We will only use personal contact details for purposes related to our mission and will not sell, trade, or rent personal information to third parties.

 

3. Text Message Communications

Opt-in Requirement: Participants must explicitly opt in to receive text messages. This opt-in may occur through written consent, online forms, or other verifiable means. Where messages are promotional or marketing in nature, PCS will obtain prior express written consent as required by the Telephone Consumer Protection Act (TCPA). Consent to receive text messages is not a condition of receiving any PCS service or program. At the point of opt-in, PCS will disclose the program or brand name, the purpose and recurring nature of the messages, the message frequency, that message and data rates may apply, the applicable opt-out (“STOP”) and help (“HELP”) keywords, and a link to this Privacy Policy and any applicable messaging terms.

​

Opt-out Option: Participants can opt out of receiving text messages at any time by replying “STOP” to any message, by following the instructions provided in the message, or by contacting us directly. PCS will honor a request to revoke consent made through any reasonable means and will process opt-out requests promptly. Upon opt-out, PCS will send a single confirmation message and will cease sending further text messages except as necessary to confirm the opt-out. Participants may reply “HELP” at any time to receive assistance and contact information.

​

Frequency of Messages: We aim to limit text message frequency to essential updates, ensuring participants do not receive excessive communications. PCS will send messages only during reasonable hours and will observe applicable restrictions on the timing of messages.

​

Message and Data Rates: Standard text messaging rates may apply as determined by the participant’s mobile carrier. PCS is not responsible for any additional costs incurred.

​

Data Protection in Texting: Protected health information, financial information, and other sensitive or confidential information will not be transmitted via text message. PCS will use email with encryption or other secure methods for communications involving such information. To the extent any text message content could constitute protected health information (such as appointment reminders), PCS will limit such content to the minimum necessary and will obtain any authorization required by HIPAA.

 

4. Data Security

We employ industry-standard measures to protect personal information from unauthorized access, use, or disclosure.

​

All employees and vendors handling personal information are trained on data security practices and the importance of confidentiality. PCS adheres fully to all mandates of the Health Insurance Portability and Accountability Act (HIPAA) and takes rigorous measures to protect protected health information (PHI) and Personally Identifiable Information (PII) at all times.

​

Access to personal information is restricted to only those who require it to perform their job functions. Also, PCS takes measures to ensure that all emails containing PHI and/or PII are encrypted prior to being sent.

 

5. Data Retention and Disposal

We retain personal information only as long as necessary for the purpose for which it was collected, or as required by law.

​

Once information is no longer needed, it is securely deleted or destroyed to protect privacy.

 

6. Third-Party Sharing

We may share limited personal information with trusted third-party service providers who assist us in operating our programs and services, such as technology platforms for texting and email.

These third parties are contractually obligated to protect personal information and use it solely for the services they provide to us.

​

Text messaging originator opt-in data, mobile number and consent will not be shared with any third parties.

 

7. Participant Rights

Access: Participants have the right to access the personal information we hold about them.

Correction: Participants may request corrections to their personal information to ensure accuracy.

Deletion: Participants may request deletion of their information, subject to PCS’s obligations to retain records as required by HIPAA, Maryland law, and other applicable federal and state record retention requirements.

Data Portability: Upon request, participants may receive a copy of their personal information in a format that is readily producible by PCS, consistent with applicable law.

​

8. Changes to the Policy

PCS reserves the right to update this policy as needed. We will notify participants of significant changes, particularly those affecting text messaging practices.

 

9. Contact Us

If you have questions, concerns, or would like to exercise your rights under this policy, please contact us at info@potomaccommunity.org.