0

CSEAP Privacy Notice

Colorado State Employee Assistance Program

***NOTICE OF PRIVACY PRACTICES***

Effective April 14, 2004
Amended June 30, 2014
Amended January 3, 2019

 

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

The Department of Personnel & Administration (the Department) is required under the Medical Privacy Rules of the Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. § 1320d et seq., and its implementing regulations, 45 C.F.R. Parts 160 and 164, to provide all state employees eligible to participate in certain health plans with this notice of privacy practices. This notice concerns the personal, protected health information you may provide to the State of Colorado's Employee Assistance Plan (CSEAP).

In general, access to your personal information is restricted to CSEAP counselors and those CSEAP employees who need to know the information in order to provide services to you. CSEAP maintains appropriate administrative, physical, and technical safeguards to protect the privacy and security of your information.

CSEAP is committed to protecting the confidentiality of your health information, and is required by law to do so. This notice describes how we may use your health information within CSEAP and how we may disclose it to others outside CSEAP. This notice also describes the rights you have concerning your own health information. Please review it carefully and let us know if you have questions.

CSEAP is required by law to:

  • Make sure your health information is protected,
  • Give you this notice describing our legal duties and our privacy and security practices for your protected health information, and
  • Follow the practices described in this notice.

How CSEAP may use and disclose your health information:

CSEAP abides by all applicable state and federal laws related to the protection of your health information. We may use or disclose, to the minimum amount of information that is reasonably necessary, your health information without your signed permission in certain limited ways, including:

  1. Treatment: CSEAP may use or disclose your information for treatment purposes. For example, CSEAP may share information with another provider to consult on how to best care for you. For another example, CSEAP may contact you to remind you of an upcoming appointment, to inform you about possible treatment options or alternatives, or to tell you about health-related services available to you.
  2. Payment: CSEAP may use and disclose your health information to get paid for the services that we provide to you. For example, CSEAP may share summary enrollment and utilization data with the Department for purposes of monitoring workload, resource allocation and budgeting. All summary information disclosed to the Department is de-identified and does not disclose the name or treatment information of any patient.
  3. Health care operations: CSEAP may use or disclose health information about you for CSEAP operations. For example, CSEAP may use or disclose health information for quality assessment and improvement activities, competency assurance activities, health reviews, audits, or legal services, business planning, development, management, and administration, and business management and general administrative activities, including de-identifying protected health information or creating a limited data set.
  4. Individuals involved in your care or payment for your care: CSEAP may rely on your informal permission to disclose protected health information to your family, relatives, friends, or other persons you identify when such information is directly relevant to the person\'s involvement in your care or payment for care. CSEAP also may rely on your informal permission to use or disclose protected health information for the purpose of notifying (including identifying or locating) family members, personal representatives, or others responsible for your care of your location, general condition, or death. In addition, your health information may be disclosed for notification purposes to public or private entities authorized by law or charter to assist in disaster relief efforts.
  5. As required by law: CSEAP will disclose health information about you when required or authorized to do so by federal, state, or local laws. For example, CSEAP providers are required to report child abuse or neglect, or at-risk elder abuse. In another example, CSEAP may be required to give information to Workers' Compensation Programs for work-related injuries.
  6. To avert a serious threat to health or public safety: In limited circumstances, CSEAP may use and disclose health information about you when necessary to prevent or lessen a serious and imminent threat to your health and safety or the health and safety of the public or another person.
  7. For health oversight activities: CSEAP may disclose health information to governmental, licensing, auditing and accrediting agencies as authorized or required by law.
  8. For research purposes: CSEAP may use or disclose your health information for research projects, such as studying the effectiveness of a treatment that you received. These research projects must go through a special process that protects the confidentiality of your medical information.
  9. For judicial and administrative proceedings: CSEAP may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal.
  10. Public safety purposes: In limited circumstances, CSEAP may disclose information for public safety purposes. For example, CSEAP may disclose information to law enforcement officials in response to a search warrant or a grand jury subpoena. CSEAP may also disclose information to assist law enforcement officials in identifying or locating a person, to prosecute a crime of violence, to report deaths that may have resulted from criminal conduct, and to report criminal conduct. CSEAP may also disclose your information to law enforcement officials and others to prevent a serious threat to health or safety.
  11. For deceased clients: CSEAP may disclose information concerning deceased clients to coroners, medical examiners, or funeral directors to assist them in carrying out their duties. CSEAP also may disclose limited information to family members or others unless doing so is inconsistent with any prior expressed preference of the client.
  12. Other uses and disclosures: CSEAP will seek your authorization if it wishes to use or disclose your information for a purpose that is not discussed in this notice. If you authorize CSEAP to use or disclose health information on your behalf, you may take back that authorization any time, unless CSEAP has already acted on your authorization. If you would ever like to revoke your authorization, please notify CSEAP in writing.

Information disclosed by you to CSEAP in a counseling session will be kept confidential as allowable by law.

What are your rights?

You have the right to:

  • Inspect or copy your protected health information (fees may apply), with certain exceptions, such as information collected for certain legal proceedings. Protected health information will be provided to you in the form of a summary, or CSEAP may provide an explanation of the protected health information, when you agree in advance to such summary or explanation. CSEAP may deny access under certain circumstances, and review may be available for such denials.
  • Request additions or corrections to your protected health information. CSEAP will consider your request but is not legally required to agree to it.
  • Request that CSEAP restricts how it uses or discloses your health information. CSEAP will consider your request but is not legally required to agree to it.
  • Request that CSEAP communicate with you about health matters in a manner that you feel is more confidential. For example, you can ask us not to call your home, but to communicate with you only by mail.
  • Receive an accounting of how CSEAP has disclosed your information for reasons other than disclosures requested by you.
  • Be notified following any breach of unsecured protected health information. CSEAP will notify you if your health information has been breached.
  • Obtain a paper copy of this notice upon request.

Changes to this notice:

From time to time, CSEAP may change its practices concerning how we use or disclose protected health information, or how we will implement patient rights concerning their information. We reserve the right to change this notice and to make the provisions in our new notice effective for all health information we maintain. If we change these practices, we will publish a revised notice of privacy practices. You can obtain a copy of our current notice at any time at any CSEAP facility, by requesting one from the CSEAP Compliance/Privacy Officer, or by visiting this website (cseap.colorado.gov) for any changes or updates.

To contact us:

Please contact CSEAP about any problems or concerns you have with your privacy rights or how CSEAP uses or discloses your health information. If you feel that your privacy rights have been violated or if you need more information, please contact the Privacy Officer at the following address:

Colorado Department of Personnel & Administration
Colorado State Employee Assistance Program
Attention: Privacy Officer
1525 Sherman Street
Denver, CO 80203

All complaints will be investigated and you will not be retaliated against in any way for filing a complaint. If you believe that your rights have been violated, you may also file a complaint with the Secretary of Health and Human Services in Washington D.C.

Updated on 8/29/2018

Amended: June 30, 2014, January 3, 2019