Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Contents
1. Our responsibilities
FirstLight Mental Health is required by law to maintain the privacy and security of your protected health information ("PHI"), to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.
We are required to notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
2. How we may use and disclose your information
We may use and disclose your PHI without your written authorization for the following purposes:
Treatment
To provide, coordinate, and manage your care. For example, with your knowledge we may share relevant information with your therapist, your primary care clinician, your child's school team, or a pharmacy filling your prescription.
Payment
To obtain payment for services. Because FirstLight is a private-pay practice, this is limited. If you request a superbill to submit to your insurer, the diagnosis and procedure codes on it will be disclosed to your insurance company by you.
Health care operations
For quality assessment, clinical review, business planning, and administration of the practice.
As required or permitted by law
- Suspected abuse or neglect. Michigan law requires clinicians to report suspected abuse or neglect of a child, or of a vulnerable or older adult, to the appropriate authorities.
- Serious threat to health or safety. If you communicate a serious threat of physical violence against a reasonably identifiable person, we may be required to take protective action, which can include notifying the potential victim and law enforcement.
- Judicial and administrative proceedings. In response to a court order, subpoena, or other lawful process, subject to the additional protections that apply to mental health records.
- Public health and safety activities, health oversight, coroners and medical examiners, and workers' compensation, where required by law.
- Controlled substance monitoring. Prescriptions for controlled substances are reported to the Michigan Automated Prescription System (MAPS), as required by Michigan law.
Business associates
Some functions are performed on our behalf by vendors — our electronic health record, secure messaging, telehealth platform, and payment processor. Each is required by a written Business Associate Agreement to protect your information to the same standard we do.
3. Uses that require your written authorization
The following always require your signed authorization, which you may revoke in writing at any time (except to the extent we have already acted on it):
- Most uses and disclosures of psychotherapy notes
- Any use or disclosure for marketing purposes
- Any sale of your protected health information
- Most other uses and disclosures not described in this notice
We do not sell patient information. We do not use patient information for marketing. We do not use identifiable patient information to train artificial-intelligence systems.
4. Psychotherapy notes
Psychotherapy notes are the clinician's private notes about the contents of a counseling session, kept separately from the rest of your record. They receive heightened protection under HIPAA and generally cannot be disclosed without your specific written authorization, even to an insurer.
5. Your rights
Right to inspect and copy
You may inspect and obtain a copy of your record, in electronic form if you prefer. We will respond within 30 days. There is no charge for a standard records request.
Right to request an amendment
If you believe information in your record is incorrect or incomplete, you may ask us to amend it. We may deny the request in certain circumstances, and if we do we will explain why in writing and you may submit a statement of disagreement to be kept with your record.
Right to an accounting of disclosures
You may request a list of certain disclosures we have made of your information, other than those for treatment, payment, or health care operations.
Right to request restrictions
You may ask us to limit how we use or disclose your information. We are not required to agree, except in one case: if you pay for a service in full out of pocket, you may require us not to disclose information about that service to a health plan. Because FirstLight is a private-pay practice, this protection applies broadly to your care here.
Right to confidential communications
You may ask us to contact you in a particular way — a specific phone number, no voicemail, a particular email address, or mail to an alternate location. We will accommodate reasonable requests without asking why.
Right to a paper copy of this notice
You may request a paper copy at any time, even if you agreed to receive it electronically.
Right to be notified of a breach
You will be notified if a breach occurs that may have compromised the privacy or security of your information.
6. Complaints
If you believe your privacy rights have been violated, you may complain to us using the contact information below, or to the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights.
You may file a complaint with OCR at hhs.gov/ocr/complaints, or by mail at 200 Independence Avenue SW, Washington, D.C. 20201.
You will not be retaliated against for filing a complaint. It will not affect your care here in any way.
7. Changes to this notice
We may change this notice, and the changes will apply to information we already hold as well as information we receive in the future. The current notice will always be posted on this page with its effective date, and copies are available at our office.
8. Contact
Privacy Officer
FirstLight Mental Health
Ann Arbor, Michigan
privacy@firstlightmentalhealth.com