This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. If you have any questions about this notice, please contact our Privacy Officer at (802) 524-6554.
WHO WILL FOLLOW THIS NOTCE
This notice describes our practices and that of:
- Any health care professional authorized to enter information into your health record.
- All divisions and programs of the Agency.
- Any volunteer we allow to help you while you are receiving services from the Agency.
- All employees, staff and other personnel.
- All Agency entities, sites and locations follow the terms of this notice. Staff members at these entities,
sites and locations may share health information with each other for treatment, payment or
operations purposes as described in this notice.
OUR PLEDGE REGARDING HEALTH INFORMATION
We understand that health information about you and your health is personal. We are committed to protecting your privacy and health information about you. We create a record of the care and services you receive at the Agency. We need this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all of the records of your care generated by the Agency, whether made by Agency personnel or your personal doctor. Your personal doctor may have different policies or notices regarding the doctor’s use and disclosure of your health information created in the doctor’s office or clinic.
This notice will tell you about the ways in which we may use and disclose health information about you. We also describe your rights and certain obligations we have regarding the use and disclosure of health information.
We are required by law to:
- Make sure that health information that identifies you is kept private;
- Give you this notice of our legal duties and privacy practices with respect to health information about
you; - Follow the terms of the notice that is currently in effect;
- Notify you following a breach of unsecured protected health information; and
- Comply with any state law that is more stringent or provides you greater rights than this Notice.
HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU
You have the right to authorize our program to use and disclose your substance use disorder treatment records for purposes of your treatment, payment, and health care operations, consistent with HIPAA. Once you give this consent, these records can be shared with your treating providers, health plans, third-party payers, and those helping to operate this program, and may be disclosed further as permitted by HIPAA rules.
If you give us permission to share your substance-use disorder treatment records for your care, payment, or health care operations, any provider or health plan who receives your records does not have to keep them separate from your other health information. They do not have to keep these records separate. Your substance use disorder information can be part of your regular medical record.
Your substance-use disorder treatment records cannot be used or disclosed in legal proceedings against you without your written consent or a specific court order. You may revoke your consent at any time in writing, but this will not apply to disclosures already made in reliance on your consent.
The following categories describe different ways that we use and disclose health information. For each category of uses or disclosures we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed.
For Treatment.
We may use or disclose health information about you to provide you with treatment or services. This includes the potential sharing of information about you to doctors, nurses, clinicians, case managers, interns or other Agency personnel, or to providers outside of the Agency who are involved in your care such as your PCP, dentist, etc. For example, a clinician might be treating you for a mental health or substance use problem and need to talk with one of our psychiatrists, or another clinician, who has specialized training in a particular area of care. We may also disclose information about you to people outside the Agency who are involved in your health care.
Electronic Exchange of Your Health Information-In some instances, we may transfer health information about you electronically to other health care providers who are providing you treatment or to the insurance plan providing payment for your treatment. Your health information may also be made available through the Vermont Health Information Exchange (“VHIE”). The VHIE is a state-designated health information network operated by Vermont Information Technology Leaders, Inc. (“VITL”). Your treating health care providers may access your health information through the VHIE, unless you have chosen to opt out of the VHIE and you are not in need of emergency treatment. For information about the VHIE, see www.vitl.net.
For Payment.
We may use and disclose health information about you so that the treatment and services you receive at the Agency may be approved by, billed to, and payment collected from a third party such as an insurance company. For example, we may need to give your health plan information about counseling you received at the Agency so your health plan will pay us or reimburse you for a counseling session. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the service / treatment. We will ask you to sign a consent form to allow us to bill your insurance company for substance use disorder treatment provided.
For Health Care Operations.
We may use and disclose health information about you for Agency operations. These uses and disclosures are necessary to run the Agency and make sure that all individuals receiving services from us receive quality care. For example, we may use health information to review our treatment and services and to evaluate the performance of our staff in serving you. We may also combine health information about many clients to decide what additional services we should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to doctors, nurses, clinicians, case managers, interns and other Northwestern Counseling & Support Services (NCSS) personnel for review and learning purposes.
We may also combine the health information we have with health information from other designated mental health or special services agencies to compare how we are doing and see where we can make improvements in the services we offer. We will remove information that identifies you from this set of health information so others may use it to study health care and health care delivery without learning who the specific clients are. To facilitate this review, we provide information to a data repository operated under a Business Associate Agreement with Vermont Care Network to protect the confidentiality of the information.
Northwestern Counseling & Support Services (NCSS) is a provider organization that contracts with the State of Vermont to be responsible to deliver services that may include community mental health services, developmental disability services, and some substance use disorder services and is obligated under our contracts with various departments within the Vermont Agency of Human Services (“AHS”) to provide such services. As a result, these Departments may access health information related to these contracted services for the purpose of obtaining treatment for clients, making payment or for their health care operations. Additionally, we may provide health information to AHS for non-state funded clients pursuant to an Agreement limiting its use to an extract of demographic, non-health care information for AHS health care operations and health oversight purposes.
Use of Artificial Intelligence.
Our program may use artificial intelligence (AI) technologies to help analyze and manage your health information to improve your care and program operations. When AI tools access your health information, we ensure they only access what is necessary for the task at hand, and that all privacy and security protections required by law are followed.
AI helps us detect patterns, improve clinical decision-making, and assist with administrative tasks. However, AI does not replace the judgment or decision-making of your healthcare provider. All final decisions are made by your provider based on their professional expertise.
The use of AI is strictly controlled, and your information remains confidential in accordance with HIPAA and other applicable laws.
If you have questions about how AI is used in your care, or about how it impacts your privacy, please contact the Agency’s Privacy Officer at 802-524-6554.
Appointment Reminders.
We may use and disclose information to contact you as a reminder that you have an appointment.
Alternative Treatment and Benefits and Services.
We may use and disclose information about you to obtain and recommend to you other treatment options and available services as well as other health-related benefits or services.
Fundraising Activities.
Should the need arise where information about you or where your participation is desired for the Agency’s fundraising activities, the Agency would obtain your authorization. No information would be released for this purpose without your written authorization.
Research.
Under extremely limited circumstances, we may use and disclose health information for research purposes. For example, a research project may involve comparing the health and recovery of all clients who received one medication to those who received another, for the same condition. All research projects are subject to a special approval process. This process evaluates a proposed research project and its use of health information, trying to balance the research needs with client’s need for privacy of their health information. Before we use or disclose health information for research, the project will have been approved through this research approval process. We may, however, disclose health information about you to people preparing to conduct a research project; for example, to help them look for clients with specific health needs, so long as the health information they review does not leave the Agency. We will always ask for your specific permission if the researcher will have access to your name, address or other information that reveals who you are, or will be involved in your care at the Agency.
As Required by Law.
We will disclose health information about you when required to do so by federal, state or local law. In Vermont, this would include victims of child abuse; the abuse, neglect or exploitation of vulnerable adults; or where a child under the age of sixteen is a victim of a crime; and firearm-related injuries. Under certain circumstances, the Departments within the Vermont Agency of Human Services who we contract with are mandated to access health information in order to carry out their responsibilities. We are required to disclose your health information to you and to anyone you request by written authorization to receive it.
To Avert a Serious and Imminent Threat to Health or Safety.
We may use and disclose health information about you when necessary to prevent a serious and imminent threat to your health and safety or a serious risk of danger to an identifiable person or group of persons. Any disclosure, however, would only be to someone reasonably believed to be able to help prevent the threat.
SPECIAL SITUATIONS
Military and Veterans.
If you are a member of the armed forces, we may release health information about you as required by military command authorities.
Workers’ Compensation.
We may release health information about you as authorized for workers’ compensation or similar programs as authorized by Vermont law. These programs provide benefits for work-related injuries or illnesses.
Public Health Risks.
We may disclose health information about you for public health activities. These activities generally include the following:
- To prevent or control disease, injury or disability;
- To report deaths;
- To report child abuse or neglect;
- To report abuse, neglect or exploitation of vulnerable adults; any suspicion of abuse, neglect, or
exploitation of the elderly (age 60 or older), or a disabled adult with a diagnosed physical or mental impairment, must be reported; - To report reactions to medications or problems with products;
- To notify individuals of recalls of products they may be using;
- To notify an individual who may have been exposed to a disease or may be at risk for contracting or
spreading a communicable disease or condition
Health Oversight Activities.
We may disclose health information to a health oversight agency, such as the Vermont Agency of Human Services Departments of Mental Health, Disabilities, Aging and Independent Living, and Health who we contract with, for activities authorized by law. These oversight activities include, but are not limited to, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws. We may disclose health information about you without your permission to the Secretary of the U.S. Department of Health and Human Services and/or Office of Civil Rights when they are conducting a compliance review, investigation or enforcement action or for a mandatory report of a health information breach.
Law Enforcement.
We may disclose your health information to law enforcement officials as required by law or to comply with a court order or search warrant. We may also disclose limited information to law enforcement officials to report a crime committed on our premises or for identifying a missing person or a suspect to assist in a criminal investigation.
Legal Proceedings and Disputes.
If you are involved in a lawsuit or a dispute, we may disclose health information about you in response to a court or administrative order. In certain legal proceedings, there are specific procedures that we are required to follow before substance use treatment records may be disclosed.
Public Health Officials and Funeral Home Directors.
We may release information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release health information to funeral directors thereby permitting them to carry out their duties.
Individuals in Custody.
If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release health information about you to the correctional institution or law enforcement official pertaining to care provided while you are in custody. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
Reproductive and Gender-Affirming Health Care.
Health records related to reproductive and gender-affirming health care are protected by state confidentiality and shield law provisions.
“Reproductive health care services” means all supplies, care, and services of a medical, behavioral health, mental health, surgical, psychiatric, therapeutic, diagnostic, preventative, rehabilitative, or supportive nature, including medication, relating to pregnancy, contraception, assisted reproduction, pregnancy loss management, or the termination of a pregnancy.
“Gender-affirming health care services” means all supplies, care, and services of a medical, behavioral health, mental health, surgical, psychiatric, therapeutic, diagnostic, preventative, rehabilitative, or supportive nature, including medication, relating to the treatment of gender dysphoria and gender incongruence.
We will not disclose such records for use in any civil, criminal, probate, administrative, or legislative proceeding, nor in response to requests from out-of-state entities—including subpoenas or court orders—unless the disclosure is (1) authorized by you; (2) required by Vermont or federal law; or (3) compelled by a Vermont court order that includes a finding of good cause. Before records may be disclosed under a court order, the court must expressly find on the evidentiary record that good cause exists and specify the records to be disclosed. The only other exceptions being disclosure to Vermont’s Board of Medical Practice or Office of Professional Regulation in connection with bona fide investigations and disclosures to The Vermont Department of Health or the Vermont Department of Disabilities, Aging, and Independent Living in connection with a bona fide investigation of a Vermont licensed health care facility.
USES OF HEALTH INFORMATION REQUIRING WRITTEN AUTHORIZATION
Other uses and disclosures of health information not covered by this notice or the laws that apply to us will be made only with your written authorization. Examples of this may include substance use treatment information disclosures to lawyers (except this Agency’s own lawyers), employers, the Vermont Office of Disability Determination Services or others who you know, but who are not involved in your care. Additionally, uses and disclosures of protected health information for our marketing purposes and disclosures that constitute a sale of protected health information require authorization. Also, Psychotherapy notes maintained by your treating provider can only be disclosed with your written authorization. If you provide us permission to use or disclose health information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the services that we provided to you. You understand that protected health information that is disclosed may be redisclosed in a way that is no longer protected by HIPAA.
Community Health Teams (“CHT”).
These teams were created under the Vermont Blueprint for Health and are designed to create alliances between healthcare providers, local and state agencies and community support organizations who are committed to improving quality of life through coordination of services. These services may be financial, physical, emotional or educational in nature. Your treating health care providers may only share your health information with a CHT if you have provided specific written consent for sharing.
YOUR RIGHTS REGARDING INFORMATION ABOUT YOU
Any assistance (physical, communicative, etc.) you need to exercise your rights will be provided to you by the Agency.
You have the following rights regarding information we maintain about you:
Right to Review and Copy.
You have the right to review and obtain a copy of health information that may be used to make decisions about your care. This may include both health and billing records. We are committed to responding to your requests for access to your health information as soon as possible and without unnecessary delay. Under HIPAA, we are required to provide access to your records within 30 days of your request. If your records are not readily available, we may extend this timeframe by up to 30 more days but will notify you in writing of the reason for the delay. You may also request that we send your records to another person or entity of your choosing.
To review or obtain a copy of health information, you must submit your request in writing. If you request a copy of the information, we may charge a reasonable, cost-based fee for copying, mailing, or supplies associated with your request. If you seek an electronic copy in a specific form or format of any portion of your health record, and we are unable to readily produce the copy in that form or format, we will work with
you to provide an alternative form or format for the electronic copy.
There are limited instances when we may deny your request to inspect or obtain a copy of your health information.
Right to Amend.
If you feel that health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Agency.
To request an amendment, your request must be made in writing and submitted to our Medical Records Department. In addition, you must provide a reason that supports your request.
We may deny your request for an amendment if it is not in writing or does not include a reason to support that request. In addition, we may deny your request if you ask us to amend information that:
- Was not created by us, unless the person or entity that created the information is no longer available
to make the amendment; - Is not part of the designated record set kept by or for the Agency;
- Is not part of the information which you would be permitted to inspect and copy; or,
- Was determined accurate or complete by the Agency.
Right to an Accounting of Disclosures.
You have the right to request an “accounting of disclosures.” This is a list of the disclosures we made of health information about you which were required by law and/or were not authorized by you. The list of disclosures will not include disclosures made for the purposes of treatment, payment for treatment services or health care operations related to the treatment services.
To request this list or accounting of disclosures, you must submit your request in writing to our Medical Records Department. Your request must state a time period, which may not be longer than six years. Your request should indicate in what form you want the list (for example, on paper, electronically). The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to Request Restrictions.
You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment or health care operations. We are not required to agree to your request unless your request is to limit disclosures to a health plan for the purpose of carrying out payment or health care operations that are not otherwise required by law and you or someone on your behalf other than your health plan has paid for those services in full at the time the health services are provided. However, if we do agree with a requested restriction or limitation, we will comply with your request unless the information is needed to provide you emergency treatment.
You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, like a family member. For example, you could ask that we not use or disclose information about a counseling session you received.
To request restrictions, you must make your request in writing to our Medical Records Department. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.
Right to Request Confidential Communications.
You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing to our Medical Records Department. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to a Paper Copy of This Notice.
You have the right to a paper copy of this notice. You may ask us to give you a copy of the current notice at any time. To obtain a paper copy of this notice, contact the Agency Privacy Officer at (802) 524-6554.
Security of Health Information.
We have in place appropriate safeguards to protect and secure the confidentiality of your health information. Due to the nature of community based human service practices, Agency representatives may possess your health information outside of the Agency. In these cases, Agency representatives will ensure the security and confidentiality of the information in a manner that meets Agency policy, State and Federal Law.
Changes to This Notice.
We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in all Agency facilities. The notice will contain an effective date. Should we make a material change to this notice, we will, prior to the change taking effect, publish an announcement of the change at every Agency facility.
Complaints.
If you believe your privacy rights have been violated, you may file a complaint with the Agency or with the Secretary of the Department of Health and Human Services. To file a complaint with the Agency, call (802) 524-6554 and ask to speak with our Privacy Officer. All complaints must be formally submitted either in writing or verbally with the agency’s privacy officer. You will not be penalized for filing a complaint.
The Secretary of the Department of Health and Human Services can be contacted through their regional office at Office of Civil Rights, U.S. Department of Health and Human Services, Government Center, J.F. Kennedy Federal Building – Room 1875, Boston, Massachusetts 02203, voice phone (800) 368 1019, fax (202) 619-3818, TDD (800) 537 7697, or email ocrmail@hhs.gov.
Effective Date: 2/16/2026
