BSCS’ Notice of Privacy Practices

This Notice describes how your health information may be used and disclosed and how you can get access to this information. We ask that you review it carefully. We also have posted HIPAA information in our waiting room for you to review. This notice also describes your rights regarding your health information. If you have any questions or would like to discuss this information, please contact our Compliance Officer at 617-471-8400 x600.

What is HIPAA?

HIPAA stands for The Health Insurance Portability and Accountability Act. This is federal legislation enacted in 1996. The implementation date for privacy and security was April 14, 2003.

What is PHI?

Protected Health Information (PHI) is health information (including identifying information about you) that we have collected from you or received from your health care providers, health plan, your employer or a health care clearinghouse. It may include information about your past, present, or future physical, behavioral health or substance use disorders condition.

Why are privacy and confidentiality important?

You have the right to control who will see your personal health information (PHI). This means that communication about you involving your health information must be private and limited to those who need to know the information in order to provide treatment, payment, and health care operations. Such communication may involve verbal discussions, written communication or electronic communications. Only those people with an authorized need to know will have access to the protected information. In addition to HIPAA requirements, BSCS also protects your PHI based on federal confidentiality regulations, 42 C.F.R. Part 2, which are the federal protections for individuals in substance use disorders services.

BSCS is required by law to maintain the privacy of your health information and to provide you with this notice of our legal duties and privacy practices with respect to your health information. We also are required to comply with the terms of our current NOTICE OF PRIVACY PRACTICES.

What are situations that your information will be released?

If You Provide Us with A Written Release of Information/Consent

You have the right to revoke your authorization, at which time we will not make any further disclosures of your health information under that authorization. An exception to this rule would be if we had already communicated information, prior to the revocation of the release. BSCS reserves the right to inform other providers when a release has been revoked.

Internal Communications

Communication among staff that provides care is appropriate. Supervision, treatment planning and case consultations are essential to providing quality care and sharing of PHI is appropriate under these conditions.

Health Care Options

In order to ensure that persons served receive quality care, there are some job responsibilities which require the release of PHI. These tasks include quality assurance, licensing accreditation, student training and general administrative activities.


We will ask you to complete a fee agreement which gives us authorization to bill your health insurance. We will be required to disclose your health information to enable your health plan to take certain actions before approving your services.

By way of example, some of these actions may include:

  • Determining eligibility or coverage for health insurance;
  • Determining if the services are medically necessary;
  • Determining if the services are appropriately authorized or certified in advance of your care;
  • Ensuring the appropriateness of your care or justifying the charges for your care (utilization review).


A medical or psychiatric emergency would be a situation that poses an immediate threat to your health and requires immediate medical intervention. Any information provided may only be given to those who need to know to provide emergency interventions (paramedics, emergency room staff, etc.). If you have provided us with an emergency contact person, we will notify that person of your location.

Public Health Activities

We may disclose health information about you as necessary for public health activities including, by way of example, disclosures to:

  • Clear and present danger of harming yourself or an identifiable victim;
  • Report to public health authorities for the purpose of preventing or controlling disease, injury or disability;
  • Report vital events such as birth or death;
  • Conduct public health surveillance or investigations;
  • Report child abuse or neglect;
  • Report certain events to the Food and Drug Administration (FDA) by a person subject to jurisdiction of the FDA including information about defective products or problems with medications;
  • Notify consumers about FDA-initiated product recalls;
  • Notify a person who may have been exposed to a communicable disease or who is at risk of contracting or spreading a disease or condition;
  • Notify the appropriate government agency if we believe an adult has been a victim of abuse, neglect or domestic violence.

Legal Proceedings

BSCS will not release information based on a court subpoena unless you want us to. Under some circumstances, a court order may override a person’s request not to release confidential information. In addition, BSCS reserves the right to defend itself in a malpractice case.

Note: Your clinician’s credentials and license status impacts our ability to respond to court requests. Please speak with your clinician, if you have any questions or concerns.

Crime Against the Program/Against Program Personnel

BSCS reserves the right to use information to protect programs and staff.

Research/Audit and Evaluation

Oversight agencies include government agencies that oversee the health care systems, government benefits programs such as Medicare or Medicaid, and other government programs regulating health care. BSCS only conducts research that does not require release of PHI.

Mandated Reporting

BSCS staff members are mandated reporters and therefore must abide by state requirements to report abuse of children, elders and disabled people.

Qualified Service Organizations

BSCS contracts with other businesses to provide specialized services. These vendors must sign a confidentiality agreement.

To Avert Serious Threat to Health and Safety

BSCS may disclose PHI to maintain public safety. For example: Duty to warn identifiable victim(s) of a dangerous threat made against them.


  1. PHI is not disclosed in any fundraising, marketing or sales activities.
  2. Names of persons served are not listed in a Facility Directory. BSCS does not maintain a patient facility directory.
  3. BSCS will not disclose PHI without authorization for any reason not described in this Notice of Privacy.

What are my rights regarding my health information?

  • You have the right to inspect and receive copies of your PHI. You must sign an authorization form and submit your request to our Compliance Officer subject to federal and state laws (fees may apply).
  • You have the right to request us to amend your health information. This request should be placed in writing and submitted to the Program Director. We may deny your request if:
    • The information was not created by BSCS;
    • The information is not part of deciding your care;
    • The information is not part of the health information you are permitted to inspect; or
    • The information in the record is accurate and complete.
  • If we deny your request to amend, we will send you a written notice stating the basis for the denial, and offering you the opportunity to provide a written statement of disagreement. You may ask that your request for amendment and our denial notice be attached to all future disclosures of the health information that is the subject of your request.
  • If you choose to submit a written statement of disagreement, we have the right to prepare a written rebuttal to your statement of disagreement. In this case, we will attach your written statement of disagreement and our rebuttal, as well as your original request and our denial, to all future disclosures of the health information that is the subject of your request.
  • You have the right to request that we provide you with an accounting (list) of disclosures that we have made of your health information, other than those disclosures that we have made for the purpose of securing treatment payments and/or health care operations with a signed authorization.
  • You have a right to request a restriction on the health information that we use or disclose about your treatment, payment, or health care operation. You also may ask that any part (or all) of your health information not be disclosed to family members or friends who may be involved in your care.
  • You have the right to request that information about services, for which you have paid out-of-pocket, are not disclosed to a health care plan or insurance provider.
  • You have the right to be notified if your PHI has been accessed by an unauthorized entity. The unauthorized disclosure of PHI is called a Breach of Information. BSCS will notify you as required by state and federal laws of any breaches of your PHI.

Access to Your Record

You have a right to review your record in order to ensure that all information is clearly understood. Arrangements will be made to review your record with your clinician or clinic administrator. If you would like a copy of your record, a request must be made in writing. Records will be reproduced within 10 days. BSCS reserves the right to review the record with you in order to explain clinical information.

What if I have a concern or complaint?

If you have any concerns or complaints regarding the protection of your PHI, you may contact BSCS’ Compliance Officer directly and/or the Secretary of Health and Human Services. Individuals will not be retaliated against for filing complaints. BSCS’ Compliance Officer may be reached at 617-471-8400 x600; or via our Contact Form; or via mail: Attn: Compliance Officer, Bay State Community Services, 1120 Hancock Street, Quincy, MA 02169.

Changes to this Notice

We reserve the right to change the terms of our Notice of Privacy Practices. We also reserve the right to make the revised or changed Notice of Privacy Practices effective for all health information we already have about you as well as any health information we receive in the future.

We will post a copy of the current Notice of Privacy Practices at our main office and at each site where we provide care, as well as on our website. You may also obtain a copy of the current Notice of Privacy Practices by calling us at 617-471-8400 x600 and requesting that a copy be sent to you in the mail or by asking for one any time you are at our offices.