HIPAA Privacy and Confidentiality Policy

1. Purpose

To protect the privacy and security of protected health information (PHI) and confidential mental health records maintained or received by Aspen View Mental Health (“Aspen View”) in providing adult mental health intensive outpatient services in Colorado. This policy establishes minimum requirements for using, disclosing, accessing, safeguarding, and responding to requests involving patient information.

2. Scope

This policy is written for an adult outpatient/IOP program. Colorado BHA Chapter 11 in the supplied source is labeled proposed language and states that it applies to facilities designated under Title 27, Article 65 for involuntary treatment services. It is not treated here as an adopted rule or as automatically applicable to a voluntary adult IOP. If Aspen View holds or seeks a 27-65 designation, provides involuntary services, or has other applicable BHA endorsements or licenses, leadership must obtain a separate applicability review and add the requirements that apply.

3. Policy

Aspen View will maintain the privacy and security of PHI, use or disclose it only as permitted by applicable law and this policy, provide patients with required privacy information and rights, and follow the more protective requirement when federal and Colorado law differ. Access to PHI is limited to workforce members who need it to perform assigned duties. No workforce member may access, use, or disclose patient information out of curiosity, for personal reasons, or outside authorized duties.

4. Responsibilities

• Privacy and Security Officer: oversees privacy compliance; receives and coordinates privacy requests and complaints; assesses suspected impermissible uses or disclosures; coordinates breach analysis and notifications; maintains policy and training records; and escalates issues to leadership and counsel as needed.
• Program leadership: provides resources and enforces this policy; ensures vendor/business associate arrangements are in place; and supports corrective action.
• Workforce members: follow this policy, complete required training, verify identity and authority before releasing information, use approved systems, and promptly report suspected privacy or security incidents.
• Workforce members may not promise absolute confidentiality. They must explain applicable limits, including treatment coordination, payment, healthcare operations, legal reporting duties, and serious/imminent safety concerns.

5. Permitted Uses and Disclosures

Use or disclose only the minimum information reasonably necessary for the purpose, except where the minimum-necessary rule does not apply under HIPAA (including disclosures to or requests by a healthcare provider for treatment). When applicable, permitted uses and disclosures include:

• Treatment and care coordination with professionals involved in the patient’s care, consistent with HIPAA and Colorado mental health confidentiality law.
• Payment and healthcare operations, including billing, utilization review, quality assurance, supervision, compliance, and care administration, to the extent permitted by law.
• Services performed by business associates (such as billing, electronic health record hosting, or IT support) only under an appropriate written agreement requiring protection of PHI.
• Patient-authorized disclosures, after verifying the authorization is valid, within scope, and has not been revoked.
• Disclosures required or permitted by law, including appropriate public-health or abuse/neglect reporting, health oversight, certain law-enforcement requests, court processes, workers’ compensation, and other legally authorized purposes. Colorado mental health record protections and any applicable special federal protections must be evaluated before disclosure.
• Disclosures necessary to prevent or lessen a serious and imminent threat to health or safety, only as permitted by applicable law and Aspen View’s clinical/safety procedures.

If a request is not clearly authorized, do not disclose the information until the Privacy and Security Officer or designee has reviewed the request. A subpoena, attorney request, family request, or law-enforcement request does not automatically authorize release of the full record.

6. Colorado Mental Health Confidentiality

Mental health information and records are confidential under Colorado law. Before releasing mental health records, workforce members must identify the legal basis for disclosure and follow any applicable consent, authorization, court-order, or statutory requirements. HIPAA permission alone does not override a more protective Colorado requirement.

• Family members, friends, and other supports: do not confirm that a person is receiving services or disclose treatment details merely because someone identifies as a relative or support person. Obtain the patient’s permission or confirm another applicable legal basis. Document relevant permissions and disclosures.
• Safety and duty to protect: when a patient communicates a serious threat of imminent physical violence against a specific person or place, promptly notify the treating clinician/supervisor and follow the clinical risk and escalation procedure. Disclosures or protective steps, including contacting law enforcement or the threatened person, must be made when required or permitted by applicable Colorado law and documented.
• Adult program: this policy is for adults. Minor-consent provisions in the supplied notice and Chapter 11 are not included as routine IOP procedures. If Aspen View treats a minor, use a separate approved procedure addressing Colorado minor consent, parental access, and applicable law.
• Psychotherapy notes: separately maintained notes that meet HIPAA’s definition of psychotherapy notes receive special protection. Keep them separate from the ordinary clinical record and obtain a valid written authorization before use or disclosure unless a specific legal exception applies. Ordinary progress notes and the clinical record are not automatically psychotherapy notes.

7. Specially Protected Substance Use Disorder Records

This policy does not assume that Aspen View is a federally assisted substance use disorder program subject to 42 CFR Part 2. If Aspen View is a Part 2 program or receives records protected by Part 2, staff must follow the applicable Part 2 consent, redisclosure, and use restrictions, including restrictions on use in legal proceedings. The Privacy and Security Officer must confirm applicability and implement a Part 2 addendum before handling such records. Do not rely on this general policy alone for Part 2 records.

8. Patient Privacy Rights and Requests

Route requests to the Privacy and Security Officer or trained designee. Verify identity and, where applicable, legal authority before acting. Document the request, review, response, and any denial.

• Access/copy: process requests for access to PHI within HIPAA’s required timeframes (generally 30 calendar days, subject to a permitted extension with written notice). Apply any lawful denial and review procedures.
• Amendment: respond to requests to amend records within HIPAA’s required timeframe (generally 60 calendar days, subject to a permitted extension with written notice). If denied, provide the required written explanation and explain the patient’s right to submit a statement of disagreement.
• Accounting of disclosures: process requests for an accounting for the applicable period, generally up to six years, subject to exclusions and HIPAA requirements.
• Restrictions: consider requests to restrict use or disclosure. Agree when required by HIPAA, including qualifying requests not to disclose to a health plan information about a service paid in full out of pocket, unless disclosure is otherwise required by law.
• Confidential communications: accommodate reasonable requests to communicate by an alternative method or at an alternative location as required by law.
• Authorization: explain that a patient may revoke an authorization in writing, except to the extent action has already been taken in reliance on it.
• Notice: provide the current Notice of Privacy Practices as required, make it available on request, and document receipt or the required good-faith effort to obtain acknowledgment.

9. Safeguards and Workforce Conduct

• Use unique user accounts, strong authentication, role-based access, and approved devices and systems. Do not share passwords or leave records or screens accessible to unauthorized persons.
• Discuss patient information only in private settings and only with persons who have a legitimate role or lawful basis to receive it. Verify recipient identity and destination before sending information.
• Use approved secure methods for electronic transmission. Check email addresses, fax numbers, attachments, and recipients before sending. Do not send PHI through personal email, personal messaging, or unapproved storage.
• Keep paper records secured; retrieve printouts promptly; dispose of PHI using approved secure destruction methods; and protect records from loss, theft, and casual viewing.
• Do not photograph, record, post, or discuss patients on social media or personal devices unless expressly authorized under an approved process and permitted by law.
• Use de-identified information when feasible for training, presentations, and quality improvement. Follow applicable authorization or waiver requirements when identifiable information is needed.

10. Business Associates and External Services

Before a vendor or other service provider creates, receives, maintains, or transmits PHI on Aspen View’s behalf, leadership or its designee must determine whether a business associate agreement is required and ensure it is executed before access is granted. Contracts must require appropriate privacy and security protections. Access must be limited to the service being provided.

11. Suspected Privacy or Security Incident

All workforce members must report a suspected loss, misdirection, unauthorized access, use, disclosure, alteration, or destruction of PHI immediately to the Privacy and Security Officer or designated supervisor. Do not delay reporting while trying to determine whether a breach occurred.

• Take reasonable steps to contain the incident without destroying evidence; preserve relevant emails, logs, documents, and devices; and do not independently contact affected patients or outside parties unless instructed.
• The Privacy and Security Officer will document the facts, assess whether the event is a breach under applicable law, determine the scope and risk, involve leadership/counsel and relevant vendors as needed, and ensure required notifications are made within applicable deadlines.
• Maintain an incident record, including the event, affected information and individuals where known, mitigation, risk assessment, decisions, notices, and corrective actions.
• Retaliation against a person who reports a concern in good faith is prohibited.

12. Training, Enforcement, and Documentation

Workforce members must receive privacy and security training at onboarding and when material changes to duties, systems, or policy require it. Training completion must be documented. Violations may result in corrective action up to and including termination of employment or contract, subject to applicable law and organizational procedures. Aspen View will retain policy, training, authorization, request, disclosure, incident, and other compliance documentation for the period required by applicable law and its approved retention schedule.

13. Complaints and Non-Retaliation

Patients may submit privacy complaints to the Privacy and Security Officer without fear of retaliation. Aspen View will document and review complaints, take corrective action where appropriate, and provide information about filing a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. No patient or workforce member will be intimidated, threatened, coerced, discriminated against, or retaliated against for exercising privacy rights or making a good-faith complaint.

14. Notice of Privacy Practices and Conditional Items

This internal policy does not replace Aspen View’s patient-facing Notice of Privacy Practices (NPP). The NPP must be separately finalized, made available, and acknowledged as required. Before approval, the Privacy and Security Officer must confirm whether Aspen View:

• Participates in a health information exchange (such as Contexture); include an HIE-specific statement only if participation and the applicable opt-out process are confirmed.
• Is a Part 2 program or receives Part 2 records; add and implement the required Part 2 language and procedures if applicable.
• Conducts fundraising or other optional activities described in the draft NPP; remove unused optional language.
• Bills Medicaid or Medicare and therefore needs any applicable nondiscrimination notice/taglines or other program-specific materials.