Privacy Policy

Policy Specifying the Maintaining of Privacy

Policy Statement:

Family Services of NW PA provides high quality, ethical, and professionally delivered services to clients seeking the assistance of the agency. Through their involvement with the agency, clients provide Protected Health Information to Family Services' employees such as phone numbers, addresses, family details, gender, ethnicity, race, language, income, religion, communication needs, other services received, insurance information, etc., as well as all service related information in the form of diagnoses, progress notes, treatment plans, crisis plans, signatures, etc.; this information is collected to be able to speak or meet with the client, to aid in service delivery, and to clients have a right to privacy and to feel confident that their information, regardless of the form (paper, electronic, telephonic, SMS messaging, etc.), will be protected by agency employees. Employees are trained and instructed on confidentiality, privacy, and security of client information and how that information can or cannot be shared according to law. They are equally informed that no personal information can be sent via SMS text messaging using personal phones; the expectation is to use the secure SMS site through Office@Hand. Additionally, Family Services, as a matter of policy, does not disclose 3^rd party information to clients or providers, requesting that this information be obtained directly from the creator of the documentation. Similarly, no client data for which the client opted in will be sent to 3^rd party vendors and SMS consent is not shared with third parties or affiliates for marketing purposes.

Family Services of NW PA, therefore, maintains the highest standards of confidentiality and employees are expected to maintain the privacy of client information, and limit how it is used and provided to others as defined minimally by the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act, or more stringently when other regulation or requirement must be adhered to (e.g., Act 32 of 2022 of the PA Mental Health Procedures Act, Act 33 of 2022 [SUD Confidentiality Standards under DDAP]). As a result of the various Acts and standards, no client  information can be shared by agency employees without written consent from the client.

Definitions:

1. Privacy Rule – A rule that has a defined set of standards used to assure that individuals' health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well-being. The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing.
2. Health Insurance Portability and Accountability Act of 1996 (HIPAA) – HIPAA is United States legislation that provides data privacy and security provisions for safeguarding medical information.
3. Telephone Consumer Protection Act (TCPA) - This federal law requires businesses to get written consent from consumers before sending text messages. The TCPA also prohibits sending messages outside of quiet hours and requires businesses to provide instructions for opting out.
4. CAN-SPAM Act - This act applies to text messages and protects consumers from unsolicited marketing messages. It provides guidelines for sender identification and opt-out options.
5. Act 32 of 2022 of the PA Mental Health Procedures Act - aligns with federal health privacy standards to permit providers, facilities, and health plans to share patient mental health and substance use disorder-related information more easily.
6. Act 33 of 2022 - a Pennsylvania law that amends the confidentiality of substance use disorder (SUD) patient records. The law took effect on July 7, 2022 and makes Pennsylvania's SUD confidentiality requirements consistent with federal law.

Procedures including SMS Terms and Conditions:

1. Client records are kept in a secure, encrypted, password protected electronic health record system. Any remaining hard copy files for programs not yet in the electronic record are kept in locked cabinets behind locked doors.
2. Access to client records is limited to the assigned employees/employees of the program department and supervisor/director as well as the Privacy Officer, Compliance Officer, and billing department, and auditors when necessary.
3. The Privacy Officer provides direct oversite of the release of project/program records, ensuring proper consent and authorization exist via a valid Consent for the Release of Information. The Privacy Officer ensures valid releases contain the following:
   1. Name of the person, agency or organization to whom disclosure is made.
   2. Specific information disclosed.
   3. Purpose of disclosure.
   4. Dated signature of client (or guardian as provided for under 42 CFR 2.14(a) and (b) and 2.15 (relating to minor patients; and incompetent and deceased patients).
   5. Dated signature of witness.
   6. Date, event or condition upon which the consent will expire.
4. A copy of all client Consents for the Release of Information are offered to the client; completed releases are maintained in the client record.
5. Only those records identified in the established Designated Record Set defined by programmatic regulations and applicable laws are released.
6. When consent for releasing information is not required by regulations or law, program staff must fully document the disclosure in the client record and inform the client, as readily as possible, that the information was disclosed, for what purposes and to whom
7. Clients must also be informed of information that third party service providers use including mobile phone numbers when sending text messages, the text messages that are sent to other users of the third party service, any user or screen name that is selected in connection with the third party service, as well as any comments or feedback regarding the third party service that clients send to the agency. Each message that clients send through the third party service (either to the agency or to other users of the third party service) is stored on Family Services' servers. No mobile opt-in client data will be shared with third parties.
8. Family Services will not rent or sell client's Personal information to other companies or individuals, unless consent has been obtained. The agency may use or disclose such information in any of the following limited circumstances:
   1. Consent has been obtained
   2. Family Services needs to enforce the Terms of Service.
9. Family Services takes precautions to ensure the security of client Personal Information, including ensuring that our third party service providers protect the security of client Personal Information. However, the agency cannot guarantee that hackers or unauthorized personnel will not gain access to client Personal Information despite the agency's Clients must be aware that in using the third party service, their information will travel through third party infrastructures which are not under the agency's control (such as a third party SMS delivery platform or the client's carrier network).
10. Family Services cannot protect any information that clients transmit to other users. Clients should never transmit personal or identifying information to other users
11. Clients are informed of the types of SMS messages they may receive by Family Services including appointment reminders, order alerts, account notifications, etc. They are also informed that messaging frequency may vary, and that message and data rates may apply. Clients can opt in as a mobile user by:
    1. Entering a phone number online,
    2. Sending a Mobile Originating (MO) message containing an advertising keyword,
    3. Filling out a paper form that includes their phone number, or
    4. Signing up at a point-of-sale location.
12. Clients can also opt out, at any time, when receiving message by texting "STOP" or "QUIT" to 61364.
13. Clients may seek assistance, if needed, by texting HELP or by visiting Family Services website at FSNWPA.org.
14. Clients may also visit https://www.fsnwpa.org/privacy-policy to view the privacy policy as well as the terms and conditions.
15. Family Services reserves the right to send clients certain communications relating to the third party service, such as announcements and administrative messages, without offering the opportunity to opt out of receiving them.

Any action found in violation of this policy and established procedures shall be subject to the agency's established disciplinary process.