This notice explains how client information is handled, how it can be reviewed, and how it is shared with other professionals and organizations. Lantern ABA, Inc. (“Lantern ABA”) is required by law to disclose this information related to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The California Medical Information Act (“CMIA”) also contains privacy-related requirements that Lantern ABA must comply with.
In most situations, information regarding services/treatment can only be released by providing a written authorization form that meets certain legal requirements imposed by state law or HIPAA. Clients who are 13-years or older must also sign the written authorization form.
Protected Health Information
When services are provided to the client by Lantern ABA, information is collected about the client’s educational functioning, family history, and physical, adaptive, emotional, or mental health. This may include information about the client’s past, present, or future health or condition, the treatment or services received, or payment for services rendered. This information is called Protected Health Information (“PHI”). The information obtained from the client is maintained in paper and/or electronic format in a secure location. PHI may include, but is not be limited to, the following:
Personal and educational history;
Reasons for treatment: problems, symptoms, needs, goals;
Diagnoses: medical terms for client presenting problems, symptoms, disabilities;
Treatment plan: services/interventions/accommodations for intervention;
Testing/interview notes;
Treatment or evaluation records from other providers/school;
Health history and medications;
Legal documentation and matters; and/or
Billing information.
This information is used for many purposes including, but not limited to:
Evaluation or treatment;
Reports and recommendations;
Communication with other health care professionals (current/past) providing treatment (e.g., primary care physician); and/or
Billing and services rendered documentation.
Although health records and documentation are the physical property collected by the treating health care practitioner at Lantern ABA, the information belongs to the client. The client can inspect, read, or review all records. Copies of records will be made available upon written request, and reasonable fees for the cost of copying and mailing may be charged. In some rare situations, you or the client may be prevented from seeing all of what is in the records. Records will not be released in circumstances where disclosure of the contents could reasonably be expected to be life threatening, endanger the safety of the client or another, or where disclosure could reasonably be expected to lead to identification of the person who provided confidential information.
Your rights
If you are the client’s parent, legal guardian, or other personal representative authorized by law, you may exercise the following rights on the client’s behalf. Some rights may be limited when required by law or when the client is legally authorized to control particular information. You and the client have the following rights regarding the PHI. To exercise any of these rights, please submit a request in writing to the Privacy Official identified at the end of this Notice. You and the client have the right to choose how you receive communications that include PHI.
1. Obtain a copy of records.
You may inspect or obtain an electronic or paper copy of medical and billing records. We generally respond within 30 days to your request for records. We may charge a reasonable, cost-based fee when permitted by law. We will provide a copy in the form and format
you request, if readily producible.
2. Request a correction or amendment.
If you believe that information we have about the client is incorrect or incomplete, you may request that we amend it. Your request must be in writing and must explain why the information should be amended. We may deny your request under limited circumstances permitted by law; if we do, we will provide you with a written explanation of the denial and your rights to respond.
3. Request confidential communications.
You have the right to request that we communicate with you about health matters in a specific way or at a specific location- for example, only by mail at a particular address or only by email. We will accommodate reasonable requests submitted in writing that include a mailing address where you can receive bills and related correspondence.
4. Ask us to limit use or sharing.
You have the right to request a restriction or limitation on the PHI we use or disclose for treatment, payment, or health care operations, or to a person who is involved in the client’s care or the payment for that care. We are not required to agree to your request, except that we must agree to a restriction on disclosures to a health plan when (a) the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law and (b) the PHI pertains solely to a health care item or service for which you, or a person other than the health plan on your behalf, has paid us in full out of pocket.
5. Receive an accounting of disclosures.
You may request a list of certain disclosures made during the six years before your request. The list does not include disclosures for treatment, payment, operations, disclosures made to you, or certain other disclosures excluded by law. One accounting in a 12-month period is provided without charge.
6. Receive this Notice.
You may request a paper or electronic copy of this Notice at any time.
7. Choose someone to act for you.
A legally authorized person may exercise privacy rights on the client’s behalf. We may ask for documentation of that authority.
8. File a complaint.
If you believe the client’s privacy rights have been violated, you may file a complaint with Lantern ABA by contacting the Privacy Official at the email address below. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, DC 20201, by calling 1-877-696-6775, or online at https://www.hhs.gov/ocr/ You and/or the client will not be retaliated against or penalized for filing a complaint.
9. Your choices.
For certain information, you may tell us your preferences about what we share. If you are unable to state a preference, we may share information when we reasonably believe it is in the client’s best interest and the law allows it.
10. Family members and others involved in care.
You may tell us whether we may share relevant information with family members, caregivers, or others involved in the client’s care or payment for care.
11. Disaster relief.
We may share limited information with a disaster-relief organization when legally permitted and necessary to assist with notification or safety.
12. Marketing and sale.
We will obtain written authorization before using medical information for marketing when authorization is required, and before selling medical information. Lantern ABA does not sell medical information.
13. Right to Be Notified of a Breach.
You have the right to be notified if there is a breach of unsecured PHI, in compliance with state and HIPAA breach-notification rules.
How We May Use and Disclose Information
In order to use the client’s PHI, written permission via an authorization form is required in most cases. If you or the client authorize use or disclosure of the client’s PHI, authorization can be revoked in writing at any time. Uses or disclosures made before a revocation of this authorization cannot be undone. Any information about the client that is shared with family members or personal contacts at your request will be limited to the information you choose to disclose.
In some circumstances, written authorization to use PHI is not needed. The following categories below describe the ways Lantern ABA may use and disclose PHI without an authorization. Not every use or disclosure within a category is listed, but every permitted use or disclosure will fall within one of these categories. When confidential information is read by the clinician or other clinicians for professional consultation (within office), it is called “use.” If the information is shared with or sent to others outside this office, it is called “disclosure.” Except in some special circumstances, when client PHI is used or disclosed to others, only necessary information will be shared for the intended purpose. The law gives you and the client rights to know about PHI, how it is used, and to have a say in how it is disclosed.
In almost all cases, the intent of sharing PHI in-office or with other people or organizations is to provide an evaluation for the client, arrange for payment for services, or conduct some other business activities called “health care operations.” Information about the client is needed in order to provide satisfactory care and evaluative services. Generally, disclosure of PHI is for three purposes: treatment/evaluation, obtaining payment, and health care operations.
1. Treatment.
We may use and share information to assess needs, develop and implement treatment, coordinate care, consult with other providers, and support continuity of services. Disclosure of the client’s PHI may be released to others who provide treatment to the client, including a physician. Occasionally it may be helpful to consult other medical and mental health professionals about a case. During consultation with a professional, who is not involved in the client’s treatment, every effort is made to avoid revealing the client’s identity. These professionals are legally bound to keep the information confidential. Consultations will not be disclosed, unless it is important to the work and all consultations will be noted in the client’s clinical record.
At times it may be necessary to refer the client to other professionals or consultants for services within a different scope of practice, such as special testing or treatments. In these cases, an exchange of information will be completed in order to share information about the client’s conditions, as well as receive their findings and recommendations. This will be recorded in the clinical record and can be shared (with consent) with potential future medical and/or mental health professions.
2. Payment.
Lantern ABA is a private-pay practice and does not bill insurance directly. We use information to collect payment and maintain billing records. At your request, we may provide invoices, superbills, or other documentation that you may submit to an insurer. Other disclosures for payment will be made only as permitted or authorized by law.
3. Health Care Operations.
Disclosure of PHI may be necessary in the course of operating various business functions of Lantern ABA. We may use and disclose the client’s PHI to support our day-to-day operations, including quality improvement, outcomes assessment, staff training, credentialing, licensing, accreditation, audits, legal services, business planning, customer service, and compliance activities. For example, a supervising staff member may review session notes to ensure the client’s behavior plan is being followed correctly. Other disclosures may include, but are not limited to:
Evaluating the quality of services provided to the client;
Developing clinical guidelines;
Contacting you with information about treatment alternatives or communications in connection with the client’s case management or care coordination;
Reviewing the qualifications and training of health care professionals;
Conducting medical review, legal services, and auditing functions; and/or
Managing general administrative activities, such as customer service and data analysis.
Additional use and/or disclosure of PHI without consent or authorization will be done in the following circumstances:
Child abuse. PHI information about the client will be disclosed if compelled by the California Child Abuse and Reporting Act. Lantern ABA is a mandated reporter and is required to report any observed or disclosed incidents where a child has been injured as a result of physical, mental, or emotional abuse, neglect, sexual abuse or exposure to domestic violence. This includes knowledge of or reasonable suspicion that mental suffering has been inflicted upon a child or that his/her emotional well-being is endangered in any other way. This must be immediately reported to a police or sheriff’s department, social services, or protective service agency.
Adult and domestic abuse. PHI information may be disclosed if it is compelled by the California Elder/Dependent Adult Abuse Reporting Law. This would include reasonable cause that an adult has been or is being abused, abandoned, abducted, isolated, neglected, financially exploited, or in need of protective services. This must be reported to the appropriate authorities as permitted or required by law.
Health oversight activities. Disclosure of the client’s PHI information to the California Board of Psychology, California Board of Behavioral Sciences, or other oversight agency is necessary for a proceeding before these boards. PHI information may be used and/or disclosed in designated activities and functions including audits; civil, administrative, or criminal investigations, inspections, licensure or disciplinary actions, or civil, administrative, or criminal proceedings or actions.
Judicial and administrative proceedings. Disclosure of the client’s PHI may be warranted in response to an order of a court or administrative tribunal, a warrant, subpoena duces tecum, discovery request, or other lawful process. If you are involved in a court proceeding and a request is made about the professional services that Lantern ABA has provided to the client, Lantern ABA must not release your information without: (1) your written authorization or the authorization of your attorney or personal representative; (2) a court order; or (3) a subpoena to produce records.
Relating to decedents. Disclosure of the client’s PHI may be used if compelled or permitted, in the event of death, to the coroner or medical examiner.
To avert a serious threat to health or safety. If Lantern ABA believes there is a substantial likelihood that the client has threatened an identifiable person or persons and that the client is likely to act on that threat, or if it is believed that the client presents an imminent risk of serious physical harm or death to oneself, the client’s PHI may be used and/or disclosed in order to avert a serious threat to health or safety.
Worker’s compensation. Information may be disclosed about the client’s health information as necessary to comply with State Workers’ Compensation laws.
Emergencies. Information may be disclosed about the client to assist in notifying a family member, relative, or another person responsible for the client’s care, about the client’s psychological or medical condition or in the event of an emergency or death.
U.S. Secretary of Health and Human Services. Information may be disclosed about the client’s PHI to the U.S. Secretary of Health and Human Services or the Office of Civil Rights if compelled to participate in an investigation or determination of Lantern ABA’s compliance with privacy, security, and transaction requirements under federal regulations.
When required by law. Information may be used and/or disclosed about the client in other circumstances not described above when law specifically requires disclosure of this information.
4. Appointment and Service Communications.
Lantern ABA may contact you or the client by phone, text message, email, or mail to remind you or the client of appointments, share scheduling updates, or provide information about treatment alternatives and other health-related benefits or services that may be of interest. You or the client may request in writing that we use a specific method of contact. Unless specifically requested to be contacted by other means, the Privacy Rule permits contact with you or the client regarding appointment reminders and other similar materials.
As a courtesy to clients, appointment reminders are made through phone calls to given numbers or email. In the event calls are unanswered, reminder messages will be left via voicemail or with the person answering the phone. No PHI will be disclosed during this conversation or message other than the date and time of your scheduled appointment and a request to return the call if there is a need to cancel or reschedule an appointment.
Business associates who may assist with tasks such as billing, filing, and messages need to receive some of the client’s PHI in order to perform these services properly. Safeguards will be implemented in order to ensure privacy protections.
5. Other Uses and Disclosures Requiring Authorization
Uses and disclosures not described in this notice will be made only with written authorization when required. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.
Specially Protected Records
Some records receive additional protection under federal or California law. If Lantern ABA receives records protected by 42 CFR Part 2, those records generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against an
individual without the individual’s written consent or a court order issued after notice and an opportunity to be heard, as required by law.
Electronic Records, Communication, and Telehealth
Lantern ABA maintains records electronically. Any paper received for scanning is handled securely and incorporated into the electronic record as appropriate, subject to applicable requirements. We use administrative, technical, and physical safeguards appropriate to the information and services involved. Email, text messaging, telephone services, and telehealth offer convenience but may carry privacy risks. We use service providers and safeguards selected for health care operations. Email and text should generally be limited to scheduling and administrative matters unless a secure method is arranged. You may request a reasonable alternative communication method.
Retention
Lantern ABA retains clinical and business records for at least seven years after the last date of service, or longer when required by applicable law, contract, payer requirement, or professional obligation. Records are securely deleted when the applicable retention period ends.
Our Responsibilities
We are required by law to maintain the privacy and security of protected health information, provide this notice, and follow the duties and privacy practices described in the current notice. We will notify affected individuals following a breach of unsecured protected health information as required by law.
We will not use or share information other than as described here unless you authorize it in writing or the law otherwise permits or requires it. You may revoke an authorization in writing for future uses and disclosures.
Changes to This Notice
We may change the terms of this notice, and changes may apply to information already maintained. The current notice will be available upon request and on our website.
Privacy Official of Lantern ABA
If you have questions about this Notice, wish to exercise any of the rights described above, or want to file a privacy complaint, please contact the Privacy Official: Lantern ABA, Inc. Email: ethan@lanternaba.com
For questions about this document, contact ethan@lanternaba.com.
Also see our Privacy Policy →