What is the Privacy Rule?
The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without client authorization. The Rule also gives client's rights over their health information, including rights to examine and obtain a copy of their health records and to request corrections.
Notice of Privacy Practices
In 1996, the Health Insurance Portability and Accountability Act (HIPAA) was enacted by US Congress to bring about health insurance reform and to ensure that client health information is not used for any unintended or unauthorized purpose. As part of HIPAA's implementation, any organization providing health-related services that exchanges client health information electronically must provide its clients with a document that states how the information may be used and their rights concerning its use. That document is called the Notice of Privacy Practices, and is available on this page.
Getting Your Medical Records
Release of Information Authorization/Request forms may be obtained by your provider or at Tri-City Mental Health Services locations:
Adult Services - 2008 N. Garey Avenue Pomona, CA 91767
Child and Family Services - 1900 Royalty Drive Suite 180 Pomona, CA 91767
All requests for mental health records require a properly completed Authorization for the Release/Disclosure of Information including subpoena requests. Authorizations not properly completed and signed will not be processed and may delay records to be sent. Prior to releasing information and records, releases are reviewed and approved by designated case provider. Fees may apply. Please contact Medical Records department for details.
Before submitting your request, it is important to review the form for completion, including:
- Personal identifying information of client, including full name, date of birth and Social Security Number (the last four digits are acceptable)
- Name, address and phone number of the individual or organization to which you want the records released
- What the information will be used for
- Description of Requested Information
- Time period for the information requested
- Initials where required
- Signature and date
Please contact the Medical Records Department at (909) 623-6131.
Adult Program Medical Records Department fax: (909) 865-9281
Child and Family Program Medical Records Department fax: (909) 865-0730
You can learn more at the US Department of Health and Human Services.
Consent refers to instances in which the privacy rule does not require a covered entity/health care provider to obtain consent for uses and disclosures of protected health information, such as for treatment, payment and healthcare operations.
Authorization is required by the Privacy Rule for uses and disclosures of protected health information (PHI) not otherwise allowed by the Rule.
In some situations, PHI disclosures may be made without the client's authorization, but they require an opportunity for the client to verbally agree or object.
These situations include:
- Disclosures to the client's next-of-kin or to another person (designated by the client) involved in the client's health care
- Notification of a family member (or the client's personal representative) of the client's location, general condition or death
- Disaster relief situations.
Authorization in an emergency:
If the client is incapacitated or in cases of an emergency, EMS responders, in the exercise of professional judgment, may determine whether disclosure of PHI is in the client's best interests.
This provision of the Privacy Rule allows responders to inform relatives or others involved in a client's care that a client has suffered an affliction and to provide updates on the client's progress and prognosis.
When Authorization Is NOT Required
For certain uses and disclosures, an authorization or opportunity to agree or object, is not required:
- Required by law
- Public health activities (injury/disease control/prevention)
- Victims of abuse, neglect, or domestic violence
- Health oversight activities (DHS, regional EMS council)
- Judicial and administrative proceedings
- Law enforcement purposes
- Decedents
- Cadaver donation of organs, eyes, or tissues
- Research purposes
- To avert a serious threat to health or safety
- Specialized Government Functions
- To comply with worker’s compensation law
- You may file a complaint with the Privacy Officer by using a Grievance Form in English or Spanish and/or by calling (909) 784-3298
- To learn more about your rights regarding HIPAA, visit the US Department of Health and Human Services | In Spanish