What is the Privacy Rule?  

The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without client authorization. The Rule also gives client's rights over their health information, including rights to examine and obtain a copy of their health records and to request corrections.

Notice of Privacy Practices

In 1996, the Health Insurance Portability and Accountability Act (HIPAA) was enacted by US Congress to bring about health insurance reform and to ensure that client health information is not used for any unintended or unauthorized purpose. As part of HIPAA's implementation, any organization providing health-related services that exchanges client health information electronically must provide its clients with a document that states how the information may be used and their rights concerning its use. That document is called the Notice of Privacy Practices, and is available on this page.

Getting Your Medical Records

How do I obtain my medical records?        

Release of Information Authorization/Request forms may be obtained by your provider or at Tri-City Mental Health Services locations: 

Adult Services - 2008 N. Garey Avenue Pomona, CA 91767

Child and Family Services - 1900 Royalty Drive Suite 180 Pomona, CA 91767

All requests for mental health records require a properly completed Authorization for the Release/Disclosure of Information including subpoena requests.  Authorizations not properly completed and signed will not be processed and may delay records to be sent.  Prior to releasing information and records, releases are reviewed and approved by designated case provider.  Fees may apply.  Please contact Medical Records department for details. 

Before submitting your request, it is important to review the form for completion, including:

1. Personal identifying information of client, including full name, date of birth and Social Security Number (the last four digits are acceptable) 
2. Name, address and phone number of the individual or organization to which you want the records released 
3. What the information will be used for 
4. Description of Requested Information 
5. Time period for the information requested 
6. Initials where required 
7. Signature and date 

Where may I get a Release of Information form?

Insert links to Release of Information documents

Please contact the Medical Records Department at (909) 623-6131.

Adult Program Medical Records Department fax:  (909) 865-9281

Child and Family Program Medical Records Department fax:  (909) 865-0730

Where may I learn more about HIPAA?

You can learn more at http://www.hhs.gov/hipaa/

How does "consent" differ from "authorization"?

Consent refers to instances in which the privacy rule does not require a covered entity/health care provider to obtain consent for uses and disclosures of protected health information, such as for treatment, payment and healthcare operations. 

Authorization is required by the Privacy Rule for uses and disclosures of protected health information (PHI) not otherwise allowed by the Rule. 

Who has the right to view my medical records without my permission/authorization?

In some situations, PHI disclosures may be made without the client's authorization, but they require an opportunity for the client to verbally agree or object. 

These situations include: 

• Disclosures to the client's next-of-kin or to another person (designated by the client) involved in the client's health care  
• Notification of a family member (or the client's personal representative) of the client's location, general condition or death 
• Disaster relief situations. 

Authorization in an emergency: 

If the client is incapacitated or in cases of an emergency, EMS responders, in the exercise of professional judgment, may determine whether disclosure of PHI is in the client's best interests. 

This provision of the Privacy Rule allows responders to inform relatives or others involved in a client's care that a client has suffered an affliction and to provide updates on the client's progress and prognosis. 

When Authorization Is NOT Required 

For certain uses and disclosures, an authorization or opportunity to agree or object, is not required: 

1. Required by law 
2. Public health activities (injury/disease control/prevention) 
3. Victims of abuse, neglect, or domestic violence 
4. Health oversight activities (DHS, regional EMS council) 
5. Judicial and administrative proceedings 
6. Law enforcement purposes
7. Decedents 
8. Cadaver donation of organs, eyes, or tissues 
9. Research purposes 
10. To avert a serious threat to health or safety 
11. Specialized Government Functions 
12. To comply with worker’s compensation law 

How may I file a HIPAA-related complaint?

• You may file a complaint with the Privacy Officer by using a Grievance Form in English or Spanish and/or by calling (909) 784-3298 

To learn more about your rights regarding HIPAA, visit http://www.hhs.gov/hipaa/index.html 
In Spanish: hhs.gov/hipaa/for individuals/spanish/