Last updated: 10.26.26

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.


Rock River Community Clinic, Inc. (“we” / “us”) is required by law (“HIPAA”) to maintain the privacy of your health information. We are also required to provide you with a notice that describes our legal duties and privacy practices and your privacy rights with respect to your health information. We will follow the privacy practices described in this Joint Notice. If you have any questions about any part of this Joint Notice or if you want more information about our privacy practices, please contact our Privacy Officer at the contact information at the end of this document.

Information specifically relating to the treatment of a substance use disorder (“SUD”) are subject to additional privacy practices under federal law. If you have received or are receiving SUD treatment, please review the information beginning on page 4.

We reserve the right to change the privacy practices described in this Joint Notice in the event our practices need to be changed to follow the law. We will make the new notice provisions effective for all the protected health information that we maintain. If we change our privacy practices, we will have them available upon request. This Joint Notice will also be posted at the location of service.

How We May Use or Disclose Your Health Information for Treatment, Payment, or Health Care Operations

The following categories describe the ways that we may use and disclose your health information and treatment information. For each type of use and disclosure, we will explain what we mean and present some examples. Examples are for illustrative purposes only.

Treatment. We may use or disclose your health care information in the provision, coordination, or management of your health care. Our communications to you may be by telehealth, telephone, cell phone, email, patient portal, mail, or text. For example, we may use your information to call and remind you of an appointment or to refer your care to another provider. As another example, we utilize an electronic health record system hosted by Fort Healthcare. Health information may be shared through this system between all our provider locations, Fort Healthcare, and other providers using Fort Healthcare’s electronic health record system, but only if those providers are also providing care or treatment to you. If another provider requests your health information and they are not providing care and treatment to you, we will request an authorization from you before providing your information.

Payment. We may use or disclose your health care information to obtain payment for your health care services. For example, we may use your information to send a bill for your health care services to your insurer.

Health Care Operations. We may use or disclose your health care information for activities relating to the evaluation of patient care, evaluating the performance of our health care providers, business planning, and compliance with the law. For example, we may use your information to determine the quality of care you received during an appointment. If the activities require disclosure outside of our health care organization, we will request your authorization before disclosing that information.

How We May Use or Disclose Your Health Information
Without Your Written Authorization

The following categories describe ways that we may use and disclose your health information without your authorization. For each type of use and disclosure, we will explain what we mean and present some examples, which are for illustrative purposes only.

  1. Required by Law. We may use and disclose your health information when that use or disclosure is required by law. For example, we may disclose health information to report child abuse or to respond to a court order.
  2. Public Health. We may release your health information to local, state, or federal public health agencies subject to the provisions of applicable state and federal law for reporting communicable diseases, aiding in the prevention or control of certain diseases, and reporting problems with products and reactions to medications to the Food and Drug Administration.
  3. Victims of Abuse, Neglect, or Violence. We may disclose your information to a government authority authorized by law to receive reports of abuse, neglect, or violence relating to children or the elderly.
  4. Health Oversight Activities. We may disclose your health information to health agencies authorized by law to conduct audits, investigations, inspections, licensure, and other proceedings related to oversight of the health care system.
  5. Judicial and Administrative Proceedings. We may disclose your health information in the course of an administrative or judicial proceeding in response to a court order. Under most circumstances, such a request is made through a subpoena or discovery request or involves another type of administrative order, which must meet certain conditions for disclosure.
  6. Law Enforcement. We may disclose your health information to a law enforcement official for purposes such as identifying or locating a suspect, fugitive, or missing person, or complying with a court order or other law enforcement purposes. Under some limited circumstances we will request your authorization prior to permitting disclosure.
  7. Coroners and Medical Examiners. We may disclose your health information to coroners and medical examiners. For example, this may be necessary to determine a cause of death. 
  8. Organ, Eye and Tissue Donation. We may disclose your health information to organizations that facilitate organ, eye, or tissue donation, banking, or transplantation.
  9. Research. Under certain circumstances, and only after a special approval process, we may use and disclose your health information to help conduct medical research, which may involve an assessment of how well a drug is working or whether a certain treatment is working better than another.
  10. To Avert a Serious Threat to Health of Safety. We may disclose your health information in a very limited manner to appropriate persons to prevent a serious threat to the health or safety of a particular person or the general public. Disclosure is usually limited to law enforcement personnel who are involved in protecting public safety.
  11. Specialized Government Functions. Under certain and very limited circumstances, we may disclose your health care information for military, national security, or law enforcement custodial situations. 
  12. Workers’ Compensation. Both state and federal law allow the disclosure of your health care information that is reasonably related to a worker’s compensation injury to be disclosed without your authorization. These programs may provide benefits for work-related injuries or illness.
  13. Health Information. We may use or disclose your health information to provide information to you about treatment alternatives or other health related benefits and services that may be of interest to you.

When We Are Required to Obtain an Authorization to Use or Disclose Your Health Information

Except as described in this Joint Notice of Privacy Practices, we will not use or disclose your health information without written authorization from you. For example, uses and disclosures made for the purpose of psychotherapy, marketing, and the sale of protected health information require your authorization. If you do authorize us to use or disclose your health information for another purpose, you may revoke your authorization in writing at any time. If you revoke your authorization, we will no longer be able to use or disclose health information about you for the reasons covered by your written authorization, though we will be unable to take back any disclosures we have already made with your permission.

Your Health Information Rights

  1. Inspect and Copy Your Health Information. You have the right to inspect and obtain a copy of your health care information. You have the right to request that the copy be provided in an electronic form or format (e.g., PDF saved onto a flash drive). If the form and format are not readily producible, then we will work with you to provide it in a reasonable electronic form or format. This right of access does not apply to psychotherapy notes that are maintained for the personal use of a mental health professional. Your request for inspection or access must be submitted in writing to our Privacy Officer at the address listed at the end of this document. In addition, we may charge you a reasonable fee to cover our expenses for copying your health information.
  2. Request to Correct Your Health Information. You have a right to request that we amend your health information that you believe is incorrect or incomplete. For example, if you believe the date of an appointment is incorrect; you may request that the information be corrected. We are not required to change your health information, and if your request is denied, we will provide you with information about our denial and how you can disagree with the denial. To request an amendment, you must make your request in writing to our Privacy Officer at the address listed at the end of this document. You must also provide a reason for your request.
  3. Request Restrictions on Certain Uses and Disclosures. You have the right to request restrictions on how your health information is used or to whom your information is disclosed, even if the restriction affects your treatment or our payment or health care operation activities. However, we are not required to agree in all circumstances to your requested restrictions, except in the case of a restriction of disclosure to a health plan if the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law and the protected health information pertains solely to a health care item or service for which you, or the person other than the health plan on your behalf, has paid us in full. If you would like to make a request for restrictions, you must submit your request in writing to our Privacy Officer at the address listed at the end of this document. A restriction cannot be applied to your health information that has already been disclosed. 
  4. Receive Confidential Communications of Health Information. You have the right to request that we communicate your health information to you in different ways or places. For example, you may wish to receive billing information sent to a private address. We must accommodate reasonable requests. To request specific confidential communications, you must submit your request in writing to our Privacy Officer at the address listed at the end of this document.
  5. Receive A Record of Disclosures of Your Health Information. You have the right to request a list of the disclosures of your health information that we have made in compliance with federal and state law. This list will include the date of each disclosure, who received the disclosed health information, a brief description of the health information disclosed, and why the disclosure was made. For some types of disclosures, the list will also include the date and time the request for disclosure was received and the date and time the disclosure was made. For example, you may request a list that indicates all the disclosures we have made from your health care record in the past six months. To request this accounting of disclosures, you must submit your request in writing to our Privacy Officer at the address listed at the end of this document. We must comply with your request for a list within 60 days, unless you agree to a 30-day extension, and we may not charge you for the list, unless you request such list more than once per year.
  6. Obtain A Paper Copy of this Joint Notice. Upon your request, you may at any time receive a paper copy of this Joint Notice, even if you earlier agreed to receive this Joint Notice electronically. To obtain a paper copy of this Joint Notice, send your written request to our Privacy Officer at the contact information at the end of this document. This Joint Notice is also available on our website at www.rockrivercommunityclinic.com.
  7. Notified of a Breach. We are required by law to maintain the privacy of protected health information and provide you with notice of our legal duties and privacy practices with respect to protected health information and to notify you following a breach of unsecured protected health information that qualifies under the federal healthcare privacy rules.
  8. Complaint. If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer at the contact information, below, who will provide you with any needed assistance. We request that you file your complaint in writing so that we may better assist in the investigation of your complaint. You may also file a complaint with the Secretary of the Department of Health and Human Services (DHHS). If your complaint relates to your privacy rights while you were receiving treatment for mental illness, alcohol or drug abuse, or a developmental disability, you may also file a complaint with the staff or administrator of the treatment facility or community mental health program. There will be no retaliation against you in any way for filing a complaint.

Additional Rights and Privacy Protections for Substance Use Disorder

THIS NOTICE DESCRIBES

  • HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
  • YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
  • HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION

YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH OUR PRIVACY OFFICER AT (262) 472-6839 OR privacy@rockrivercommunitycinic.org. IF YOU HAVE ANY QUESTIONS.

Records relating to SUD treatment have additional rights and privacy protections under federal law. These additional rights and privacy protections build off of the rights and privacy protections afforded to all individuals under HIPAA (described above).

Our Permitted Uses and Disclosures of SUD Treatment Records Without Consent. We may use and disclose treatment records to:

  1. Communicate with other staff within our SUD program or an entity that has direct administrative control over our SUD program when such individuals have a need for the health information to provide diagnosis, treatment, or referral for treatment.
  2. Qualified service organizations that provide services on our behalf when such services are provided under a written agreement.
  3. A law enforcement agency or official if you commit or threaten to commit a crime on our premises or against a person who works for us. 
  4. Report suspected child abuse and neglect to the appropriate authorities.
  5. Comply with a court order when that order includes a subpoena or other legal mandate. (See below for more information regarding legal proceedings.)
  6. Medical personnel in a medical emergency. 
  7. For certain scientific research, financial audits conducted by governmental bodies or agencies or individuals acting on behalf of government authority, or program evaluations.
  8. To a public health authority; provided, however, the treatment record has been de-identified.

Our Permitted Uses and Disclosures of SUD Treatment Records that Require Consent. For treatment, payment, and health care operations purposes, we require that you provide a single consent for all future uses or disclosures for treatment, payment, and health care operations purposes. When your treatment record is disclosed to a HIPAA covered entity (such as another health care provider or a health insurance company) or a business associate (companies that provide services on behalf of HIPAA covered entities), the recipient may disclose your treatment information consistent with HIPAA and this Joint Notice. 

Revoking Consent. You may revoke your consent in writing at any time by submitting a request to your provider. We will no longer use or disclose your treatment record after such time. However, we cannot take back any uses or disclosures of your treatment information already made when we had your consent. 

Using or Disclosing Treatment Information in Legal Proceedings. Your treatment records created by us, your treatment records received by us from another SUD program, or testimony about your treatment records cannot be used or disclosed in any civil, criminal, administrative, or legal proceeding against you without your written consent or a court order. Treatment records shall only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you or us. A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the treatment record is used or disclosed. 

Your Right to a List of Disclosures by an Intermediary. If you consent to share your treatment records through an intermediary, such as a health information exchange or research organization, you have a right to a list of disclosures by the intermediary for the past three years. To request a list of disclosures by an intermediary, you must submit your request to the intermediary.

Fundraising. We may only use or disclose your treatment records to fundraise for our benefit, provided that we supply you with a clear and conspicuous opportunity to elect not to receive fundraising communications.

If you have any questions or concerns regarding your privacy rights or the information in this Joint Notice, please contact our Privacy Officer at  (262) 472-6839, privacy@rockrivercommunitycinic.org, or Rock River Community Clinic, Inc., Attn: Privacy Officer, 1461 West Main Street, Suite B Whitewater, WI 53190.