Notice of Privacy Practices

Notice of Privacy Practices

This Notice of Privacy Practices (“Notice”) describes how your protected health information (PHI) may be used and disclosed and how you can get access to this information, as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and other laws. Please review it carefully.

Who We Are

This single Notice applies to all departments and programs within Alameda County Health (AC Health), an agency of the County of Alameda and a HIPAA-covered entity. AC Health includes the following departments and programs: Behavioral Health (Mental Health and Drug Medi-Cal Organized Delivery System (DMC-ODS) Health Plans), Public Health, Environmental Health, and additional services such as Healthcare for Homeless, Homelessness and Housing Services, Emergency Medical Services, Healthy Schools and Communities, Health PAC, and Social Health Information Exchange (SHIE).

AC Health may share your protected health information (PHI) with individuals and organizations known as Business Associates and Qualified Service Organizations who perform essential services on our behalf. These include administrative support services such as data analysis, billing or claims processing, accreditation, auditing, laboratory services, information technology, as well as direct clinical services provided under contract through our health plans or other approved service arrangements. While providing these services, Business Associates may also collect, create, or receive PHI and share it with AC Health as necessary to support care delivery, coordination, payment, or operations. All Business Associates are legally and contractually required to protect your PHI and may only use or disclose it as permitted under HIPAA and their agreement with AC Health.

Your Information. Your Rights. Our Responsibilities.

Your Information: Our Uses and Disclosures

We generally use and disclose (share) your health information to provide treatment (to care for you), process payment (to bill for your services), and support healthcare operations (to run our organization).

Treat You

To provide you with medical, behavioral health (mental health and substance use disorder), or dental care and coordinate your treatment across our programs and share it with other professionals who are treating you.

Example: A behavioral health provider may work with your primary care provider to ensure your treatment plan supports both your mental and physical health needs.

Bill For Your Services

We can use and share your health information to bill and get payment from Medi-Cal, Medicare, health plans or other insurance carriers.

Example: We give information about you to your health insurance plan so it will pay for your services.

Run Our Organization

We can use and share your health information to operate our programs, improve your care, and contact you when necessary.

Example: We may use health information about you to manage your treatment and services, for quality improvement, or staff training.

Substance Use Disorder (SUD) Treatment Records (42 CFR Part 2 Protections)

Some records about substance use treatment are specifically protected under federal law (42 CFR Part 2). These rules now work with HIPAA so that your health care team can share information safely to help coordinate your care while keeping it private. How we may use and disclose your SUD treatment information depends on the type of consent you have given:

  • General consent: If you have given us general permission, we may use and share your SUD records for treatment, payment, or healthcare operations (TPO). This lets us share your information with other health care providers and organizations involved in your care.
  • Consent for another purpose: If you give us permission for a different purpose, we may use and disclose your SUD treatment records only in ways you allow.
  • Without your consent: If you have not given permission, we will only share your SUD records in the ways permitted by 42 CFR Part 2.

Care Coordination and CalAIM Programs

We participate in California Advancing and Innovating Medi-Cal (CalAIM), a program that helps coordinate care for Medi-Cal members with complex needs. As part of this effort, we may share your health information with other approved providers and organizations involved in your care, such as health plans, community-based organizations, housing providers, or behavioral health providers, to better coordinate service through programs like Enhanced Care Management (ECM) or Community Supports. This sharing happens only as allowed by law and only when necessary to support your treatment and services.

Additional Uses and Disclosures

We may also use or disclose your health information for the following purposes as allowed or required by law.

Public Health and Safety Issues

We can share health information about you for certain situations such as:

  • Preventing disease, injury or disability
  • Reporting births and deaths
  • Helping with product recalls
  • Reporting adverse reactions to medications
  • Reporting suspected abuse, neglect, or domestic violence
  • Preventing or reducing a serious threat to anyone’s health or safety

Research

We can share health information with third parties for research purposes.

Comply With the Law

We will share information about you if state or federal laws require it, including with the U.S. Department of Health and Human Services if it
wants to see that we’re complying with federal privacy law.

Organ and Tissue Donation Requests

We can share health information about you with organ procurement organizations.

Health Oversight

We can use or share your health information with health oversight agencies for activities authorized by law.

Coroner, Medical Examiner, or Funeral Director

We can share health information with a coroner, medical examiner, or funeral director when an individual dies.

Workers’ Compensation

We can use or share health information about you for workers’ compensation claims.

Government Requests and Law Enforcement

We can use or disclose your health information with health oversight agencies for activities authorized by law; for special functions such as military or national security activities, or to protect the President and other authorized persons; and in limited circumstances, for law enforcement purposes or with a law enforcement official.

Inmates

If you are in custody of a correctional institution or law enforcement official, we may disclose your health information for your health and safety, the health and safety of others, or for the administration and safety of the facility.

Serious and Imminent Threats

We may disclose your health information when needed to lessen a serious or imminent threat to the health or safety of you, the  public, or another person.

Lawsuits and Legal Actions

We can disclose health information about you in response to a court or administrative order, or in response to a subpoena.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Access Your Records

You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. We will provide a copy or a summary of your health information, usually within 30 days of your request.

Request Amendments

You can ask us to correct health information you believe is incorrect or incomplete. We may say “no” to your request, but we’ll tell you why in writing within 60 days.

Request Restrictions

You may request restrictions on the use or disclosure of your health information, though we may not be able to agree in all cases.

Request Confidential Communication

You can ask us to contact you in a specific way (for example: home or office phone) or to send mail to a different address. We will say “yes” to all reasonable requests. You must make this request in writing, and you must tell us how or where you wish to be contacted.

Receive an Accounting of Disclosures

You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why. We will include all the disclosures except for those about treatment, payment, and healthcare operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting a year for free but may charge a reasonable, cost-based fee if you ask for another one within 12 months.

Get a Paper Copy of this Privacy Notice

You can ask for a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically. We will provide you with a paper copy promptly.

Choose Someone to Act for You

If you have given someone medical power of attorney or someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.

File a Complaint

If you believe your privacy rights were violated, you can file a complaint with us by calling 510-618-3333 or email us at ACHealth.Compliance@acgov.org

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to:

HHS Office for Civil Rights
90 7th Street, Suite 4-100 | San Francisco, CA 94103
By Phone: 1800-368-1019
Online www.hhs.gov/ocr/privacy/hipaa/complaints/

We will not retaliate against you for filing a complaint.

Your Rights Under California Law

Some of your health information is subject to special protection under California law because it is considered sensitive information. This includes information related to HIV test results; substance use treatment; mental health; genetic testing; reproductive health services (including abortionrelated care); and gender-affirming care. We may use or share this information within AC Health and with our business associates when needed to treat you, bill for your care, or run our organization. When required by law, we will obtain your written authorization before making other types of disclosures.

Youth and Minor Confidentiality Rights

In some circumstances, we are permitted or required to deny access to a parent or guardian of a minor.

For example:

  • When minors legally consent, we will not share their information with parents or guardians without the minor’s written permission, unless required or permitted by law (e.g., court order, medical emergency, mandated reporting).
  • Minor ages 12 and older can consent to certain sensitive services, including mental health, substance use disorder treatment, reproductive health services, HIV/STI testing and treatment.
  • Minors can request that we send communication (e.g., test results, bills) to a different address, phone number, or email to protect their privacy. This is called a confidential communications request, and we are required to honor it.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us to:

  • Share information with your family, close friends, or others involved in your care.
  • Share information in a disaster relief situation.
  • Have us communicate with you in a specific way (e.g., phone, email, office address, etc.).
  • Ask us not to share your information with your health plan about a service you paid for out-of-pocket in full.

If you are not able to tell us your preference, for example—if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases, we will not share your information unless you give us written permission:

  • Marketing purposes.
  • Sale of your information.
  • Most sharing of psychotherapy and SUD counseling notes.
  • We will not share your SUD treatment record, or any testimony about it, in any civil, criminal, administrative, or legislative proceedings against you, unless you have authorized the use or disclosure by consent, or a court has ordered it after providing you notice.

Even if you have given us written permission, you may revoke it in writing at any time.

In the case of fundraising or media campaign

  • We may contact you for fundraising or media campaign efforts, but you can tell us not to contact you again.

Our Responsibilities

  • We are required by law to maintain the privacy and security of your protected health information.
  • We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
  • We must follow the duties and privacy practices described in this Notice and give you a copy of it.
  • We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
  • For more information visit:
    www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

Changes of the Terms of This Notice
We can change the terms of this Notice, and the changes will apply to all information we have about you. The new Notice will be available upon request, in our office, and on our website.

Effective Date of Notice: 2013
Revised: August 2017; June 2022; November 2025