HIPAA Privacy

NORTH DAKOTA DEPARTMENT OF HEALTH AND HUMAN SERVICES
NOTICE OF PRIVACY PRACTICES
Effective Date February 1, 2025

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

The North Dakota Department of Health and Human Services (HHS) is a “hybrid entity” under the Health Insurance Portability Act of 1996 (HIPAA). This means that not all of HHS is subject to HIPAA. Only the health plans and programs providing health care listed in “Exhibit A HIPAA Hybrid Entity Covered Components” on HHS’ HIPAA Privacy webpage (hhs.nd.gov/hipaa) are required to comply with HIPAA.

This Notice of Privacy Practices (Notice) describes the legal duties and privacy practices of the HIPAA covered components with respect to Protected Health Information (PHI), how PHI may be used and disclosed, and your rights regarding PHI. PHI is information about you, including demographic information that may identify you and that relates to your past, present, or future physical or mental health or condition; the provision of health care; or the past, present, or future payment for the provision of health care to you.

This Notice does not pertain to HHS’ Behavioral Health Clinics or the North Dakota State Hospital. A separate Notice regarding these facilities can be obtained on HHS’ HIPAA Privacy webpage (hhs.nd.gov/hipaa) or at each facility.

USES AND DISCLOSURES OF PHI WITH AUTHORIZATION

Generally, your PHI may be used and disclosed when you give your authorization to do so in writing on a form that specifically meets the requirements of the laws and regulations that apply.

USES AND DISCLOSURES OF PHI WITHOUT AUTHORIZATION

The following describes the different ways we are permitted or required to use or disclose your PHI without your written authorization.

Treatment. PHI may be used and disclosed to provide treatment, care coordination, and treatment-related services to you. For example, we may disclose your PHI in order to refer you to another health care provider who needs the information to provide treatment to you.

Payment. PHI may be used and disclosed to bill and collect payment for treatment and treatment-related services that you receive. For example, PHI may be disclosed to your health plan to determine if the health plan will pay for your treatment.

Health Care Operations. PHI may be used and disclosed for the purpose of health care operations that include internal administration, planning, and various activities that improve the quality and effectiveness of treatment and services. For example, PHI may be used to evaluate the quality and competence of clinical providers.

Appointment Reminders, Treatment Alternatives, and Health Related Benefits and Services. PHI may be used and disclosed to contact you to remind you of an appointment and to tell you about treatment alternatives or health related benefits and services that may be of interest to you.

To Business Associates. PHI may be disclosed to business associates that perform services on our behalf through contracts or agreements. These contracts and agreements contain requirements that safeguard PHI.

Permitted or Required by Law. PHI may be used and disclosed if permitted or required by state or federal laws or regulations.

Public Health Activities. PHI may be disclosed to local, state, or federal public health agencies authorized by law to receive the PHI for the purpose of preventing or controlling disease, injury, or disability; to keep vital statistic records such as data about births and deaths; and to report reactions to medications or problems with products to the Federal Food and Drug Administration.

Health Oversight Activities. PHI may be used and disclosed to other divisions of HHS and with other agencies for oversight activities as required by law. Examples of oversight activities include audits, inspections, investigations, and licensing activities.

Judicial and Administrative Proceedings. PHI may be disclosed if we are a party to litigation or potential litigation, to comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena; in response to an administrative request, administrative subpoena or summons, civil or authorized investigative demand, or similar process authorized under law.

Law Enforcement or Other Agencies. PHI may be disclosed to government agencies authorized under law to receive reports of abuse, neglect, or domestic violence. PHI may be disclosed to law enforcement: (1) In response to a court order, subpoena, warrant, summons, or similar process; (2) To identify or locate a suspect, fugitive, material witness, or missing person; (3) About a victim of a crime even if, under certain limited circumstances, the victim’s agreement cannot be obtained; (4) About a death believed to be the result of criminal conduct; (5) Regarding a crime committed on our premises or against our personnel; (6) To identify or apprehend an individual who has admitted participation in a violent crime causing serious physical harm; and (7) To identify or apprehend an individual who escaped from lawful custody.

To Coroners, Medical Examiners, and Funeral Directors. PHI may be disclosed to a coroner, medical examiner, or funeral director to carry out their duties authorized by law.

Organ Donations. If you are an organ donor, we may disclose your PHI to an organization that procures, banks, or transports organs for the purpose of an organ, eye, or tissue donation and transplantation.

Research. PHI may be disclosed under limited circumstances where the PHI will be protected by the researchers.

To Avert a Serious Threat to Health or Public Safety. PHI may be disclosed if it is necessary to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public.

National Security and Protection of the President. PHI may be disclosed to an authorized federal official or other authorized person for the purpose of national security, providing protection to the President, or to conduct special investigations as authorized by law.

Military and Veterans. If you are a member of the armed forces, PHI may be disclosed as required by military command authorities. If you are a member of a foreign military, PHI may be disclosed to the appropriate foreign military authority. If you are a Veteran, PHI may be disclosed to the Department of Veteran Affairs to determine eligibility of benefits.

Correctional Facilities. If you are an inmate of a correctional facility or in the custody of a law enforcement official, PHI may be disclosed to the correctional institution or law enforcement official if the disclosure is necessary to provide you with health care, protect your health and safety or the health and safety of others, or for the safety and security of the correctional facility or law enforcement official.

To Other Government Agencies Providing Benefits or Services. PHI may be disclosed to government agencies or programs that provide similar benefits or services if the disclosure is necessary to coordinate the delivery of benefits or services, or improve our ability to administer or manage our programs.

Worker’s Compensation. PHI may be disclosed to worker’s compensation programs that provide benefits to work-related injuries or illness.

USES AND DISCLOSURES OF PHI REQUIRING AUTHORIZATION

The following uses and disclosures of PHI require written authorization: (1) Marketing purposes; (2) Sale of PHI; and (3) Psychotherapy notes in limited circumstances. We do not maintain a public client directory.

OTHER USES AND DISCLOSURES OF PHI

Except for the uses and disclosures described in this Notice and as authorized, required, or permitted by law or regulation, we will only use and disclose PHI with your written authorization.

You have the right to cancel or revoke an authorization you signed for the use or disclosure of your PHI, except to the extent we have already acted based on your authorization. Your request must be in writing using HHS’ “Revocation of Authorization to Disclose Information" form (SFN 91). The form can be obtained from the health plan you are enrolled in or the program you receive health care services from.

In Certain Situations, You Can Tell Us Your Choices About What PHI We Disclose. With your verbal permission or if we reasonably expect that you do not disagree, you are incapacitated or not available, or professional judgement determines it is in your best interest, we may disclose PHI in the following circumstances:

Individuals Involved in Care or Payment for Care. PHI may be disclosed to a family member, other relative, friend, or other person whom you have identified to be involved in your health care or payment for your health care.
Notification Purposes. PHI may be disclosed to identify, locate, and notify family members, guardians, or anyone else responsible for your care, of your location, general condition, or death.
Disaster Relief Purposes. PHI may be disclosed to organizations such as the American Red Cross, authorized by law to assist in disaster relief efforts, for the purpose of coordinating the notification of family members or other persons involved in your care, of your location, general condition, or death. Your permission is not required in this situation if doing so would interfere with our ability to respond to the emergency.

If you have a preference for how your PHI is disclosed in the situations described above, contact the health plan you are enrolled in or the program you are receiving health care services from.

YOUR RIGHTS REGARDING PHI

See or Obtain a Copy of PHI. You have the right to see and obtain a copy of your PHI and request we send a copy of your PHI directly to a third party. You have the right to request a copy in electronic form or format. If the form and format are not easily created, we will work with you to provide it in a reasonable form or format. We will provide a summary of your PHI if you agree. Your request must be in writing. We may charge a fee associated with your request. We are not required to allow you to see or copy psychotherapy notes or PHI we prepare for use in legal actions or proceedings.

Amend PHI. If you believe your PHI is incorrect or incomplete, you may request that it be changed as long as we maintain the PHI. Your request must be in writing and include the reason why a change should be made. We may deny your request if the PHI was not created by us, is excluded from the PHI you are permitted to see or copy, or we believe the PHI to be accurate and complete. We will notify you or our decision in writing.

Request a Restriction. You have the right to request that we limit how your PHI is used and disclosed for treatment, payment, or health care operations. Your request must be in writing. We are not required to agree to your request unless you are requesting to restrict the use and disclosure of your PHI to a health plan (non-Medicaid) for payment or health care operations, and the PHI you wish to restrict pertains solely to a health care item or service for which you have paid out-of-pocket, in full, the non-sliding fee. If we approve your request, we will comply with your request unless the PHI is needed to provide you with emergency treatment or the disclosure is required by law. We will notify you of our decision in writing.

Request an Accounting of Disclosures. You have the right to request a list of disclosures we made of your PHI. The list will not include disclosures made for treatment, payment, health care operations, or that you authorized in writing. Your request must state a time period for the disclosures, which may not be longer than six (6) years prior as long as we maintain the PHI. We will provide one list free of charge per year.

Request Confidential Communications. You may request we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we contact you at your workplace or by email. Your request must be in writing and specify how or where you wish to be contacted. We will accommodate reasonable requests.

Request a Paper Copy of This Notice. You have the right to request a paper copy of this Notice at any time. Please contact the program you are receiving treatment or treatment-related services from or the health plan you are enrolled in to request a paper copy. You may also view and download a copy of the Notice from HHS’ HIPAA Privacy webpage (hhs.nd.gov/hipaa).

Fundraising. You have right to opt out of fundraising contacts. However, we do not engage in fundraising activities.

To Exercise Your Rights. You may exercise your rights only in writing in the form and manner approved by HHS, unless we waive the written requirement. Contact the health plan you are enrolled in or the program you are receiving health care services from to request the applicable form to exercise your rights or request additional information. Forms should be returned to the health plan you are enrolled in or program you are receiving health care services from.

OUR RESPONSIBILITIES

We are required by law to maintain the privacy of your PHI. We will let you know promptly if a breach occurs that may have compromised the privacy of your unsecured PHI. We are required to abide by the terms of this Notice, currently in effect. We reserve the right to change the terms of this Notice at any time. We also reserve the right to make the revised Notice effective for all the PHI that we maintain. If we make changes to this Notice, the new notice will be posted in our facilities, a copy will be available at all programs, and on HHS’ HIPAA Privacy webpage (hhs.nd.gov/hipaa).

FOR MORE INFORMATION

If you have questions or would like additional information regarding this Notice, please contact:

HIPAA Privacy Officer
North Dakota Department of Health and Human Services
State Capitol
600 East Boulevard Avenue, Dept. 325
Bismarck, ND 58505-0250
Toll-free (800) 472-2622
TTY toll-free (800) 366-6888

TO FILE A COMPLAINT

If you believe that your HIPAA privacy rights have been violated, you may file a complaint with the health plan you are enrolled in, the program you are receiving health care services from, or with the HIPAA Privacy Officer. All complaints must be made in writing using HHS’ “Request for Informal Privacy Conference" form (SFN 934). The form can be obtained from the health plan you are enrolled in, program you are receiving health care services from, or the HIPAA Privacy Officer.

HIPAA Privacy Officer
North Dakota Department of Health and Human Services
State Capitol
600 East Boulevard Avenue, Dept. 325
Bismarck, ND 58505-0250
Toll-free: (800) 472-2622
TTY toll-free: (800) 366-6888

You may also file a complaint with the U.S. Department of Health and Human Services:
Centralized Case Management Operations
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Bldg.
Washington, D.C. 20201
Toll-free: (800) 368-1019
TDD toll-free: (800) 537-7697
OCRComplaint@hhs.gov

THERE WILL BE NO RETALIATION AGAINST YOU FOR FILING A COMPLAINT

HHS Notice of Privacy Practices DN 900

NORTH DAKOTA DEPARTMENT OF HEALTH AND HUMAN SERVICES
NOTICE OF PRIVACY PRACTICES FOR
BEHAVIORAL HEALTH CLINICS AND NORTH DAKOTA STATE HOSPITAL
Effective February 1, 2025

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW THIS NOTICE CAREFULLY.

The behavioral health care facilities (facilities) of the North Dakota Department of Health and Human Services (HHS) are committed to protecting the privacy of your health information. These facilities are listed below. This Notice of Privacy Practices (Notice) describes the legal duties and privacy practices of the facilities with respect to Protected Health Information (PHI), how PHI may be used and disclosed, and your rights regarding PHI.

PHI is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health or condition; the provision of health care services; or the past, present, or future payment for the provision of health care to you.

BEHAVIORAL HEALTH CARE FACILITIES

NORTHWEST HUMAN SERVICE CENTER 316 2ND AVE W. WILLISTON, ND 58802 (800) 231-7724	NORTH CENTRAL HUMAN SERVICE CENTER 1015 S. BROADWAY, SUITE 18 MINOT, ND 58701 (888) 470-6968
LAKE REGION HUMAN SERVICE CENTER 200 HWY 2 W. DEVILS LAKE, ND 58301 (888) 607-8610	NORTHEAST HUMAN SERVICE CENTER 151 S. 4TH ST., SUITE 401 GRAND FORKS, ND 58201 (888) 256-6742
SOUTHEAST HUMAN SERVICE CENTER 2624 9TH AVE S. FARGO, ND 58103 (888) 342-4900	SOUTH CENTRAL HUMAN SERVICE CENTER 520 3RD ST NW. JAMESTOWN, ND 58401 (800) 260-1310
WEST CENTRAL HUMAN SERVICE CENTER 1237 W. DIVIDE AVE., SUITE 5 BISMARCK, ND 58501 (888) 328-2662	BADLANDS HUMAN SERVICE CENTER 1463 I-94 BUSINESS LOOP EAST DICKINSON, ND 58601 (888) 227-7525
NORTH DAKOTA STATE HOSPITAL 2605 CIRCLE DRIVE JAMESTOWN, ND 58401 (855) 674-7314

USES AND DISCLOSURES OF PHI WITH AUTHORIZATION

Generally, your PHI may be used or disclosed when you give your authorization to do so in writing, on a form that specifically meets the requirements of the laws and regulations that apply.

USES AND DISCLOSURES OF PHI WITHOUT AUTHORIZATION

The following describes the different ways we are permitted or required to use or disclose your PHI without your written authorization.

Treatment. PHI may be used and disclosed to provide treatment, care coordination, and treatment-related services to you. For example, we may disclose your PHI in order to refer you to another health care provider who needs the information to provide treatment to you.

Payment. PHI may be used and disclosed to bill and collect payment for treatment and treatment-related services that you receive. For example, PHI may be disclosed to your health plan to determine if the health plan will pay for your treatment.

Health Care Operations. PHI may be used or disclosed for the purpose of health care operations that include internal administration, planning, and various activities that improve the quality and effectiveness of treatment and services. For example, PHI may be used to evaluate the quality and competence of clinical providers.

Appointment Reminders, Treatment Alternatives, and Health Related Benefits and Services. PHI may be used and disclosed to contact you to remind you of an appointment and to tell you about treatment alternatives or health related benefits and services that may be of interest to you.

To Business Associates. PHI may be disclosed to business associates that perform services on our behalf through contracts or agreements. These contracts and agreements contain requirements that safeguard PHI.

Permitted or Required by Law. PHI may be used and disclosed if permitted or required by state or federal laws or regulations.

Public Health Activities. PHI may be disclosed to local, state, or federal public health agencies authorized by law to receive the PHI for the purpose of preventing or controlling disease, injury, or disability; to keep vital statistic records such as data about births and deaths; and to report reactions to medications or problems with products to the Federal Food and Drug Administration.

Health Oversight Activities. PHI may be used and disclosed to other divisions of HHS and with other agencies for oversight activities as required by law. Examples of oversight activities include audits, inspections, investigations, and licensing activities.

Judicial and Administrative Proceedings. PHI may be disclosed if we are a party to litigation or potential litigation; to comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena; in response to an administrative request, administrative subpoena or summons, civil or authorized investigative demand, or similar process authorized under law.