" "

HIPAA Policy


Crossnore Communities for Children understands that medical information about you and your health is personal.

We are committed to protecting medical information about you. Crossnore creates a record of the care and services you receive. We need this record to provide you with quality care and to comply with certain legal requirements. This Notice of Privacy Practices applies to all of the records of your care generated and/or maintained by Crossnore, including the following people and organizations:

Any health care professional who is authorized to enter information in your medical record;
All providers that Crossnore contracts with to provide services to our clients.

This Notice will tell you about the ways in which we may use and disclose medical information about you. We also describe your rights and certain obligations we have regarding the use and disclosure of medical information.


  • Maintain the privacy of your health information, including implementing reasonable and appropriate physical, administrative, and technical safeguards to protect the information.
  • Provide you with this notice as to our legal duties and privacy practices with respect to individually identifiable health information we collect and maintain about you.
  • Abide by the terms of this notice
  • Train our personnel concerning privacy and confidentiality
  • Implement a sanction policy to discipline those who breach privacy/confidentiality or our policies with regard thereto.
  • Mitigate (lessen the harm of) any breach of privacy/confidentiality.

We reserve the right to change our practices and to make the new provisions effective for all individually identifiable health information we maintain. Should we change our information practices, we will post a revised notice in the agency offices and on our agency website at www.crossnore.org. Copies of any revised notices will be made available to you upon request.

We will not use or disclose your health information without your consent of authorization, except as described in this notice or otherwise required by law.


Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HI-TECH), your PHI is protected and confidential.

PHI is the term used to refer to any information that is maintained by Crossnore that can be used to identify you such as your name, address, Social Security number, ID numbers, or other unique identifiers. Your PHI also includes symptoms, test results, diagnosis, treatment, other related medical information, payments, billing and insurance information.



The following are ways that Crossnore will use or disclose your PHI:

Treatment: We will use and disclose your health information to other staff within the agency providing you with care to coordinate medical/clinical treatment or services. For example, therapists or other members of your treatment team will record information in your record and use it to determine the most appropriate course of care. We may also disclose health information to other health care providers to assist you in a medical emergency.

Payment: We will use and disclose your health information for payment purposes. For example, we will submit bills and maintain records of payments from your health plan. We may need to give your insurance company or a third party, medical information about treatment you received so that the insurance company or third party can make a payment.

Health Care Operations: We will use and disclose your health information to conduct our standard internal operations, including proper administration of records, evaluation of quality treatment, and to assess the care and outcomes of your case and others like it.

As part of our operations, we may disclose your information to qualified personnel for audit and program evaluation. We may allow our agency attorney to use your health information when representing this agency in legal matters. For example, we use your PHI in measuring and evaluating how many of our consumers have received certain services (such as therapy, a combination of therapy and community supports), we may send you a member satisfaction survey to determine how we can improve our services, or we may use your PHI in the course of an accreditation survey, or for fraud and abuse prevention activities.

Individuals Involved in Your Care: We may release limited information about you to a person including a family member actively involved in your care and treatment or supervision as allowed under State law and in accordance with Crossnore policies and procedures. For example, we may release the type and dose of medication you are receiving to your parent, legal guardian, spouse or caregiver if that person is actively involved with your care and treatment.

Information Regarding Deceased Individuals: Your death may increase the accessibility to your records. Besides your health care decision maker, your records may be disclosed to your personal representative or administrator of your estate, if there is not one then your spouse unless you were legally separated, then the trustee of a trust created by you where you were the trust beneficiary, then an adult child, then an adult sibling, then a guardian at the time of death.

Substance Abuse/HIV Health Information: The confidentiality/privacy of alcohol and drug abuse client records related to the diagnosis, treatment, referral for treatment or prevention, is protected by federal law and regulations (42 U.S.C.290dd-3 and 42 U.S.C.290ee-3) and regulations (42 CFR Part 2). Generally, a substance abuse program may not disclose to anyone outside the program that a client attends the program or disclose any information identifying a client as an alcohol or drug abuser, unless the client authorizes in writing. A general authorization for the release of medical or other information is not sufficient for this purpose; the disclosure is allowed by a court order; the disclosure is made to medical personnel in a medical emergency; the disclosure is made to qualified personnel for research or to oversight agencies, funders, and other authorized auditors for audit or program evaluation; the client commits or threatens to commit a crime either at the program or against any person who works for the program and the disclosure is made to report suspected child abuse or neglect.

Communicable Disease Related Information: Communicable disease related information, including HIV-related information, is kept strictly confidential and released only in conformance with the requirements of state law. A general authorization for the release of medical or other communicable disease related information is not sufficient to release HIV-related information. A written authorization must specifically indicate that it is for the release of confidential HIV-related information.

Business Associates: We provide some services through contracts with business associates such as a psychiatrist. When we use such services, we may disclose your health information to the business associate so they can perform the function(s) we have contracted with them to do and bill your third party payer for services rendered. To protect your health information, however, we require the business associate to appropriately safeguard your information.

As required by law: We may disclose medical information about you when required to do so by federal, state, or local law, and or as required for national security or protective services.

Law Enforcement or Court Appearances: We may disclose information about you for law enforcement purposes unless otherwise prohibited by state or federal law. We may release information for court proceedings such as court orders. We may release information to correctional institutions or other law enforcement officials when you are in their custody.

In cases of abuse or neglect: We may disclose your medical information if a government agency or social services agency contacted us concerning a case of abuse, neglect, or domestic violence and asked us for records or information; we would comply with the request.

Coroners, Medical Examiners and Funeral Directors: We may release information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also release medical information about members to funeral directors as necessary to carry out their duties.

Any and all uses or disclosures of your PHI other than described above require your prior written authorization. Crossnore will honor the specific requirements of your authorizations—including any revocation of an authorization that you have previously given us.

If we need to obtain your authorization for any use or disclosure beyond those needed for treatment, payment, or operations, we will contact you to request your written authorization.



Crossnore may use your health information to contact you to:

  • Remind you of upcoming appointments
  • Make you aware of alternative treatment, services, products, or health care providers that may be of interest to you
  • Contact you to request your participation in raising funds for the agency.


Crossnore Communities for Children will not disclose your health information without your authorization except as allowed or required by state or federal law.

For all other disclosures, we will ask you to sign a written authorization that allows us to share or request your health information. Before you sign an authorization, you will be fully informed of the exact information you are authorizing to be disclosed/requested and to/from whom the information will be disclosed/requested.

You may request that your authorization be cancelled by informing our agency Privacy Official that you do not want any additional health information about you exchanged with a particular person/agency. You will be asked to sign and date the Authorization Revocation section of your original authorization; however, verbal authorization is acceptable. Your authorization will then be considered invalid at that point in time; however, any actions that were taken on the authorization prior to the time you cancelled your authorization are legal and binding.

If you are a minor who has consented to treatment for services regarding the prevention, diagnosis and treatment of certain illnesses including: venereal disease and other diseases that must be reported to the State; pregnancy; abuse of controlled substances or alcohol; or emotional disturbance, you have the right to authorize disclosure of your health information. Disclosure of health information to external client advocates will require authorization by you and your personal representative if one has been designated. If you are a minor whose parent or guardian has consented to your treatment for substance abuse, both you and your parent or guardian must authorize disclosure of your health information.



Right to Request Restrictions: You have the right to request a restriction or limitation on the medical information we use or disclose about you. We are not required to agree to your request, but if we do agree we will comply with your request unless the information is needed to provide you with emergency treatment. To request restrictions, you must make your request in writing to the Crossnore Privacy Officer. In your request, you must tell us what information you want to restrict, and to whom you want the restriction to apply. Additionally, if you pay for your services in full, out of pocket, at the time of issue, you have the right to restrict certain disclosures of PHI to a health plan.

Right to be notified of a breach of your PHI: You have the right to be notified by this agency if your unsecured PHI is breached. The Privacy Officer from Crossnore will notify you if it is ever identified that your information was erroneously shared outside of allowed individuals. You will be notified in writing without reasonable delay.

Right to revoke Consent for Release of Information: If you determine, for some reason, that you do not wish to permit access to your records after consent has been signed, you can ask your staff or the Privacy Officer to assist you in the revocation of that consent. Your request for revocation must be in writing. If the record, or any part of the record, has already been released, we are unable to undo that act and cannot be held liable for such release.

Right to Request Different Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location if you believe that you will otherwise be endangered. For example, you can ask that we only contact you at a certain telephone number or address. To request confidential communications, you must make your request in writing to the Crossnore Privacy Officer. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to Access: You have the right to inspect and copy medical information that may be used to make decisions about your care. Usually, this includes progress notes, evaluations/assessments, treatment plans, and billing information, you may receive one copy upon request.

Right to Amend: If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as your medical information is kept by Crossnore. To request an amendment, your request must be made in writing and submitted to the Crossnore Privacy Officer. You must provide a reason that supports your request. We may deny your request if you ask us to amend information that was not created by us, unless the person or entity that created the information is no longer available to make the amendment; it is not part of the medical information kept by or for Crossnore; is not part of the information which you would be permitted to inspect or copy; or is accurate and complete.

Right to Accounting of Disclosures: You have the right to request an accounting of disclosures. This is a list of the disclosures we made of medical information about you to others. The accounting does not include the information disclosed based on your written permission or as a part of treatment, payment, or health care operations. To request this accounting, you must submit your request in writing to the Crossnore Privacy Officer. Your request must state a period of time for the accounting that may not be longer than six years and may not include dates before April 14, 2003.

Right to Opt-Out of Receiving Fundraising Information and Solicitation: In order to opt-out of receiving fundraising information from Crossnore, you need to follow the directions provided with the mailing. The options shall include responding to the email, calling the agency, or contacting the agency in writing.

Right to Paper Copy of this Notice: You have the right to a paper copy of this Privacy Notice. You may ask us to give you a copy of this Privacy Notice at any time by requesting a copy from a front desk staff member.

Changes to this Notice: Crossnore reserves the right to change this notice. Crossnore reserves the right to make the revised notice effective for medical information that Crossnore already has about you as well as any information we will receive in the future. Crossnore will post a copy of the current notice at the facility and on its website. The notice will contain the effective date at the bottom of each page. Crossnore will make you aware of any revisions by posting a revised notice in above-mentioned areas.

Violations or Concerns

If you are concerned that we have violated your privacy rights, or you disagree with a decision we made about your records, you may contact the person listed below.

You may also send a written complaint to the Secretary U.S. Department of Health and Human Services, Office of Civil Rights. The person listed below will provide you with the appropriate address upon request. You will not be penalized in any way for filing a complaint.

Privacy Contact: If you have any questions, requests, or complaints please contact:

Crossnore Communities for Children
Teresa Huffman
PO Box 249
Crossnore, NC 28616-0249
Phone: (828) 733-4305
Fax: (828) 733-3250
Email: thuffman@crossnore.org

The North Carolina Department of Health and Human Services operates an information and referral service located in the Office of Citizen Services, known as CARE-LINE, which has been designated to receive and document complaints and concerns regarding your privacy. Contact information is as follows:

2012 Mail Service Center
Raleigh, NC 27699-2012

Voice Phone (English and Spanish):
1-800-662-7030 (Toll Free)
(919) 733-4261 (Triangle Area and Out of State)
FAX: (919) 715-8174
TTY: 1-877-452-2514 (TTY Dedicated)
(919) 733-4851 (TTY Dedicated for local or out-of-state calls)

Email: care.line@ncmail.net

You may also send a written complaint to the United States Secretary of the Department of Health and Human Services. Contact information is as follows:

Office for Civil Rights
U.S. Department of Health and Human Services
Atlanta Federal Center, Suite 3B70
61 Forsyth Street, S.W.
Atlanta, GA 30303-8909

Voice Phone: (404) 562-7886
FAX: (404) 562-7881
TDD: (404) 331-2867

If you file a complaint, we will not take any action against you or change the quality of health care services we provide to you in any way.

You have the right to contact Disability Rights North Carolina, formerly named North Carolina Protection and Advocacy System (GACPD), for assistance in protecting and advocating for the rights of persons with disabilities:

Disability Rights North Carolina
2626 Glenwood A
venue Suite 550
Raleigh, NC 27608

Telephone Voice: (919) 856-2195; Toll Free Voice (877) 235-4210
TTY: (888) 268-5535
Fax: (877) 235-4210
Email: info@disabilityrightsnc.org
Internet Location: http://www.disabilityrightsnc.org/

Legal References

Primary Federal and State laws and regulations that protect the privacy of your health information are listed below.

  • Confidentiality of Alcohol and Drug Abuse Patient Records – 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for Federal regulations.
  • Health Insurance Portability and Accountability Act (HIPAA), Administrative Simplification, Privacy of Individually Identifiable Health Information – 42 U.S.C. 1320d-1329d-8 and 42 U.S.C. 1320d-2(note) for Federal laws and 45 CFR Parts 160 and 164 for Federal regulations.
  • NC General Statutes – Chapter 122C, Article 3 (Client’s Rights and Advance Instruction), Part 1