Your Right to Health Care Privacy

What is "protected health information" (PHI)?

HIPAA's (Health Insurance Portability and Accountability Act) privacy regulations require protection of individually identifiable health information. The regulations define "Protected Health Information" as information that relates to the:

  • Past, present, or future physical or mental health or condition of an individual.
  • Provision of health care to an individual.
  • Past, present, or future payment for the provision of health care to an individual.

Protection applies to information collected from the individual or received or created by a health care provider, health plan, health care clearinghouse, or employer, and is maintained or transmitted in any form or medium.

What information must be protected?

A wide range of information is considered personal and therefore Protected Health Information. This includes but is not limited to:

  • The fact that someone received treatment.
  • Claims information. 
  • Clinical information.
  • Demographic information in the context of health care.

There is no distinction between clinical and other types of information. All are protected under the law.

Consent rights of youth ages 14 and older

Where a minor at least 14 years of age or older is receiving services provided through CSOC, written authorization by the minor and/or parent/legal guardian is required to release protected health information to a provider or third party entity. Where more than one person in a family is receiving services provided through CSOC, any release of information is prohibited without written authorization by each family member receiving services who is at least 14 years of age or older and/or parent/legal guardian.

Absent a written authorization of each family member 14 years of age or older and/or parent/legal guardian, a provider should not disclose any information received from any family member.

Special privacy rules for substance use treatment services

Information about substance use treatment is protected under HIPAA and additional federal rules. These additional layers of privacy are designed to encourage individuals to seek substance use treatment by ensuring that information does not get shared with anyone without their consent. More information about these special privacy rules is available both in the substance use treatment section of this site and the Youth and Family Guide.

Releasing information

You will be asked at the beginning of treatment and at certain ongoing intervals to fill out forms with your service providers or PerformCare information that can be released, and to whom. This is one of the key ways we protect you and your child’s privacy. There are limited individuals we can release information to without written permission from you and/or your child. You can find out more information about the forms PerformCare may require, including a form that allows us to communicate with individuals you designate, on the forms page.

Requesting copies of records

Youth and families have the right to request a copy of their records and PerformCare complies with HIPAA privacy regulations for disclosure of Protected Health Information. A request for records must be submitted in writing to the Quality Improvement department at PerformCare stating what information is being requested and the reason for the request. Release of information requests are processed and mailed to you within 30 days. Youth age 14 and older and/or the parent/legal guardian must consent to the disclosure of their records. Families can call PerformCare at 1-877-652-7624 to obtain the Authorization for Disclosure of Health Information (PDF).