Under HIPAA, you have several specific rights regarding your health information. Some of these rights require you to contact HCPH in writing in order to exercise them. If you are required to contact HCPH in order to exercise your rights, please submit your written request to the Health Information Management Office, Harris County Public Health Services, 1111 Fannin St., Houston, Texas, 77002. You have the right to:

• Authorize the use or disclosure of your health information or any health information from which you could be identified.  You may revoke your authorization at any time except to the extent that action has already been taken on your previously authorized use or disclosure.  All revocations must be in writing and must be received by HCPH in order to be effective.
• Request a restriction on how HCPH may use or disclose your health information. However, HCPH is not required to agree to a requested restriction.
• Receive confidential communications of your health information from HCPH by asking that HCPH send those communications to you at a location other than the one HCPH has on file for you or by asking that HCPH communicate with you a different way.  For example, you might ask that HCPH contact you by mail rather than by telephone, or ask that HCPH contact you at work rather than at home.
• Inspect and obtain a copy of the health information about you that HCPH uses or stores. HCPH must respond to your request for a copy of your health information within fifteen (15) days after HCPH receives your request unless HCPH is unable to respond within that timeframe and has advised you of the estimated date by which HCPH will respond.  Additionally, HCPH may charge a reasonable fee to cover the costs of copying, mailing, labor, and supplies associated with your request.
• Request an electronic copy of your health information.  HCPH will make every effort to produce your health information in the electronic form or format you request.  HCPH may charge you a reasonable cost-based fee for the labor costs associated with providing you the electronic copy of your health information.
• Request that HCPH change (amend) your health information if you believe your health information is incorrect or incomplete. All requests for changes must be in writing. If you do not submit your request for a change in writing along with the proper documentation, HCPH will deny your request. In addition, your request will also be denied if you ask HCPH to change information that is:
  • Accurate and complete;
  • Not a part of the health information that is kept by or for HCPH; or
  • Not created by HCPH.

• Obtain an accounting of the disclosures of your health information that have been made by HCPH. This accounting of disclosures will not include any disclosures you have authorized or that are made for your treatment or payment or for HCPH’s healthcare operations (unless made through an Electronic Health Record, in which case you may request an accounting of TPO disclosures made through the EHR over the past three years).
• Be notified in the event of a breach of your health information.  If a breach of your health information occurs, and if that information is unsecured (for example, the information is on a computer that is not encrypted), HCPH will notify you promptly with the following information:
  • A brief description of what happened;
  • A description of the health information that was involved;
  • Recommended steps you can take to protect yourself from harm that might occur as a result of the breach;
  • The steps HCPH is taking in response to the breach, including what HCPH is doing to reduce the harm to you that might have been caused by the breach;
  • What HCPH is doing to prevent other similar breaches from occurring in the future; and
  • Contact information and procedures so you can obtain further information about the breach.
• Receive a paper copy of this Notice the first time you come to HCPH.  However, you may ask for, and HCPH will provide you with a copy of this Notice at any time.  You may download a copy of this Notice from the HCPH website at: http://publichealth.harriscountytx.gov/Services-Programs/Services/RecordsRequest.

* HCPH is required by both Texas law and HIPAA to protect the privacy of your health information.  This means that unless a use or disclosure of your health information is specifically allowed for under either Texas law or HIPAA (which we will explain to you in this Notice), HCPH may not use or disclose your health information or any health information from which you could be identified without first obtaining your written permission to do so.  If HCPH wants to use or disclose your health information we will contact you to ask you to sign an “Authorization to Release Protected Health Information (PHI)” which is described later in this Notice.  Similarly, if you contact HCPH to ask HCPH to disclose your health information to a specific individual or entity, we will ask you to sign the Authorization to Release Protected Health Information (PHI) before we disclose your health information.

* HCPH will ask you for written permission before HCPH uses or discloses your health information in ways other than those stated in this Notice.  If you give HCPH permission to use or disclose your health information, you may revoke it at any time, but HCPH will not be liable for uses or disclosures already made in accordance with your written permission.

* HCPH may change this Notice in the future.  You can always request the most current version of this Notice, and the most current version will be available at HCPH facilities and on the HCPH website.  If you come to our facilities after we change our Notice, HCPH will offer to provide you with the updated version.  HCPH will honor the terms of the Notice that is currently in effect.

The following categories describe the different ways in which HIPAA allows HCPH to use and/or disclose your health information without your authorization.  This is not an exhaustive list of every type of use or disclosure that HCPH is permitted to make, but the different ways HCPH is permitted to use and disclose your health information do fall within one of the following categories.

1. Treatment
   HCPH will use and disclose your health information as necessary to provide, coordinate, or manage healthcare or related services.  This includes providing care to you, consulting with another healthcare provider about you, and referring you to another healthcare provider.  For example, HCPH may disclose your health information to refer you to a high-risk clinic or a hospital for additional healthcare services.  HCPH may also contact you to remind you of an appointment or to tell you about other health-related information that may be of interest to you.
2. Payment
   HCPH may use or disclose your health information to pay or to collect payment for your healthcare.  For example, HCPH can use or disclose your health information to bill your insurance company, Medicaid, or other funding sources such as the Texas Department of State Health Services for the healthcare services that HCPH provided to you.
3. Health Care Operations
   HCPH may use or disclose your health information for healthcare operations.  Examples of healthcare operations include:
   1. Conducting quality assessment, improvement activities, training healthcare professionals; 
   2. Coordinating and managing care; and 
   3. Performing HCPH’s general administrative activities.
4. Family Member, Other Relative, Personal Representative, or Close Personal Friend
   HCPH may disclose your health information to your family members, other relatives, your personal representative, or a close personal friend.  A personal representative is a person who has legal authority to act on your behalf regarding your healthcare.  However, HCPH will only disclose your health information to your family members, other relatives, your personal representative, or a close personal friend when the health information being disclosed is related to that person’s involvement with your care or payment for your care and you have been given an opportunity to stop or limit the disclosure before it happens.
5. Business Associates
   HCPH may disclose your health information to a business associate of HCPH.  HCPH business associates are individuals or entities that are not employees of HCPH but they perform certain functions for HCPH or provide certain services to HCPH.  HCPH has a contract with each of its business associates and this contract prohibits the business associate from using or disclosing any health information that they receive from HCPH or that the business associate creates for HCPH for reasons other than those specified in the contract.  In other words, your health information might be used by, created by, stored at, or disclosed to a business associate, but the business associate can use it only on HCPH’s behalf.  For example, HCPH entered into a contract with Harris Health System (HHS) to allow HCPH to use HHS’s Electronic Medical Record System.  All of HCPH’s patients’ medical records are disclosed to HHS and are stored on HHS computers, but the contract prohibits HHS employees from accessing or using any of HCPH’s patients’ medical records unless the patient is a patient of both HCPH and HHS.
6. As Required by Law
   HCPH will use or disclose your health information when required to do so by federal, state, local, or any other applicable law.  For example, HCPH must disclose your health information to the U.S. Department of Health and Human Services when the Department wants to determine whether HCPH is in compliance with HIPAA.
7. Public Health
   HCPH may disclose your health information for purposes of preventing or controlling disease, injury, or disability, or to report vital statistics, or to report problems with FDA-regulated products or activities.
8. Victims of Abuse, Neglect, or Domestic Violence
   If HCPH believes that you are or that you have been the victim of abuse, neglect, or domestic violence HCPH will disclose your health information to the appropriate government authority but only to the extent such a disclosure is required or expressly authorized by Texas law or when you agree to HCPH making the disclosure.
9. To Avert a Serious Threat to Health or Safety
   HCPH may use or disclose your health information if HCPH believes the use or disclosure is necessary in order to prevent or lessen a serious and immediate threat to your health and safety or to the health and safety of the public or another person.
10. Health Oversight Activities
    HCPH may sometimes use or disclose your health information for health oversight activities.  Health oversight activities include audits, inspections, and investigations that are authorized by law or are necessary for governmental oversight of the healthcare system.  For example, HCPH may disclose your health information to the Centers for Medicare and Medicaid Services (CMS) if CMS is investigating a physician who is suspected of engaging in Medicare or Medicaid fraud.
11. Research
    HCPH may use or disclose your health information for research purposes, but only if the HCPH Institutional Review Board has approved the research study.  HCPH will only disclose information that can be used to identify you when the research that is being conducted could not be conducted without the identifying information.
12. Purposes Relating to Death
    HCPH may disclose your health information to (1) hospitals for the purpose of organ transplants, (2) coroners or medical examiners to identify a deceased person or to determine the person’s cause of death, and (3) funeral directors as necessary for their duties.
13. Eye, Organ, or Tissue Donation
    HCPH may disclose your health information to organizations that handle organ and tissue procurement, banking, or transplantation if your information is needed because you are listed as an organ donor.
14. Judicial and Administrative Proceedings
    HCPH may disclose your health information in response to a valid subpoena, discovery request, or other lawful process by someone else involved in a lawsuit in which your health information is at issue, but HCPS will only do so after HCPH makes reasonable efforts to tell you about the request or if we obtain a court order protecting the health information that is requested by the subpoena, discovery request, or other lawful process.
15. Law Enforcement Purposes
    HCPH will not disclose your health information to a law enforcement official unless the law enforcement official provides HCPH with valid legal process (court order, warrant, etc.) that meets the strict requirements of HIPAA and 42 CFR Part 2.
16. Military and Veterans, National Security and Intelligence Activities, and Protective Services for the President and Others
    If you are a member of the armed forces, HCPH may disclose your health information as required by military command authorities.  HCPH may also disclose your health information to authorized federal officials (1) for intelligence, counter-intelligence, and other national security activities authorized by law and (2) to provide protection to and conduct special investigations of threats against the President or other authorized persons.
17. Workers’ Compensation
    HCPH may disclose your health information to comply with laws relating to workers’ compensation or other similar programs (that provide benefits for work-related injuries or illnesses).
18. Dental Services
    If you are a patient of our dental program, we may disclose your health information to dentists, dental hygienists, and dental assistants or client service specialists for your care. We may also share your information with specialists (such as oral surgeons or orthodontists) as necessary to complete your treatment plan.
19. Substance Use Disorder (SUD) Records (42 CFR Part 2 Updates)
    Consistent with federal updates to 42 CFR Part 2 and HIPAA, if you receive treatment for a Substance Use Disorder (SUD) from a Part 2 program within HCPH, we may use and disclose your SUD records for Treatment, Payment, and Health Care Operations once you have provided a single written consent. Once disclosed for these purposes, your information may be redisclosed by lawful holders (such as insurance plans) in accordance with HIPAA standards. However, your SUD records will not be used to criminally investigate or prosecute you without a specific court order and subpoena.
20. Reproductive Health Care
    HCPH is prohibited from using or disclosing your health information for the purpose of conducting a criminal, civil, or administrative investigation into, or imposing liability on, any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care.  

Other than the uses and disclosures described above, HCPH will not use or disclose health information about you without first obtaining an “Authorization to Release Protected Health Information (PHI)” that is signed by you or, if you are unable to sign the Authorization, by your personal representative.

Harris County Public Health (HCPH) will not sell your health information. HCPH will not use or disclose your health information for marketing purposes without your written authorization, unless allowed by law.  

In addition, certain types of health information about you cannot be released unless they are specifically identified on the Authorization and you specifically designate them for disclosure (or unless their release is required by law). Those “special” categories include: (1) HIV/AIDS information; (2) mental health information; and (3) psychotherapy notes. Note regarding SUD Records: While 42 CFR Part 2 now allows SUD records to be used for Treatment, Payment, and Operations after your initial consent, a specific authorization is still generally required for disclosures to employers or for legal proceedings unrelated to your healthcare.  

If you sign an Authorization allowing HCPH to disclose your health information, you may later revoke (or cancel) that Authorization provided you do so in writing. If you would like to revoke your authorization, you need to send a letter to the Health Information Management Office in which you tell HCPH the Authorization(s) you want to revoke. If you revoke your Authorization, we will follow your instructions except to the extent that we have already relied on your prior Authorization and taken some action.

HCPH may send text messages related to appointments, public health programs, campaigns, or other health-related information. Participation in text messaging is voluntary. HCPH does not collect personal information through SMS. Messages may direct you to call HCPH or visit our website, but no information is gathered through the texting process itself. HCPH may use a third-party vendor to deliver SMS messages. These vendors may process limited technical information such as message routing or delivery status for operational purposes. HCPH does not sell or monetize SMS-related data. Message frequency varies depending on the program or campaign. Standard message and data rates may apply. You may opt out of text messages at any time by replying STOP. For help, reply HELP or contact HCPH at 713-439-6000.

By providing your cell phone number, you agree to receive texts to your number from Harris County. Texts will include messages about public health alerts, community health programs and resources, vaccination and wellness events, clinic hours, and service updates. Msg frequency varies. Reply STOP to opt out. Reply HELP for help or more information. Msg and data rates may apply.