Employee Health – HIPAA Notice of Privacy Practices

Effective Date: July 1, 2025 (Updated)
Privacy Officer: Executive Director, Disability Services, Inc. dba Envida
Contact: (719) 633-4601


Introduction: Our Commitment to Your Privacy

We are committed to protecting your Protected Health Information (PHI) any information that identifies you and relates to your health, care, or payment for care.
 This Notice describes:

  • How we may use and disclose your PHI.
  • Your rights regarding your PHI.
  • Our obligations under federal and Colorado law.

You have important rights, and we have important responsibilities. Please review this Notice carefully.


Our Legal Duties

By law, we must:

  • Maintain the privacy and security of your PHI.
  • Provide you with this Notice explaining our practices.
  • Follow the terms of this Notice until it is updated.
  • Notify you promptly if a breach compromises the privacy or security of your PHI.

How We May Use and Disclose Your PHI Without Authorization

We may use or share your PHI for the following purposes:

Treatment

To provide, coordinate, or manage your care.
Example: Sharing information with a specialist about your diabetes management.


Payment

To bill and receive reimbursement.
Example: Sending diagnostic codes to your insurance for a covered service.


Health Care Operations

For administrative functions like quality improvement, audits, and compliance.
Example: Reviewing documentation to ensure staff follow best practices.


Appointment Reminders & Benefits

We may remind you of appointments or inform you of wellness benefits.


Public Health and Safety

We may disclose information when required for:

  • Reporting disease, injury, or vital events (births, deaths).
  • Reporting suspected abuse, neglect, or domestic violence.
  • Preventing or controlling disease outbreaks.

Law Enforcement & Legal Proceedings

We may disclose PHI when required by:

  • A court order or subpoena.
  • Law enforcement investigating a crime.
  • Correctional institutions when you are in custody.

Special Situations with Stronger Protections

Reproductive Health Privacy (NEW in 2025)

We cannot disclose information related to reproductive health services unless specifically required by law. This includes contraception, fertility, pregnancy, and related care.


Substance Use Disorder Records (42 CFR Part 2)

Records relating to substance use disorder services are protected by stricter federal rules and require written consent for most disclosures.


Security Rule Enhancements (Pending Finalization)

We are adopting stronger safeguards, including:

  • Multi-factor authentication (MFA) for PHI access.
  • Encryption of electronic records.
  • Annual cybersecurity risk assessments.
  • Formal incident response planning.

Uses Requiring Your Written Authorization

We need your authorization before using or disclosing PHI for:

  • Marketing purposes.
  • Sale of PHI.
  • Most disclosures beyond those listed in Sections 3 and 4.

You may revoke authorization at any time in writing.


Your Rights Regarding Your PHI

You have the right to:

  • Access & Copies: Inspect or get copies of your medical records (paper or electronic).
  • Electronic Access: Request your records in an electronic format or direct them to another person/entity.
  • Amend Records: Request corrections if your PHI is incomplete or inaccurate.
  • Restrict Use: Request restrictions on disclosure, including blocking disclosures to your insurance if you paid out-of-pocket.
  • Confidential Communications: Ask us to contact you at a specific place or method (e.g., at work, by mail only).
  • Accounting of Disclosures: Request a list of non-routine disclosures (who accessed your PHI and why).
  • Breach Notification: Receive notice if your PHI is involved in a breach.
  • Paper Copy of Notice: Even if you agree to electronic, you may request a paper copy anytime.

All requests must be made in writing to the Privacy Officer.


Complaints

If you believe your rights have been violated, you may file a complaint:

  • With us: Executive Director, Disability Services, Inc. dba Envida, 5660 N. Academy Blvd, Colorado Springs, CO 80918
  • Or with the U.S. Department of Health & Human Services.

You will not be penalized for filing a complaint.


Changes to This Notice

We may change this Notice at any time. Updates will apply to all PHI we maintain, including prior records. Updated Notices will be:

  • Posted in our office.
  • Available on our website.
  • Provided upon request.