Notice of FirstSteps Privacy Practices

This notice describes how medical and behavioral health information about your child may be used and disclosed and how you may access this information.

Please review carefully.

If you have any questions about this Notice, please contact our Director of Operations.

FirstSteps Commitment to Protecting Privacy

FirstSteps for Kids, Inc. ("FirstSteps") is required by law to maintain the privacy and security of your child’s protected health information ("PHI") which includes any and all written, audio, and/or visual information about your child, their treatment, or health history that would enable their identification. We are also required to provide you with this Notice of Privacy Practices ("Notice") and must abide by the terms of this Notice, including notification should a breach of your child’s unsecured PHI occur.

Except for the specific purposes set forth below, FirstSteps will use and disclose your child’s PHI only with your written authorization ("Authorization"). As parent / legal guardian of your child, you have the right to revoke an Authorization at any time by providing FirstSteps written notice of your revocation.

Permitted Uses and Disclosure of PHI:

Per law, there are some activities and reasons for which FirstSteps may share your child’s PHI without your written authorization including:

• Treatment: FirstSteps may use your child’s PHI within our agency to provide your child with behavioral health treatment. This includes discussing or sharing your child’s PHI with any FirstSteps employee.
• Payment: FirstSteps may use and disclose your child’s PHI to bill and collect payment for the treatment and services provided. This may include certain activities that your funding entity (health insurance, regional center, and/or school district) may undertake before it approves or pays for the treatment services we have prescribed for your child. When accessing a funding entity for payment of services, you will be required to agree to their terms regarding your child’s PHI and the processes they require FirstSteps to use for the provision and billing of services. This may include our use of their secure portals, clearinghouses, fax transmissions, peer reviews, and paper invoicing.
• General Operations: FirstSteps may use and disclose your child’s PHI to operate and support the business activities of our practice. These activities include but are not limited to quality assurance, scheduling, accounting, and security practices. When contracting with non-FirstSteps employees / providers (e.g., attorneys, consultants, or others working to improve our operations), a Business Associate Agreement ("BAA") will be secured that contractually bounds all parties to protect and keep confidential any and all PHI.
• Patient Incapacitation or Emergency: FirstSteps may disclose your child’s PHI to others in the case of an emergency wherein your child’s health and wellbeing is at risk.
• Public Health: If requested, FirstSteps will disclose your child’s PHI to a public health authority that is permitted by law to collect or receive the information.
• Communicable Diseases: FirstSteps will disclose your child’s PHI, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition.
• Health Oversight: FirstSteps may disclose your child’s PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, government regulatory programs, and civil rights laws.
• Abuse or Neglect: FirstSteps will disclose PHI to a public health authority that is authorized by law to receive reports of suspected abuse or neglect, if we suspect that your child, his or her siblings, or any member of the home may have been a victim of abuse, neglect, or domestic violence. All disclosures will be made consistent with the requirements of applicable federal and state laws.
• Legal Proceedings: FirstSteps may disclose your child’s PHI in the course of any judicial or administrative proceeding, in response to a court order or administrative tribunal (to the extent that such disclosure is expressively authorized), or in certain conditions in response to a subpoena, discovery request, or other lawful process.
• Workers’ Compensation: FirstSteps may disclose your child’s PHI as authorized to comply with workers’ compensation laws and other similar legally established programs.
• Others Involved in Care or Payment: FirstSteps may share your child’s PHI to a friend or family member involved in his or her care including babysitters, family members, or respite workers unless you object in whole or in part. The opportunity to consent may be obtained retroactively in emergency situations.

Other uses and disclosures of your child’s Protected Health Information will be made only with your written authorization and consent, unless otherwise permitted or required by law.

You may revoke your authorization in writing at any time. If you revoke your authorization, we will no longer use or disclose your child’s PHI for the reasons outlined by your revocation of your written authorization. FirstSteps is unable to withdraw any disclosures already made prior to revoking of your authorization.

Your Rights Regarding Your Child’s PHI

The following is an explanation of your rights with respect to your child’s Protected Health Information and a brief description of how you may exercise these rights.

• Confidential Communication: You have the right to request that FirstSteps communicate with you about your child in a particular manner. You may ask that we only contact you at home rather than at work or by email rather than phone. You may make a written reasonable request and need not provide a reason.
• Requesting Restrictions: You have the right to restrict or limit disclosure of your child’s PHI for the purposes of treatment, payment, or health care operations. You may also request that your child’s PHI not be shared or disclosed to family members, friends, and caretakers involved in your child’s daily care. Your request must state the specific restriction requested and to whom you want the restriction to apply.
• Inspection and Copies: You have the right to inspect and obtain a copy of your child’s PHI that is used to guide their treatment. To access these records, please submit a written request to your child’s Program Director or to our Director of Operations. FirstSteps charges a nominal fee for this service which includes copying, mailing, supplies, and administrative labor. FirstSteps must retain the original documents. Under federal law, you may not inspect or copy informal therapy notes or information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding.
• Amendment: You have the right to request FirstSteps amends your child’s health record if you believe it is incorrect or incomplete. In certain cases, we may deny your request for an amendment. If your request is denied, you have the right to file a statement of disagreement and FirstSteps will prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal. Please contact your child’s Program Director or our Director of Operations if you have questions or would like to request your child’s record be amended.
• Accounting of Disclosures: You have the right to request an accounting of non-routine disclosures made by FirstSteps regarding your child’s PHI. Use of your child’s PHI as part of routine care or routine organizational operation (e.g., scheduling, billing) is not required to be documented. To obtain an Accounting of Disclosures, please submit a written request to either your child’s Program Director or our Director of Operations. When making a request, you must state the time period of your request, which may not exceed 6 years from the date of the disclosure and may not include dates prior to January 3, 2005.
• Receive a Copy of our Notice of Privacy Practices: You have the right to request and receive a copy of our Notice of Privacy Practices at any time. To obtain another copy, please contact our Director of Operations.
• Complaints: You have the right to file a complaint if you believe FirstSteps has violated your child’s privacy rights. To file a complaint, you may submit a written statement to your child’s Program Director or our Director of Operations. Alternatively, you may file a written complaint with the Department of Health and Human Services. By filing the complaint with FirstSteps, we appreciate the opportunity to address your concerns directly and expeditiously. There will be no retribution or retaliation for filing a complaint.
• Authorizations for Other Uses and Disclosures: You have the right to submit additional authorizations for uses and disclosures not specified in this notice or permitted by law. Further, any and all authorizations for uses and disclosure of your child’s PHI may be revoked at any time with a written request. Though use and disclosure will stop per your request, we are required by law to retain the original authorization to use and disclose PHI as these documents are part of your child’s medical and behavioral health record.

Our Notice of FirstSteps Privacy Practices was first published in 2005 with the current Notice herein updated and commenced on March 26, 2024. FirstSteps reserves the right to change the terms of our Notice at any time. If amended, the new Notice will be effective for all protected health information that we maintain at that time.