Notice of Privacy Practices

This Notice of Privacy Practices and HIPAA Release Form provides information about how Mount Prospect Academy (MPA) may use and disclose client Protected Health Information (PHI). The Notice describes your rights as a client or their authorized representative. You have a right to review this document before signing, and a copy will be provided to you upon request.

Allowable Disclosures:

MPA is permitted under HIPAA Rules to share your PHI for purposes of:

  • For treatment: to manage and coordinate treatment and ensure continuity of care;
  • For payment: to bill for services, including releasing information about your diagnosis, treatment, and services to your insurance company;
  • For health care operations: to maintain business operations, including tracking service delivery, assessing service quality, staff education and training, and recordkeeping;
  • Your records will be available to MPA staff on a need-to-know basis. The organization’s quality improvement staff reviews client records to ensure compliance with agency recordkeeping policies. MPA staff may use your information to contact you for appointment reminders or share other important information;
  • Business associates of MPA that perform services related to treatment, payment or health care operations may also have access to your information solely for the purpose of providing such services. Business associates must agree, in writing, to maintain the confidentiality of such information. Business associates must also comply with applicable security practices required by law.

Required Disclosures:
MPA is legally required to disclose PHI in certain circumstances and may do so without first securing your permission. Examples include:

  • When required by state or federal law (including public health activities such as reporting on or preventing certain diseases).
  • When necessary, to prevent or lessen a serious or imminent threat to the client or others.
  • To report child, elderly, or incapacitated person abuse or neglect.
  • For disaster relief purposes, such as to notify family about the client’s whereabouts and condition.
  • When required by state and federal agencies to determine our compliance with requirements.
  • In connection with Workers’ Compensation claims.
  • To comply with a valid court order, subpoena, or other allowable legal request.
  • In emergency situations in which you are unable to indicate your preference, we may need to share information about you with other individuals or organizations to coordinate your care or notify your family.
  • For research in situations where PHI will not be disclosed in an identifiable manner.
  • To cooperate with conduct of national security intelligence activities


MPA will not disclose your private health information without your written consent except as described in the sections above.

MPA’s Responsibilities:

  • To protect and maintain the privacy and security of your protected health information.
  • Notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
  • Follow the duties and privacy practices described in this notice.
  • Provide a copy of this notice to you.
  • MPA reserves the right to change our privacy practices, if necessary. If our privacy practices change, the revised notice will be accessible on the agency website (, posted at agency offices, and available upon request from agency staff.

Your rights relative to confidentiality of your private health information:

  • Request restrictions on the use and disclosure of your information. MPA will honor all reasonable requests.  If you pay for a service in full, you can request that MPA not share information for the purpose of payment with your health insurer, unless a law requires us to do so.
  • Receive communications from MPA in a confidential manner. You may elect to allow communication via email, texting, or message left on a voicemail system.  You may elect to receive mail in a plain envelope rather than one with MPA identified in the return address.  MPA will honor all such reasonable requests.
  • Receive a list (accounting) of unauthorized disclosures of your information for six years prior to the date of your request. To receive such an accounting, please contact MPA at the address given below.  One accounting is provided free of charge every 12 months, but there may be a reasonable charge if you ask for another one within 12 months.
  • Request and authorize that your information be sent to other health care providers, agencies, or other persons. You may revoke this authorization at any time through verbal or written request, except to the extent that information has been disclosed based upon the previous authorization.
  • Review and/or receive a copy of your information, with some exceptions noted in our “Client Confidentiality” policy. If you wish to do so, we will provide you or others you select an opportunity to review your record within three (3) working days of such a request.  There is no charge for copying costs for records provided to service recipients or guardians.
  • Request to amend your information. If you wish to do so, please submit the proposed amendment in writing to your worker or clinician.  If approved, he/she will ensure your amended information is added to the record.  If we make any written response to your amended information, you will be given a copy.  If your request is declined, a written explanation of the reasons will be provided within 30 days.
  • Receive a paper copy of this Notice of Privacy Practices upon request. This notice may be revised, and the revised notice will be accessible on the agency website (, posted at agency offices, and available upon request from agency staff.
  • Choose someone to act for you in exercising your rights. For example, if you have a legal guardian, medical power of attorney, or Supported Decision-Making agreement the designated person can make choices about sharing your protected health information. MPA will make sure the person has this authority before we take any action in this regard.
  • File a complaint to MPA Family of Services, the state Dept. of Health & Human Services, or the U.S. Department of Health and Human Services if you believe your privacy rights have been violated (see contact information, below).
  • Be free from any form of retaliation by a MPA staff for filing a complaint or grievance. If you believe retaliation is occurring, please report this to MPA’s HIPAA Compliance Officer.