Privacy Policy

Hillcrest Family Services
Notice of Privacy Practices
Effective Date: April 14, 2003
Revised September 5, 2013


If you have any questions about this notice, please contact our Privacy Officer at (563) 583-7357


This notice describes our agency’s practices and that of:

Hillcrest sites and programs follow the terms of this notice except those listed above. In addition, these sites and programs may share health information with each other for treatment, payment or agency operations purposes described in this notice.

We understand that health, including mental health, information about you is personal. We are committed to protecting your health information. We create a record of the care and services you receive at Hillcrest. We need this record to provide you with quality care and to follow certain legal requirements. This notice applies to all of the records of your care created by Hillcrest.
This notice will tell you about the ways in which we may use and give out health information about you. We also explain your rights and the responsibilities we have regarding the use and giving out of health information.

We are required by law to:

The following list describes different ways we use and give out health information. We provide examples to explain each way that health information could be used or given out. Not every use or disclosure in a category will be listed. However, all the ways we are allowed to use and give out information will fall within this list.

For Treatment.
We may use health information about you to provide you with health care, treatment or services. We may give out the minimum necessary health information about you to doctors, nurses, technicians, health care interns or students, clergy, social workers, counselors, direct care staff, pharmacists or others who are involved in your care. For example, clinicians providing you a service need to be aware of those events in your past, which have caused you emotional or psychological harm. Different departments of this agency also may share health information about you in order to coordinate your medical or mental health treatment. Counselors, therapists, mental health technicians may disclose health information about you to their supervisor or the Clinical Director during a case consultation with the intent of improving current services and preparing for aftercare.

For Payment.
We may use and give out health information about you so that the treatment and services you receive from Hillcrest Family Services may be billed to and payment may be collected from you, an insurance company or a third party such as a county. For example, we may need to give your insurance plan information about the services you received at Hillcrest so your health plan will pay us for the service. We may also tell your health plan about a treatment you are going to receive in order to get prior approval or to determine whether your plan will cover the treatment.

For Health Care Operations.
We may use and give out health information about you for agency operations. These uses and disclosures are necessary to run the agency and make sure that all of the individuals being served receive quality care. For example, we may use health information to send satisfaction surveys or gather data to improve our programs here at Hillcrest. Personal health information will be taken out unless it is necessary for state staff or other persons to review our work.

Individual’s records will be handled by authorized people and stored in a designated secured area. Only authorized people will have access to both open and closed files.

During a meeting with a supervisor, health information may be shared when discussing your treatment needs. Individuals involved during a supervision meeting may include the Clinical Director, the therapist you work with, referring worker, a nurse, family/support individual, a psychologist or psychiatrist or direct care staff such as a youth care worker.

Appointment Reminders.
We may use and give out health information to contact you as a reminder that you have an appointment for services at Hillcrest, except for the Hillcrest Professional Health Clinic.

Business Associates.
There are some services provided in our organization through contracts with business associates. Examples include financial audits, computer software vendors, etc. We may disclose your health information to our business associates so they can perform the job we’ve asked them to do. To protect your health information, however, we require the business associate to appropriately safeguard your information.

Treatment Alternatives.
We may use and give out health information to tell you about possible treatment options that may be of interest to you.

Health-Related Benefits and Services.
We may use and give out information to tell you about health-related benefits, health services or health education classes that may be of interest to you.

Fundraising Activities.
We may use certain information (name, address, telephone numbers, dates of services, age and gender) to contact you in the future to raise money for Hillcrest to improve the programs we provide to the community. You have the right to opt out of receiving fundraising communications. If you do not want Hillcrest to contract you for fundraising, you must notify the Privacy Officer at (563)583-7357.

Hillcrest Directory of Persons Served.
Hillcrest keeps a list of persons we have served or are serving. The information on the list includes name, program, date of admission, and discharge, general condition and religious affiliation. This information is used primarily for the receptionist to get phone calls and mail to you in the correct program. This information, except for your religious affiliation may be released to people who ask for you by name. Your religious affiliation may be given to members of clergy, such as a minister, priest or rabbi. We may also give out health information about you to the Red Cross or other agencies, helping with a disaster relief effort (fire, tornado) so that your family can be told about your location and condition. If you do not want to be included in the directory, or you want to restrict the information we include in the directory, you much notify the Privacy Officer at (563)583-7357 of your objection.

Individuals Involved in Your Care or Payment for Your Care.
We may release health information about you to a caregiver that may be a friend or family member who is involved in your care. We will release only that information that is directly relevant to that person’s involvement in your care. We may also give information to someone who helps pay for your care. If there is a family member, or other relative, or close personal friend that you do not want to receive health information about you, please notify the Privacy Officer at or tell our staff member who is providing care to you.

Sometimes, with your written permission, we may use and give out health information about you for research purposes. For example, a research project may involve comparing the health and recovery of all individuals who have received one type of treatment to those who have received another, for the same condition. All research projects, however, are subject to a special approval process. We will ask for your specific permission if the researcher will have access to your name, address or other types of information.

As Required By Law. We will give out health information about you when required to do so by federal, state or local law.


If you are a member of the armed forces, we may give out health information about you as required by military authorities. We may also give out health information about foreign military personnel to the appropriate foreign military authority.

Workers’ Compensation.
We may give out health information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Public Health Risks (Health and Safety to you and/or others).
We may give out health information about you for public health activities. We may use and give out health information about you to agencies when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. These activities generally include the following:

Health Oversight Activities.
We may give out health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections and licensure. These activities are necessary for the government to oversee the healthcare system, government programs and follow civil rights laws.

Lawsuits and Disputes.
If you are involved in a lawsuit or a dispute, we may give out health information about you in response to a court or administrative order. We may also give out health information about you in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute.

Law Enforcement.
We may give out health information if asked to do so by a law enforcement official:

National Security and Intelligence Activities.
We may give out health information about you to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law.

Protective Services for the President and Others.
We may give out health information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations for their protection.

If you are an inmate of a jail or prison or under the custody of a law enforcement official, we may give out health information about you to the jail, prison or law enforcement official. This release would be necessary (1) for the jail or prison to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Certain Uses and Disclosures that Require Your Written Authorization

Psychotherapy Notes.
Your authorization is required before we may use or disclose psychotherapy notes unless the use or disclosure is: (a) by the originator of the psychotherapy notes for treatment; (b) for our own training programs for students, trainees, or practitioners in mental health; (c) to defend ourselves in a legal action or other proceeding brought by you; (d) when required by law; or (e) permitted by law for oversight of the originator of the psychotherapy notes.

We may use and disclose medical information about you to communicate with you about a product or service to encourage you to purchase the product or service. Generally, this may occur without your authorization. However, your authorization is required if: (a) the communication is to provide refill reminders or otherwise communicate about a drug or biologic that is, at the time, being prescribed for you and we receive any financial remuneration in exchange for making the communication which is not reasonably related to our cost in making the communication; or, (b) except as stated in (a), we use or disclose your health information for marketing purposes and we receive direct or indirect financial remuneration from a third party for doing so. When an authorization is required to communicate with you about a product or service, the authorization will state that financial remuneration to Hillcrest is involved.

Sale of Information.
Your authorization is required for any disclosure of your health information when the disclosure is in exchange for direct or indirect remuneration from or on behalf of the recipient of the health information. However, your authorization may not be required under certain condition if the disclosure is: (a) for public health purposes; (b) for research purposes; (c) for treatment and payment; (d) if we are being sold, transferred, merged or consolidated; (e) to a business associate of ours for activities undertaken on our behalf; (f) to you when requested by your; (g) required by law; (h) when permitted by applicable law where the only remuneration received by us is a fee permitted by law.

Other Uses and Disclosures.
Other uses and disclosures will be made only with your written authorization. You may revoke such an authorization at any time by notifying the Privacy Officer in writing of your desire to revoke it. However if you revoke such an authorization, it will not have any effect on action taken in reliance on the prior authorization.

You have the following rights regarding health information we collect about you:

Right to Inspect and Copy.

Right to Amend.
If you feel that health information we have about you is incorrect or incomplete, you may ask us to correct the information. You have the right to request a correction for as long as the information is kept by or for Hillcrest.

To ask for a correction, you must do so in writing and give it to the Privacy Officer. In addition, you must have a reason that supports your request.

We may deny your request for correction if it is not in writing or does not include a valid reason to support the request. In addition, we may deny your request if you ask us to change information that:

If we deny your request we will inform you of the basis for the denial. You will have the right to submit a statement disagreeing with our denial. We may prepare a rebuttal statement. Your request for amendment, our denial, your statement of disagreement, if any, and our rebuttal, if any, will be included with any subsequent disclosure of the health information, or at our election, we may include a summary of the request and denial. If you do not submit a statement of disagreement, you may ask that we include your request for amendment and our denial with any future disclosures of the information.

Right to an Accounting of Disclosures.
You have the right to request an “accounting of disclosures.” This is a list of the times we gave out health information about you to others except for purposes of treatment, payment and operations identified above. Certain types of disclosures are not included in such an accounting such as: (a) Disclosures to carry out treatment, payment and health care operations; (b) Disclosure of health information made to you; (c) Disclosures incident to another use or disclosure; (d) Disclosures that you have authorized; (e) Disclosures for our facility directory or to persons involved in your care; (f) Disclosures for disaster relief; (g) Disclosures for national security or intelligence purposes; (h) Disclosures to correctional institutions or law enforcement officials having custody of you; (i) Disclosures that are part of a limited data set for purposes of research, public health or health care operations; and (j) Disclosures made prior to April 14, 2003.

To request this list or accounting of disclosures, you must submit your request in writing to the Privacy Officer. Your request must state a time period, which dates before April 14, 2003. Your request should tell us in what form you want the list (for example, on paper or electronically). You may ask for one free list in a 12-month time period. For additional lists, we may charge you for the costs of providing the list. We will tell you the cost and you may choose to change your request at that time before any costs are added.

Right to Request Restrictions.
You have the right to ask for a limitation on the health information we use or give out about you for treatment, payment or health care operations. You also have the right to ask for a limit on the health information we give out about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, if you are a patient of the Professional Hillcrest Clinic, you could ask that we not use or give out information about your care.

We are not required to agree to your request. If we do agree, we will accept your request unless the information is needed to provide you emergency treatment. The foregoing notwithstanding, we will always agree to a request to restrict disclosures to a health plan if the information relates solely to a health care item or service for which you, or someone on your behalf (other than the health plan) have paid us in full.

To ask for restrictions, you must make your request in writing to the Privacy Officer. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit the use or giving out of health information or both or (3) to whom you want the limits to apply, for example, giving out information to your wife or husband.

You may write to us at:
Privacy Officer
Hillcrest Family Services
2005 Asbury Road
Dubuque, Iowa 52001

Right to Request Confidential Communications.
You have the right to ask that we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work, home or by mail.

To ask for confidential communications, you must make your request in writing to the Privacy Officer. We will not ask you the reason for your request. We will accept all reasonable requests. Your request must tell us how or where you wish to be contacted.

The exception to this section is the Professional Health Clinic which can receive information regarding confidential communications directly.

Privacy Practices PDF