THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Definitions.

• “BHDD” means the South Carolina Department of Behavioral Health and Developmental Disabilities including its component offices which are the Office of Intellectual and Developmental Disabilities, the Office of Mental Health, and the Office of Substance Use Services.
• “Business Associate” means a person or entity, in providing a service to BHDD, who may receive PHI (e.g., consulting, computer services), but does not include an entity whose only relationship to BHDD is as a treatment provider. By the terms of the agreement with BHDD, a Business Associate must protect the privacy of PHI.
• “Designated Record Set” means a group of treatment and payment records containing PHI kept and used by BHDD, to be made available for inspecting/copying in accordance with the Notice.
• “HIPAA” means the Health Insurance Portability and Accountability Act.
• “PHI” means “Protected Health Information” which is any information that identifies a patient/client in any form (electronic, written, oral, etc.) collected, created, maintained, or received by BHDD relating to past, present, or future physical/mental health or condition, health care provided, or past, present, or future payment for provided health care. PHI specifically includes information related to a prospective or actual commitment for involuntary treatment under applicable law but normally does not include education or BHDD employment records.

Uses and Disclosures.

• Uses and disclosures of your PHI which you may request a restriction.
  • Treatment: We may use/share your PHI needed for your BHDD and other providers’ treatment or care (your diagnosis, medications, treatment plan, etc.), including PHI needed for case management, consultation, and referral with/to other treatment or care providers.
  • Payment: We may use/share PHI (treatment dates or types) to bill/be paid for treatment (insurance/Medicaid/Medicare or other payer). We may also share PHI with payers before we provide treatment to get their approval or find out if the type of treatment is covered.
  • Operations: We may use/share PHI for our operations, for example, sharing PHI between our offices to determine what services you need. We may sometimes share PHI for operations of agencies and organizations with health care accrediting or licensing authority.
  • General Notification: We may share with your caregiver, family, close friend, or person whom you identify: your name, location where you are receiving treatment, and your general condition. If you are in a BHDD hospital, ministers/clergy may be told your religion.
  • Persons Involved in Treatment/Payment: We may share PHI with your caregiver, family, close friend, person whom you identify, or other person involved in your treatment or payment as needed for your treatment or payment. It may also be used for identity verification.
  • Keep You Informed: We may phone, email, text, and/or mail you reminders for appointments, need for our services, treatment information, health care benefits, or related services and satisfaction surveys.
  • Authorization Required: For marketing purposes, sale of your PHI, and most sharing of psychotherapy notes, BHDD will never share your information unless you give us your written permission.
  • Fundraising: We may contact you for fundraising efforts, but you can tell us not to contact you again.
  • Disclosures to Others Not Subject to HIPAA: Some of the persons or organizations to whom we may disclose your PHI may not be subject to HIPAA. If your PHI is disclosed to such persons or organizations, it may no longer be protected by HIPAA and may be redisclosed by the recipient.
• Uses and disclosures of your PHI without a right to request a restriction.
  • Public Health and Health Oversight: We may share PHI with a public health authority such as the South Carolina Department of Public Health related to: prevention/control of disease, injury, or disability; births/deaths; or disease/condition. BHDD may share your PHI with the South Carolina Department of Social Services (“DSS”), law enforcement, or other agency authorized to receive abuse/neglect reports. We will normally let you know unless it would place you or others at risk. We may share PHI with the Food and Drug Administration to report adverse events. We may also share PHI with agencies authorized to receive reports for health oversight activities (such as the Department of Health and Human Services and South Carolina Attorney General) for audits, inspections, and investigations.
  • Lawsuits, Disputes, or Other Legal Proceedings: If you are involved in a legal proceeding, we may share PHI by a court order pursuant to S.C. Code Ann. §44-22-100(A)(2) or §44-26-130(A)(2), when disclosure is necessary for the proceeding and failure to disclose is against public interest. Without a court order however, a subpoena or other lawful process alone, normally does not permit PHI disclosure, unless from another public agency assuring that disclosure is necessary and that it has attempted to notify you or obtain an order protecting the subpoenaed PHI.
  • Law Enforcement: We may share PHI with law enforcement if required by law, such as reporting abuse/neglect; by court order, subpoena, warrant, or other lawful process; to identify/locate a suspect, fugitive, witness, missing person, or crime victim; suspicion as to cause of death; crime on our premises; crime when responding to emergency not on our premises; or a serious, imminent threat.
  • Research: We may share PHI for research (for example, a medication study) approved by an institutional review board after review of the research rules to ensure privacy of your PHI.
  • Serious Threat to Health or Safety and Disaster Relief: We may use or share PHI if needed to prevent a serious/imminent threat to your or another person’s health or safety. We will share PHI only to persons able to lessen/prevent the threat and limited to PHI necessary to lessen or prevent the threat. We may use/share PHI with a public or private entity authorized to assist in disaster emergency relief efforts.
  • Coroners/Medical Examiners, Funeral Directors, and Organ Donation: We may share PHI with a coroner/medical examiner to identify the deceased and determine cause of death. We may share PHI with funeral directors as needed to carry out their duties. If you are an organ donor, we may share PHI with applicable organizations.
  • Correctional Institution: If you are an inmate or otherwise under law enforcement custody, we may share PHI with the correctional institution or law enforcement as needed for your health care, your or other’s health or safety, or the institution’s safety/security.
  • National Security and Protection for the President: We may share PHI with authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law. BHDD may also share your PHI with authorized federal officials to provide protection to the President, other authorized persons or foreign heads of state or to conduct special investigations.
  • Military and Veterans Affairs (“VA”): If you are in the military, we may share PHI as required by military command authorities, including foreign military authority. We may release PHI for VA determination of veteran’s benefit eligibility.
  • Court Ordered Treatment, Evaluation, or Emergency Admission: We may use/share your PHI as needed for your emergency admission, judicial admission or commitment, or other court ordered treatment or evaluation. We may share your PHI as needed for participants in such proceedings upon evidence of their appointment/authority, including judges, designated examiners, your attorney, and guardian ad litem.
  • Workers’ Compensation: We can use or share PHI about you for workers’ compensation claims.
  • DSS: If you are in the DSS system BHDD may share your PHI with DSS to coordinate and help prevent lapses in services. Information shared includes referral to OIDD, eligibility status, waiver type, your provider’s information, your OIDD case manager’s information, etc.
  • Business Associates: We may share your PHI with Business Associates providing services to BHDD by written agreement, such as consultants and require that they agree to protect your PHI and privacy.
  • By Law: We will share your PHI when otherwise required by law.
  • De-Identified Information: We may share information that does not identify you (i.e., is not PHI).

Individual rights.

• Right to a Paper Copy of this Notice: You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly. Contact BHDD for a paper copy of this notice.
• Right to Request Amendment: If you believe your PHI is incorrect or incomplete, you may ask in writing that we amend it, stating why the PHI is inaccurate or incomplete. Normally we will respond in writing within 60 days of your request. We may deny your request if the PHI was not created by BHDD, is not part of the Designated Record Set you may see and copy, or if it is accurate and complete. If so, we will let you know in writing giving our reasons. You may file a written disagreement, and we may provide you with a written reply.
• Right to Request Confidential Communications: You can ask BHDD to contact you in a specific way, e.g., only at work, home, or by regular mail. We will accommodate reasonable requests if practical and if it will not compromise your treatment.
• Right to Request Restrictions: You have the right to request in writing restrictions on our use/sharing of your PHI for treatment, payment, or operations. You may request that PHI not be shared with others (such as your spouse). Although we are not required to agree to a request, we will accommodate reasonable requests if practical and if it will not compromise treatment. If we agree, we will comply with the restriction except in an emergency/other exception under law. You may request a restriction in writing stating the PHI to be restricted, if you want to restrict its use, sharing, or both, and to whom the restrictions apply. We will usually honor your written request that healthcare items or services for which you self-pay for in full, in advance, not be disclosed.
• Right to an Accounting of Disclosures: You have the right to ask in writing for an accounting of our disclosures of your PHI for up to six (6) years. However, an accounting does not include disclosures made: for treatment, payment, or operations; for general notification; to you or your caregiver; made by authorization; for national security or intelligence; to correctional facilities/law enforcement holding custody; or to health oversight/law enforcement if it would impede those activities. BHDD will provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
• Right to Inspect and Copy: You have the right to ask in writing to see and receive a copy (including an electronic copy if the PHI is maintained in electronic form) with applicable charges applied for copying, retrieval, postage, etc., of your PHI in a Designated Record Set. We may deny in writing your access to some information including: Psychotherapy Notes; PHI needed for some legal proceedings; research PHI; PHI given to BHDD under the promise of confidentiality if likely to reveal the source, or if a BHDD licensed health care professional determines that access is reasonably likely to endanger your or other person’s life or safety. We will usually provide copies within 30 days of request. If you agree, instead of providing copies, we may provide a written summary of PHI requested (charging you the agreed upon preparation cost). If we deny a request, we will do so in writing giving our reasons and you may have the right to have that decision reviewed.
• Right to Choose Someone to Act For You: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.

BHDD’s Duties.

• BHDD is required by law to maintain the privacy and security of your protected health information.
• BHDD is required by law to provide individuals with its legal duties and privacy practices.
• BHDD is required by law and will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI.
• BHDD must follow the duties and privacy practices described in this notice.
• BHDD will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

Revisions.

BHDD reserves the right to change the terms of this notice and to make the new terms of this notice effective to all information BHDD has about you. The new notice will be available upon request, at the BHDD office, and on the BHDD website.

Complaints.

You have the right to file a written complaint with the BHDD Privacy Officer and you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to:

Centralized Case Management Operations 
U.S. Department of Health and Human Services 
200 Independence Avenue, S.W., 
Room 509F HHH Bldg.
Washington, D.C. 20201

or emailing the completed complaint to OCRComplaint@hhs.gov or by utilizing the Office for Civil Rights Complaint Portal, available at https://ocrportal.hhs.gov/ocr/portal/lobby.jsf. Complaint forms are available at How to File a Civil Rights Complaint | HHS.gov. The U.S. Department of Health and Human Services can be reached at 1-800-368-1019, 800-537-7697 (TDD).

We will not retaliate against you for filing a complaint.

Effective Date.

This notice takes effect on April 24, 2026. 

Special Protection for Certain Records.

Some health information maintained by BHDD may be subject to special confidentiality protections under federal law, including 42 U.S.C. § 290dd-2 and 42 CFR Part 2, which apply to certain substance use disorder treatment records. Where applicable, these laws provide more stringent privacy protections than HIPAA. In many cases, we may not use or disclose this information without your specific written authorization, even for purposes that HIPAA would otherwise permit, such as treatment, payment, or health care operations. This information generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a court order that meets specific federal requirements. Recipients of this information may be prohibited from redisclosing unless permitted by federal law.

South Carolina Health Information Exchange/South Carolina eHealth Alliance.

• South Carolina Department of Behavioral Health and Developmental Disabilities has become a member of the South Carolina eHealth Alliance (“SCeHA”). Your privacy and your personal health information are protected by federal and state law. Those federal and state laws also govern the way your personal and electronic health information is used or shared through SCeHA. Your doctors and other health care providers will use and share your electronic health information with other doctors and health care providers, involved in your care, through SCeHA to provide, coordinate, or manage your health care and any related services.
• SCeHA members may include health care providers licensed in the State of South Carolina, including medical doctors, dentists, chiropractors, optometrists, podiatrists, pharmacists, physician assistants, and nurse practitioners. Members also may include organizations such as hospitals, ambulatory surgical facilities, home health agencies, pharmacies, case management providers, tele-monitoring providers, health information exchanges, and organizations within which eligible individuals practice. We may also share your personal health information through SCeHA with agencies that audit, investigate, and inspect health programs for the health and safety of the public. We may submit information as required by law, including but not limited to: immunization data, quality reporting data, and communicable disease data to a state or federal agency.
• You may ‘Opt Out’ of SCeHA. By opting out, your personal health information will not be shared through SCeHA.
• If you wish to opt out of SCeHA, you must ask for, complete, and sign an Opt Out form that tells us in writing that you do not want your personal health information included in or shared through SCeHA.