Our Privacy Policy
This privacy policy has been compiled to better serve those who are concerned with how their ‘Personally Identifiable Information’ (PII) is being used online. PII, as described in US privacy law and information security, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle your Personally Identifiable Information in accordance with our website.
What personal information do we collect from the people that visit our blog, website or app?
When ordering or registering on our site, as appropriate, you may be asked to enter your name, email address, mailing address, phone number or other details to help you with your experience.
When do we collect information?
We collect information from you when you fill out a form, Use Live Chat or enter information on our site.
How do we use your information?
We may use the information we collect from you when you respond to a webform, survey or marketing communication, surf the website, or use certain other site features in the following ways:
- To improve our website in order to better serve you.
- To send periodic emails regarding your interest in the program.
- To follow up with them after correspondence (live chat, email or phone inquiries)
How do we protect your information?
We do not use vulnerability scanning and/or scanning to PCI standards.
We only provide articles and information. We never ask for credit card numbers.
We use regular Malware Scanning.
Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all sensitive information you supply is encrypted via Secure Socket Layer (SSL) technology.
We implement a variety of security measures when a user enters, submits, or accesses their information to maintain the safety of your personal information.
All transactions are processed through a gateway provider and are not stored or processed on our servers.
Do we use ‘cookies’?
Yes. Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enables the site’s or service provider’s systems to recognize your browser and capture and remember certain information. We use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.
We use cookies to:
- Keep track of advertisements.
- Compile aggregate data about site traffic and site interactions in order to offer better site experiences and tools in the future. We may also use trusted third-party services that track this information on our behalf.
You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Since each browser is a little different, look at your browser’s Help Menu to learn the correct way to modify your cookies.
If you turn cookies off, some features will be disabled. It won’t affect the user’s experience that makes your site experience more efficient and may not function properly.
Third-party disclosure
We do not sell, trade, or otherwise transfer to outside parties your Personally Identifiable Information unless we provide users with advance notice. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or serving our users, so long as those parties agree to keep this information confidential. We may also release information when it’s release is appropriate to comply with the law, enforce our site policies, or protect ours or others’ rights, property or safety.
However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.
Third-party links
We do not include or offer third-party products or services on our website.
Google’s advertising requirements can be summed up by Google’s Advertising Principles. They are put in place to provide a positive experience for users. https://support.google.com/adspolicy/answer/6008942?hl=en&visit_id=637559952256993318-3514517629&rd=1
We use Google AdSense Advertising on our website.
Google, as a third-party vendor, uses cookies to serve ads on our site.
Google’s use of the DART cookie enables it to serve ads to our users based on previous visits to our site and other sites on the Internet. Users may opt-out of the use of the DART cookie by visiting the Google Ad and Content Network privacy policy.
We have implemented the following:
- Demographics and Interests Reporting
We, along with third-party vendors such as Google use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as the DoubleClick cookie) or other third-party identifiers together to compile data regarding user interactions with ad impressions and other ad service functions as they relate to our website.
Opting out:
Users can set preferences for how Google advertises to you using the Google Ad Settings page. Alternatively, you can opt out by visiting the Network Advertising Initiative Opt Out page or by using the Google Analytics Opt Out Browser add on.
California Online Privacy Protection Act
CalOPPA is the first state law in the nation to require commercial websites and online services to post a privacy policy. The law’s reach stretches well beyond California to require any person or company in the United States (and conceivably the world) that operates websites collecting Personally Identifiable Information from California consumers to post a conspicuous privacy policy on its website stating exactly the information being collected and those individuals or companies with whom it is being shared. – See more at: http://consumercal.org/california-online-privacy-protection-act-caloppa/#sthash.0FdRbT51.dpuf
According to CalOPPA, we agree to the following:
Users can visit our site anonymously.
Once this privacy policy is created, we will add a link to it on our home page or as a minimum, on the first significant page after entering our website.
Our Privacy Policy link includes the word ‘Privacy’ and can easily be found on the page specified above.
You will be notified of any Privacy Policy changes on our Privacy Policy Page
How does our site handle Do Not Track signals?
We honor Do Not Track signals and Do Not Track, plant cookies, or use advertising when a Do Not Track (DNT) browser mechanism is in place.
Does our site allow third-party behavioral tracking?
It’s also important to note that we do not allow third-party behavioral tracking
COPPA (Children Online Privacy Protection Act)
When it comes to the collection of personal information from children under the age of 13 years old, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, United States’ consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children’s privacy and safety online.
We do not specifically market to children under the age of 13 years old.
Fair Information Practices
The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.
In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur:
We will notify you via email
- Within 7 business days
We also agree to the Individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.
CAN-SPAM Act
The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.
We collect your email address in order to:
- Send information, respond to inquiries, and/or other requests or questions.
To be in accordance with CANSPAM, we agree to the following:
- Not use false or misleading subjects or email addresses.
- Identify the message as an advertisement in some reasonable way.
- Include the physical address of our business or site headquarters.
- Monitor third-party email marketing services for compliance, if one is used.
- Honor opt-out/unsubscribe requests quickly.
- Allow users to unsubscribe by using the link at the bottom of each email. If at any time you would like to unsubscribe from receiving future emails, you can email us at info@tripledividelodge.com.
- Follow the instructions at the bottom of each email and we will promptly remove you from ALL correspondence.
Triple Divide Lodge
PERSONAL HEALTH INFORMATION POLICIES & PROCEDURES
EFFECTIVE 6/1/2021
THIS POLICY DESCRIBES HOW MEDICAL INFORMATION ABOUT PATIENTS MAY BE USED AND DISCLOSED AND HOW PATIENTS CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
The following is the privacy policy and procedures (“Privacy Policy”) of Triple Divide Lodge (TDL) as described in the Health Insurance Portability and Accountability Act of 1996 and regulations promulgated thereunder, commonly known as HIPAA. HIPAA requires TDL, its officers, employees, and agents by law to maintain the privacy of patients’ protected health information and to provide them with notice of TDL’s legal duties and privacy policies with respect to their protected health information. TDL is required by law to abide by the terms of the Privacy Notice.
Patients’ Protected Health Information
TDL collects personal health information from patients through treatment, payment and related healthcare operations, and/or healthcare providers or health plans, or through other means, as applicable. Their personal health information that is protected by law broadly includes any information that is created or received by TDL, or a health care provider and/or health plans, or employer, and relates to their past, present, or future physical or mental health or condition. Some of their personal health information is protected health information (hereinafter “PHI”). PHI is personal health information, including demographic information, that could be used to identify them as the individual patient who is associated with that personal health information, and that is oral, written, transmitted or maintained in electronic media, or personal health information that is transmitted or maintained in any other form or medium, that is created or received by certain health care entities, including health care providers, such as physicians and hospitals, drug and alcohol treatment programs, as well as health insurance companies or plans.
Uses or Disclosures of Patients’ Protected Health Information
Generally, TDL and its officers, employees, and agents will not use or disclose a patient’s PHI for any purpose without their documented consent or authorization, or the consent or authorization of their personal representative. Further, once TDL obtains their consent, TDL must use or disclose their PHI in accordance with the specific terms of that consent or authorization. The following are circumstances under which TDL is permitted by law to use or disclose your PHI.
Without patients’ consent or authorization
Without their consent, TDL may use or disclose PHI in order to provide them with services and the treatment they require or request, or to collect payment for those services, and to conduct other related health care options otherwise permitted or required by law.
TDL may use PHI to create information that is sufficiently de-identified, provided that such information meets the requirements for de-identification of PHI under HIPAA, so that the recipient of such information would be unable to link the information to the patient.
However, even with their permission, TDL is required to limit such uses or disclosures to the minimal amount of personal health information that is reasonably necessary to accomplish the intended purpose of the use, disclosure or request. Examples of treatment activities include: (a) the provision, coordination, or management of health care and related services by health care providers; or (b) consultation between TDL and health care providers relating to their care. Examples of payment activities include: (a) billing and collection activities and related data processing; (b) actions by a health plan or insurer to obtain premiums or to determine or fulfill its responsibilities for coverage and provision of benefits under its health plan or insurance agreement, determinations of eligibility or coverage, adjudication or subrogation of health benefit claims; or (c) disclosure to consumer reporting agencies of information relating to collection of premiums or reimbursement. Examples of health care operations include: (a) conducting quality assessment and improvement activities and development of clinical guidelines; (b) reviewing the qualifications of and training health care professionals; (c) underwriting and premium rating; (d) medical review, legal services, and auditing functions; or (e) business management and general administrative activities.
As Required by Law
TDL may use or disclose a patient’s PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. Examples of situations in which TDL is required to disclosure their PHI include: (a) disclosure to a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease; (b) disclosures regarding victims of abuse, neglect, or domestic violence including, reporting to social service or protective services agencies; (c) health oversight activities including, audits, civil, administrative, or criminal investigations, inspections, licensure or disciplinary actions, or civil, administrative, or criminal proceedings or actions, or other activities necessary for appropriate oversight of government benefit programs; (d) for research purposes under certain conditions; or (e) to avert a serious threat to health or safety.
Uses and Disclosures for which an Authorization is required
TDL may not use or disclose a patient’s PHI without their written authorization, except as otherwise permitted or required as described above. Outside of the conditions listed above and even under those conditions in nearly all cases, TDL does not release any PHI except by their request. Further, TDL is required to use or disclose their PHI consistent with the terms of their authorization. A patient may revoke their authorization of TDL to use or disclose any PHI at any time, prior to the release of any patient records an Authorization to Disclose Health Care Information Form that fulfills the requirements outlined under 42 CFR Part 2 & the Privacy Rule will be filled out in its entirety with the following exceptions: (a) a medical emergencies (b) to auditors and evaluators (c) To report suspected child abuse or neglect (d) to report a crime or a threat to commit a crime on program premises or against program personnel.(e) to the extent that action has been taken in reliance thereon.
Records released by Triple Divide Lodge are to be used only by the individual or entity in which they are disclosed and are not be re-released by that individual or entity. Therefore patient records communicated to outside entities will contain as footer or be stamped with “This information has been disclosed to you from records whose confidentiality is protected by Federal Law. Federal regulations (42-CFR Part 2) prohibit you from making any further disclosure of this without the specific written consent of this person to whom it pertains or as otherwise permitted by such regulation. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.”
With certain exceptions, the Privacy Rule generally requires that uses and disclosures of PHI be the minimum necessary for the intended purpose of the use or disclosure.
The Privacy Rule imposes three additional steps programs must take when disclosing information pursuant to a patient’s written consent: (a) TDL must ensure that the consent complies with the applicable requirements of 45 CFR §164.508; (b) the rule states that TDL must give patients a copy of the signed form (45 CFR §164.508 (c) (4)) TDL must keep a copy of each signed form for six (6) years from its expiration date (45 CFR §164.508(b) (6)).
Potential Impact of State Law
The HIPAA Privacy Rule generally does not “preempt” (or take precedence over) state privacy or other applicable laws that provide individuals greater privacy protections. As a result, to the extent state law applies, the privacy laws of a particular state, or other
Federal laws might impose a more stringent privacy standard, and then TDL will comply with such privacy laws.
Minors
With regards to minors: A minor must always sign the consent form for a program to release information even to his or her parent or guardian (42 CFR §2.14). The state of Montana provides minors with the same rights as adults in their ability to seek drug and alcohol abuse treatment (MT41-1-402) and does not require parental consent for the disclosure of information nor to receive services.
Disclosures to Business Associates of Triple Divide Lodge
TDL may disclose PHI to a business associate. TDL shall obtain written contractual assurances from all business associates to which PHI is disclosed that such business associate will appropriately safeguard a patient’s PHI, that that their PHI will be used only for the purposes for which such business associates were engaged, that all such business associates will safeguard their PHI from misuse, and will help the agency comply with its duties to provide clients with access to health information about them and a history of certain disclosures.
Patients’ Rights with Respect to Their Personal Health Information
Under HIPAA, patients have certain rights with respect to their PHI. The following is a brief overview of their rights and our duties with respect to enforcing those rights.
Right to Request Restrictions on Uses or Disclosures
Patients have the right to request restrictions on the following uses or disclosures of PHI: (a) to carry out treatment, payment, or healthcare operations; (b) disclosures to family members, relatives, or close personal friends of personal health information directly relevant to your care or payment related to your health care, or your location, general condition, or death; (c) instances in which they are not present or their permission cannot practicably be obtained due to their incapacity or an emergency circumstance. While TDL is not required to agree to any requested restriction, if TDL does agree to a restriction, it is bound not to use or disclose their PHI in violation of such restriction, except in certain emergency situations. TDL will not accept a request to restrict uses or disclosures that are otherwise required by law.
Right to Receive Confidential Communications
Patients have the right to receive confidential communications of their PHI. TDL may require written requests. TDL may condition the provision of confidential communications on patients providing TDL with information as to how payment will be handled and specification of an alternative address or other method of contact. TDL may require that a request contain a statement that disclosure of all or a part of the information to which the request pertains could endanger them. TDL may not require them to provide an explanation of the basis for their request as a condition of providing communications to them on a confidential basis. TDL must permit them to request and must accommodate reasonable requests by them to receive communications of PHI from TDL by alternative means or at alternative locations.
Right to Inspect and Copy Patients Personal Health Information
Patients’ designated record set is a group of records TDL maintains that includes medical records and billing records about them, or payment, claims adjudication, and case or medical management records systems, as applicable. They have the right of access in order to inspect and obtain a copy their PHI contained in their designated record set, except for (a) psychotherapy notes; (b) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding; and (c) health information maintained by TDL to the extent to which the provision of access to them would be prohibited by law. TDL may require written requests. TDL must provide them with access to their personal health information in the form or format requested by them, if it is readily producible in such form or format, or, if not, in a readable hard copy form or such other form or format. TDL may provide them with a summary of the PHI requested, in lieu of providing access to the PHI or may provide an explanation of the PHI to which access has been provided, if they agree in advance to such a summary or explanation and agree to the fees imposed for such summary or explanation. TDL will provide them with access as requested in a timely manner, including arranging with them a convenient time and place to inspect or obtain copies of your PHI or mailing a copy to them at their request. TDL will discuss the scope, format, and other aspects of their request for access as necessary to facilitate timely access. If they request a copy of their PHI or agree to a summary or explanation of such information, TDL may charge a reasonable cost-based fee for copying, postage, if they request a mailing, and the costs of preparing an explanation or summary as agreed upon in advance. TDL reserves the right to deny them access to and copies of certain PHI as permitted or required by law. TDL will reasonably attempt to accommodate any request for PHI by, to the extent possible, giving them access to other PHI after excluding the information as to which TDL has a ground to deny access. Upon denial of a request for access or request for information, TDL will provide them with a written denial specifying the legal basis for denial, a statement of their rights, and a description of how they may file a complaint with us. If TDL does not maintain the information that is the subject of their request for access but TDL knows where the requested information is maintained, TDL will inform you of where to direct their request for access.
Right to Amend Patients’ Personal Health Information
Patients have the right to request that TDL amend their PHI or a record about them contained in their designated record set, for as long as the designated record set is maintained by TDL. TDL has the right to deny their request for amendment, if: (a) TDL determines that the information or record that is the subject of the request was not created by TDL, unless they provide a reasonable basis to believe that the originator of the information is no longer available to act on the requested amendment; (b) the information is not part of their designated record set maintained by TDL; (c) the information is prohibited from inspection by law; or (d) the information is accurate and complete. TDL may require that they submit written requests and provide a reason to support the requested amendment. If TDL denies their request, TDL will provide them with a written denial stating the basis of the denial, their right to submit a written statement disagreeing with the denial, and a description of how they may file a complaint with TDL or the Secretary of the U.S. Department of Health and Human Services (“DHHS”). This denial will also include a notice that if they do not submit a statement of disagreement, they may request that TDL include their request for amendment and the denial with any future disclosures of their PHI that is the subject of the requested amendment. Copies of all requests, denials, and statements of disagreement will be included in their designated record set. If TDL accepts their request for amendment, TDL will make reasonable efforts to inform and provide the amendment within 30 days to persons identified by them as having received PHI of theirs prior to amendment and persons that TDL knows to have the PHI that is the subject of the amendment and that may have relied, or could foreseeably rely, on such information to their detriment. Requests for amendments will be responded to within 30 days and TDL can extend the response for another 30 days after notifying the patient of the need for that extension.
All requests for amendment shall be sent to:
Privacy Officer
Triple Divide Lodge
200 Hubbart Dam Road
Marion, MT 59925
Phone: 406-296-5776
Right to Receive an Accounting of Disclosures of Patients’ Personal Health Information
Patients have the right to receive a written accounting of all disclosures of their PHI that TDL has made within the six (6) year period immediately preceding the date on which the accounting is requested. Such disclosures will include the date of each disclosure, the name and, if known, the address of the entity or person who received the information, a brief description of the information disclosed, and a brief statement of the purpose and basis of the disclosure or, in lieu of such statement, a copy of your written authorization or written request for disclosure pertaining to such information. TDL is not required to provide accountings of disclosures for the following purposes: (a) treatment, payment, and healthcare operations; (b) disclosures pursuant to their authorization; (c) disclosures to them; (d) for a facility directory or to persons involved in their care, (e) for national security or intelligence purposes; (f) to correctional institutions; and (g) with respect to disclosures occurring prior to April 14, 2003. TDL reserves its right to temporarily suspend your right to receive an accounting of disclosures to health oversight agencies or law enforcement officials, as required by law. TDL will provide the first accounting to patients in any twelve (12) month period without charge, but will impose a reasonable cost based fee for responding to each subsequent request for accounting within that same twelve (12) month period. All requests for an accounting shall be sent to:
Privacy Officer
Triple Divide Lodge
200 Hubbart Dam Road
Marion, MT 59925
Phone: 406-296-5776
Right to a Paper Copy of the Notice
Patients have the right to receive a paper copy of the Privacy Policy. They may request a copy at any time, even if they have agreed to receive this Privacy Policy electronically. All requests for a paper copy of this Privacy Policy shall be sent to:
Privacy Officer
Triple Divide Lodge
200 Hubbart Dam Road
Marion, MT 59925
Phone: 406-296-5776
Triple Divide Lodge’s Duties With Respect to Patients’ Protected Health Information
TDL is required by law to maintain the privacy of their PHI and to provide them with notice of our legal duties and privacy practices with respect to their PHI. TDL shall implement reasonable administrative, technical, and physical safeguards to protect their PHI from any intentional or unintentional use or disclosure that is a violation of HIPAA regulations. All officers, employees and agents of TDL shall comply with the standards set forth in this Privacy Policy. TDL shall provide adequate training and timely updates related to the policies and procedures for compliance with the HIPAA privacy standards for all employees, including new hires, and agents. Training participation will be documented and retained by the Privacy Officer. Violation of this Privacy Policy and unauthorized uses and/or disclosures of PHI are very serious offenses. Not only is violation of this Privacy Policy by any officer, employee or agent of TDL grounds for disciplinary action, up to and including termination of employment, but violations related to unauthorized use and disclosure of PHI may be subject to civil and criminal penalties. TDL is required to abide by the terms whatever privacy policy is currently in effect. TDL reserves the right to revise or amend the terms of this Privacy Policy at any time. Any revisions of this policy will be made available upon request and will also be posted on our website at www.tripledividelodge.com
Procedures for the Protection of Patients’ Protected Health Information
In an effort to protect patients’ PHI, TDL will take the following steps. PHI will be kept in a locked cabinet in an office where staff are in attendance and in times where there is no staff attending the cabinet the building that contains it will be locked as well. Electronic information is protected in such a way that only eligible staff have access to it. These eligible staff include; members of the clinical department and members of the medical department. Members of the administrative department will also have access to PHI. Their access is limited to the purposes of transcribing, filing and assisting in the organization of records as directed by members of the clinical department. Other departments are not eligible to access PHI unless directed to do so by eligible staff, under the guidance of eligible staff and for limited purposes.
While on the wilderness expedition, each clinician will be in possession of the following documents for each client on the expedition; treatment plan, progress notes and consent for medical treatment card. Each clinician will keep these on his person at all times to prevent others from obtaining possession of any of these documents.
Each staff member will receive an orientation regarding the Policy and Procedures (P&Ps) governing PHI at the onset of their employment. They will receive a copy of these P&Ps for their personal reference and will be notified and trained as to any changes that are made regarding these P&Ps.
A copy of TDL’s Privacy Policy will by reviewed and given to each client. They will sign a form acknowledging receipt of the Policy. A copy of the policy can also be found on TDL’s website www.tripledividelodge.com. Each client will be made aware of and receive any amendments to the policy and the most current one can also be found on the site listed above.
Complaints
Patients may file a complaint with TDL and with the Secretary of Health and Human
Services if they believe that their privacy rights have been violated. They may submit their complaint in writing by mail to our Privacy Officer:
Privacy Officer
Triple Divide Lodge
200 Hubbart Dam Road
Marion, MT 59925
Phone: 406-296-5776
A complaint must name the entity that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable requirements of HIPAA or this Privacy Policy. They will not be retaliated against for filing any complaint.
