Privacy Practices

Download PDF version




Effective Date: February 2024

The Mid-State Health Network (MSHN) is part of an Organized Health Care Arrangement (OHCA) that includes the following organizations:

• Bay Arenac Behavioral Health

• Community Mental Health for Clinton-Eaton-Ingham Counties

• Community Mental Health for Central Michigan

• Gratiot Integrated Health Network

• Huron County Behavioral Health

• The Right Door for Hope, Recovery and Wellness (Ionia County CMH)

• Lifeways Community Mental Health Authority

• Montcalm Care Network

• Newaygo County Mental Health Center

• Saginaw County Community Mental Health Authority

• Shiawassee Health and Wellness

• Tuscola Behavioral Health Systems


MSHN and its providers are required under the Federal Insurance Portability and Accountability Act (HIPAA) of 1996, to protect your privacy, follow the privacy practices described in this Notice, and give you a copy of this Notice.


HIPAA allows for the sharing of information between organizations, who are part of an OHCA arrangement, for the purpose of healthcare coordination. This arrangement specifically allows for the following (Section 160.103 of HIPAA):

"A clinically integrated care setting in which individuals typically receive health care from more than one health care provider or an organized system of health care in which more than one covered entity participates, and in which the participating covered entities:

  • Hold themselves out to the public as participating in a joint arrangement; and
  • Participate in joint activities that include at least one of the following:
    • Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;
    • Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or
    • Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.”


The Mid-State Health Network understands that information about you and your health is personal. We are committed to protecting health information about you. When you contact or receive services from an agency within our provider network, a record is typically created. This record contains “demographic information” such as; name, telephone number, social security number, birth date, and health insurance information. This record also contains other information related to your services such as; any health problems you may have, your plan of care, and information about your treatment, including diagnosis, goals for treatment, progress, etc. All of this information is known as protected health information, commonly referred to as PHI, and is used for many purposes.


This notice will tell you about the ways in which physical and behavioral health information about you may be used and disclosed. It tells you what our responsibilities are and what your rights are regarding the use and disclosure of your health information.



Mid-State Health Network and its providers, who are a part of the Organized Health Care Arrangement, are able to share health information about you for the purpose of healthcare coordination without a release. Under the rules of HIPAA and the Michigan Mental Health Code, MSHN can also use and disclose protected health information, with certain limits and protections, for treatment, payment and health care operations without a release. If you give us permission to disclose your medical record, or parts of it, you may change your mind about this at any time and cancel (revoke) your permission, but you must let us know this in writing, either by signing a revocation form or giving us a signed written statement that cancels your permission. If you revoke your authorization, this will only apply to future disclosures and not ones that have already been disclosed.


Mid-State Health Network does not release any information regarding substance use disorder treatment records or HIV/AIDS status without your signed permission, unless required to do so by law. Disclosures regarding these areas are subject to additional federal and state laws. Substance use treatment records are specifically protected under Federal Law 42 CFR Part 2.


There are additional laws that may further protect your private information such as the Michigan Mental Health Code.


In the event that a breach of your PHI is discovered, you will be notified as required by law. A breach occurs when your PHI has been used or disclosed in ways not permitted by law.



The following categories describe different ways that we may use and disclose mental health and/or medical information.


For Treatment. We may use information about you to coordinate, provide and manage your health care and any other related services. This may include coordination of management with another person, like a doctor or therapist. We may also contact you to remind you of appointments and inform you of possible treatment options.


For Payment. We may use and disclose information about you so that the treatment and services you receive may be billed to and payment may be collected from you, an insurance company or a third party. For example, we may need to give your health plan information about the treatment you receive so that your health plan will pay us or reimburse you for treatment. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.


For Health Care Operations. We may use and disclose information about you in order to maintain or improve services. These uses and disclosures are necessary to make sure that all our consumers receive quality care. For example, we may use information to review our treatment and services and to evaluate the performance of our staff. We may also combine information about many consumers to decide what additional services should be offered, what services are not needed and whether certain new treatments are effective. We may also disclose information to clinicians, doctors, nurses, students and other personnel who work for the agency for review and learning purposes.


Business Associates. There are some services provided in our organization through contracts with business associates. For example, the nurse may have to send your blood to a laboratory for testing prior to giving you a medication. The lab is not a part of the agency, but we will have a business relationship with the lab. When any services are contracted, we may disclose your health information so they may perform the job we’ve asked them to do and bill you or your health plan. To protect your health information, however, we require the business associate to appropriately safeguard your information.


Research. Under certain circumstances, Mid-State Health Network is allowed to share your information in ways usually related to public health and research, however, we must meet many more conditions under the law before we can use your information for those purposes. For more information on this, go to the following website:


The Mid-State Health Network has a research policy that can be accessed at the following location:


As Required By Law. We are sometimes required to disclose some of your information without your signed authorization if state or federal laws say we must do so. Such disclosures are usually related to one of the following:

  • A medical emergency: in the event of a medical emergency, we may not be able to give you a copy of this Privacy Notice until after you receive care;
  • To prevent, control, or report disease, injury, disability, or death;
  • To alert state or local authorities if we believe you are a victim of child or adult abuse, neglect, or domestic violence;
  • To alert authorities or medical personnel if we believe someone is at risk of injury by means of violence;
  • To comply with health oversight agencies for things like audits, civil or administrative reviews, proceedings, inspections, licensing activities or to prove we are complying with federal privacy laws;
  • To respond to a court or administrative order, or a subpoena;
  • To a law enforcement official to report a crime on agency premises.



The following categories describe when an authorization is required by you prior to release of information. The release of information must be consistent with the authorization provided.

  • Psychotherapy Notes. A covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except:
    • To carry out the following treatment, payment, or health care operations:
      • Use by the originator of the psychotherapy notes for treatment;
      • Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or
      • Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and
    • A use or disclosure that is required by the Secretary to investigate or determine compliance; by law; for health oversight activities; coroners and medical examiners; and as necessary to prevent or lessen a serious imminent threat to the health and safety of a person or the public
  • Marketing. A covered entity must obtain authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of:
    • A face-to-face communication made by a covered entity to an individual; or
    • A promotional gift of nominal value provided by the covered entity.
    • If the marketing involves financial remuneration to the covered entity from a third party, the authorization must state that such remuneration is involved.
  • Sale of protected health information.
    • A covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in § 164.501 of this subpart. (ii) Such authorization must state that the disclosure will result in remuneration to the covered entity.



You have the following rights regarding physical and behavioral health information we maintain about you:

Right to Inspect and Copy. You have the right to inspect and copy information, from your record, that may be used to make decisions about your care. You have the right to request that the copy be provided in an electronic form or format. If the form and format you request are not readily producible, we will work with you to provide it in a reasonable electronic form or format. Usually, this includes medical and billing records, but may not include psychotherapy notes.


To inspect and copy information that may be used to make decisions about you, you must submit your request in writing. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.


We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

  • Right to Amend Your Record: If you believe that your personal health information or treatment record is incorrect or that an important part of it is missing, you have the right to ask us to amend your treatment record. You must submit your request and your reason for the request in writing.


Right to an Accounting of Disclosures. You have the right to request an “accounting of disclosures.” This is a list of the disclosures that we made, other than those covered in this notice, of information about you.

o To request this list of accounting of disclosures, you must submit your request in writing. Your request must state a time period which may not be longer than six years prior to the date of your request. Your request should indicate in what form you want the list (for example, on paper or electronically). Disclosures you authorized in writing, routine internal disclosures such as those made to staff when providing you services, and/or disclosures made in connection with payment are examples of disclosures not included in the accounting. The accounting will give the date of the disclosure, the purpose for which your PHI was disclosed, and a description of the information disclosed. If there is a fee for the accounting, you will be informed what the fee is before the accounting is done.


Right to Request Restrictions. You have the right to request that your protected health information not be shared or request a restriction or limitation on the information we use or disclose about you. We are not required to agree with your request and can say no if it would affect your care.


If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say yes unless a law requires us to share that information.


Right to Request Confidential Communications. You have the right to request that we communicate with you in a certain way or at a certain location. For example, you can ask that we contact you only at work or only by mail.


To request confidential communications, you must make your request in writing. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.


Right to Request Someone to Act on Your Behalf. You have the right to choose someone to act on your behalf. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can act on your rights and make choices about your health information just as you would. We will make sure the person has this authority and can legally act for you before we respond to any such request.




We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current notice at all agency locations and on our website. This notice will contain, on the first page, in the top right-hand corner, the effective date.


You have the right to receive a copy of the privacy notice at the start of services and be notified, no less frequent than once every three years, of the availability of the notice and how to obtain it. When there is a material change to the notice, the notice must be posted on the agency website in a prominent place and the notice, or information about the material change, must be provided in the next annual mailing. If you receive an electronic copy of the notice, you also have the right to obtain a paper copy upon request.



If you believe your privacy rights have been violated, you may ask for further information or file a complaint with your local agency, with the Mid-State Health Network or with the U.S. Department of Health and Human Services Office of Civil Rights.


You may not be intimidated, threatened, coerced, discriminated against, or have other retaliatory action taken against you for filing a complaint; testifying, assisting, or participating in an investigation, compliance review, proceeding, or hearing; or opposing any act or practice believed in good faith to be unlawful.

The Right Door for Hope, Recovery and Wellness

375 Apple Tree Drive

Ionia, MI 48846



Mid-State Health Network

530 West Ionia Street

Suite F

Lansing, MI 48933



U.S. Department of Health and Human Services Office of Civil Rights

200 Independence Avenue, S.W.

Washington, D.C. 20201