Confidentiality of Protected Health Information (PHI)
Date Issued: March 2024
Last Reviewed: April 8, 2024
Our Commitment to Your Privacy
At JFCS East Bay, we are committed to safeguarding your personal health information. As a healthcare provider, we comply fully with the Health Insurance Portability and Accountability Act (HIPAA), which regulates how organizations use and share Protected Health Information (PHI).
This policy explains how we protect your information and limit access to only those who need it to support your care or services.
What Is Protected Health Information (PHI)?
PHI refers to any information in your health records that can identify you and relates to your physical or mental health. This includes:
-
Your name, address, and contact information
-
Medical history and diagnoses
-
Test results and clinical notes
-
Treatment plans and progress
-
Billing details related to your care
Information that is part of employment or school records is not considered PHI.
Who Has Access to Your Information?
Only authorized individuals at JFCS East Bay may access your PHI—and only when it’s necessary for your care or for essential administrative tasks. This includes:
-
Clinical and care staff
-
Administrative and billing personnel
-
Technology and compliance staff supporting secure systems
All staff, volunteers, board members, and contractors are trained to maintain strict confidentiality and are required to report any potential privacy concerns immediately.
How We Protect Your Privacy
We take your privacy seriously and use multiple layers of protection to keep your information secure. These include:
For Paper Records:
-
Stored in locked cabinets
-
Never left unattended in public or shared spaces
-
Only removed from the office when absolutely necessary
For Digital Records:
-
Accessed only through secure, password-protected systems
-
Stored in encrypted, HIPAA-compliant platforms like Penelope and Cerenade
-
Never accessed from public Wi-Fi networks
-
Regular security updates and automatic logoffs on all devices
Limiting Use to the “Minimum Necessary”
Whenever we use or share your information, we ensure it is limited to the minimum necessary to fulfill the specific purpose. For example, someone processing billing will only access the information needed to send the invoice—not your full medical record.
What Happens If Privacy Is Breached?
JFCS East Bay takes all potential privacy breaches very seriously. If your information is shared improperly, we will:
-
Immediately investigate the situation
-
Notify any individuals who may be affected
-
Take appropriate corrective and disciplinary action
-
Strengthen our systems to prevent future breaches
We strictly prohibit retaliation against anyone who raises a privacy concern in good faith.
Questions or Concerns?
If you have questions about how your information is handled, or if you believe your privacy may have been compromised, please contact info@jfcs-eastbay.org.
Additional Resources
For more on how we protect your data and your rights as a client, you may request copies of our related policies or speak with a staff member.
Thank you for trusting JFCS East Bay. Protecting your information is a core part of our commitment to your care and dignity.
