Privacy Practices

What is HIPPA?

HIPAA is the acronym for the Health Insurance Portability and Accountability Act that was passed by Congress in 1996.  HIPAA does the following:

  • Provides the ability to transfer and continue health insurance coverage for millions of American workers and their families when they change or lose their jobs;
  • Reduces health care fraud and abuse;
  • Mandates industry-wide standards for health care information on electronic billing and other processes; and
  • Requires the protection and confidential handling of protected health information 

Notice of Privacy Practices and Patient Rights under HIPAA  

Please read this notice to find out how you medical information may be used and disclosed at Cambridge Health Associates, and how you can get access to that information.

Cambridge Health Associates (CHA) is required by law to provide you with this Notice so that you will understand how we may use or share your information from your Designated Record Set. The Designated Record Set includes financial and health information referred to in this Notice as Protected Health Information (PHI) or simply health information. We are required to adhere to the terms outlined in this Notice. If you have any questions about this notice, please contact the front desk at 617-354-8360.

Understanding your health record and information

Each time you have an appointment at our facility, a record of your stay is made containing health and financial information. Typically, this record contains information about your condition, the treatment we provide and payment for the treatment.  

CHA May Make the Following Uses and Disclosures of Your Medical Information Without Your Prior Authorization: 

1. Reporting. Federal and state laws may require or permit CHA to disclose certain health information related to the following:

  • Public Health Activities. We may disclose health information about you for public health purposes, including:

    1. Prevention or control of disease, insurance or disability

    2. Reporting births or deaths

    3. Reporting child abuse or neglect

    4. Reporting reactions to medications or problems with products

    5. Notifying people of recalls of products

    6. Notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease

  • Health Oversight Activities. We may disclose health information to a health oversight agency for activities authorized by law. These oversight activities may include audits, investigations, inspections and licensure. These activities are necessary for the government to monitor the health care system, government programs and compliance with civil rights laws.

  • Judicial and administrative proceedings. If you are involved in a lawsuit or a dispute, we may disclose health information about you in response to a court or administrative order. We may also disclose health information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

  • Abuse, Neglect or Domestic Violence. CHA may report your medical information to a government authority including a social service or protective services agency if CHA reasonably believes you are a victim of abuse, neglect, or domestic violence. This includes the following:

    • Law enforcement. We may disclose health information when requested by a law enforcement official.

    • In response to a court order, subpoena, warrant, summons or similar process

    • To identify or locate a suspect, fugitive, material witness, or missing person

    • About you, the victim of a crime if, under certain limited circumstances, we are unable to obtain your agreement

    • About a death we believe may be the result of a criminal conduct

    • About criminal conduct at CHA

    • In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or the location of the person who committed the crime.

    • Coroners, medical examiners and funeral directors. We may disclose medical information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also disclose medical information to funeral directors as necessary to carry out their duties.

    • National Security and intelligence activities. We may disclose health information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.  

    • Correctional Institution. Should you be an inmate of a correctional institution, we may disclose to the institution or its agent’s health information necessary for your health and the health and safety of others.  

2. Other Uses and Disclosures. Any other sharing of your medical information will be made only with your written permission and you may take back your permission at any time so long as you tell us in writing except if Cambridge Health Associates (CHA) has acted in reliance upon your permission, or if your permission was obtained so that the services provided would be covered by insurance.

3. In Addition. CHA may contact you to remind you about your appointment. CHA may leave you a voicemail or a message with a person stating the appointment time and date at home or at work unless you request otherwise. CHA will not identify the reason for your appointment or give any other information in the message.

Other uses of health information

Other uses and disclosures of health information not covered by this notice of the laws that apply to us will be made only with your written permission.

If you provide us permission to use or disclose health information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization.  You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.  

Your rights regarding your health information  

Although your health record is the property of CHA, the information belongs to you. You have the following rights regarding your health information.

  • Right to inspect and copy. With some exceptions, you have the right to review and copy your health information. You must submit your request in writing to CHA. We may charge a fee for the costs of copying, mailing or other supplies associated with your request.

  • Right to amend. If you feel that health information in your record incorrect or incomplete, you may ask us to amend the information. You have this right for as long as the information is kept at CHA. You must submit your request in writing to CHA. In addition, you must provide a reason for your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

    1. Was not created by us, unless the person or entity that created the information is no longer available to make the amendment

    2. Is not part of the health information kept by or for CHA

    3. Is accurate and complete

  • Right to an Accounting of Disclosures. You have the right to request an “accounting of disclosures”. This is a list of certain disclosures we made of your health information, other than those made for purposes such as treatment, payment or health care operations. You must submit your requests in writing to CHA. Your request must state a time period which may not be longer than six years from the date the request is submitted and may not include dates before April 14, 2003.  Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a twelve month period will be free. For additional lists, we may charge you for the costs of providing the lists. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

  • Right to request restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you. For example, you may request that we limit the health information we disclose to someone who is involved in your care or the payment of your care. You could ask that we not use or disclose information about a surgery you had to a family member or friend. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. You must submit your request in writing to CHA. You must tell us

    1. What information you want to limit

    2. Whether you want to limit our use, disclosure or both

    3. To whom you want the limits to apply, for example, disclosures to your spouse

  • Right to request alternate communications. You have the right to request that we communicate with you about medical matters in a confidential manner or at a specific location. For example, you may ask that we only contact you via mail to post office box. You must submit your request in writing to CHA. We will not ask you the reason for your request. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests.

  • Right to a paper copy of this notice. You have the right to a paper copy of this Notice of Privacy Practice even if you have agreed to receive the notice electronically.  You may ask us to give you a copy of this notice at any time.  You may obtain a copy of this notice on our website, To obtain a copy of this notice, contact our office at 617-354-8360.

CHA’s Duties

1. CHA is required by law to keep your medical information private and to give patients this Notice of its legal duties and privacy practices for medical information. CHA is required to abide by the terms of this Notice while it is in effect.  

2. CHA reserves the right to change the terms of this Notice, and to make the new terms apply to all medical information that CHA maintains.  When CHA revises this notice it will provide each patient with a copy of the Notice upon their next visit and post the notice and notification of its revision in the office.

3. Any patient believing that his or her privacy rights have been violated may file a written complaint with our office to our privacy officer at, or with the Secretary for the United States Department of Health and Human Services at e-mail address or call 202-619-0257. Patients will not be retaliated against for filing a complaint.

4. For further information about CHA’s privacy policy and this notice please contact the Operations Manager:  

Catherine Fernbach

Telephone:   (617) 354-8360     Fax: (617) 354-8361

Address:     335 Broadway, Cambridge, MA 02139