Privacy Policy – The Free Clinic Cleveland

The Free Clinic (“we,” “us,” or “our”) is committed to protecting the privacy and security of your personal information, including your protected health information (PHI), in accordance with applicable laws and regulations. As a nonprofit community health center providing free medical, dental, mental health, substance abuse treatment, HIV services, case management, community education, and advocacy services, we adhere strictly to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and other relevant federal and state privacy laws, including those specific to sensitive health information such as HIV status, mental health records, and substance use disorder treatment.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, receive our services, or interact with us in any way. By using our website or services, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with our practices, please do not use our website or services.

1. Information We Collect

We collect the minimum necessary information to provide you with high-quality, barrier-free care.

Identifying and Contact Information: Full name, date of birth, gender, preferred pronouns, preferred language, address (if available), phone number, email (optional), emergency contact details.
Health and Medical Information: Primary reason for seeking care, current medications (including prescriptions, over-the-counter, vitamins/supplements in original bottles), allergies, major past conditions/surgeries, smoking/alcohol/substance use (yes/no, with optional details), mental health or substance use concerns, symptoms, health history notes.
Demographic and Support Needs: How you heard about us, immediate needs (e.g., food, housing, transportation), any interpreter requirements.
Biometric and Device Data: If you use our telehealth services or website features, we may collect data from your device, such as IP address, browser type, or usage patterns, to ensure secure access.
Other: Limited socioeconomic details for case management referrals or aggregate reporting to funders (no proof required for services).

This information comes directly from you during registration/intake (via our secure Patient Registration Form—online, printed, or in-person), appointments, or interactions; from referrals (with consent); or automatically from website use (non-PHI analytics).

For children/minors: Parents/guardians must attend registration and provide consent. We follow Ohio laws allowing minors (e.g., age 12+ for SUD treatment, age 14+ for limited outpatient mental health without parental notification in many cases, certain reproductive health services) to consent independently for specific sensitive services, with heightened confidentiality.

2. How We Use Your Information

We use your PHI primarily for:

Treatment: Coordinating care among our team (physicians, nurse practitioners, nurses, dentists, mental health counselors, substance use specialists, case managers) for primary care, HIV management, chronic conditions, mental health therapy, SUD recovery, dental services, preventive screenings, referrals, and advocacy.
Health Care Operations: Quality improvement, staff training (including volunteers trained in HIPAA, cultural humility, trauma-informed care), scheduling, auditing, compliance, and administrative tasks like connecting you to resources (housing, food, employment).
Appointment Reminders and Health-Related Communications: Contacting you about appointments, services, or health tips (you can opt out).
Public Health and Required Reporting: Mandated reports (e.g., communicable diseases like HIV under Ohio law, abuse/neglect, threats to safety).
Research and Aggregate Reporting: De-identified data for community health insights or funder reports (no individual identifiers without authorization).
Fundraising/Community Updates: Limited use of contact info for donation appeals or events (opt-out available; no PHI used without consent).

For SUD records under 42 CFR Part 2, uses are more restricted—most require your written consent.

3. How We Disclose Your Information

Disclosures are limited to what is necessary, with safeguards:

For Treatment, Payment, Operations (TPO): With business associates (e.g., labs, electronic health record vendors, pharmacies) under HIPAA/Part 2-compliant contracts.
With Your Written Authorization: For sharing with non-health entities (e.g., employers, schools) or most SUD disclosures.
Without Authorization (Permitted/Required by Law):
- Public health reporting (e.g., HIV under Ohio Rev. Code §3701.243).
- Emergencies, court orders, law enforcement (limited).
- Abuse/neglect reporting, coroners, organ donation.
- Avert serious threats to health/safety.
- To you, your personal representatives, or involved family/friends (with permission or as needed for care).
Minors: For independent-consent services (e.g., SUD treatment age 12+, limited mental health age 14+), we protect confidentiality per Ohio law unless disclosure is compelled (e.g., imminent harm).
No Selling/Commercial Sharing: We never sell PHI or share for marketing without explicit consent.

4. Your Rights Regarding Your Information

Under HIPAA and other laws, you have the following rights:

Right to Access: Inspect and obtain a copy of your PHI (with some exceptions, e.g., psychotherapy notes). Requests must be in writing; we may charge a reasonable fee for copies.
Right to Amend: Request corrections to inaccurate or incomplete PHI. We may deny requests in certain cases but will provide a written explanation.
Right to an Accounting of Disclosures: Receive a list of certain disclosures made of your PHI over the past six years.
Right to Request Restrictions: Ask us to limit uses or disclosures (e.g., not sharing with family). We are not required to agree but will consider your request.
Right to Confidential Communications: Request alternative methods or locations for receiving communications (e.g., by email instead of mail).
Right to Opt Out: Of fundraising communications or certain research uses.
Right to Revoke Authorization: Withdraw consent for previously authorized disclosures, except where action has already been taken.
Right to a Paper Copy: Of this Privacy Policy, even if you agreed to receive it electronically.

To exercise these rights, contact our Privacy Officer (details below). We will respond within 30 days (or 60 days with notice).

5. Our Security Measures

We use administrative (training, policies), physical (secure facilities, access controls), and technical (encryption, firewalls, audits) safeguards. Volunteers and staff sign confidentiality agreements and receive HIPAA/Part 2 training.

In case of a breach of unsecured PHI, we notify you, HHS, and (if large) media per HITECH requirements.

6. Children and Minors

Parents/guardians generally control PHI for minors under 18. However, Ohio law allows independent consent/confidentiality for certain services (e.g., SUD diagnosis/treatment age 12+, outpatient mental health up to 6 visits/30 days age 14+, HIV testing). We handle these with extra protections and notify parents only if compelled (e.g., substantial harm risk).

7. Website and Third Parties

Our website may use cookies for non-PHI analytics. Links to external sites (e.g., social media) have their own policies—we are not responsible.

Email is not secure for PHI—use phone or in-person for sensitive info.

8. Changes to This Notice

We may revise this notice for practice or legal changes. The “Last Updated” date shows effectiveness. Material changes posted on our website and notified via email, signage, or at visits. Continued services imply acceptance.

9. Complaints

If you believe your privacy rights were violated, contact:

Privacy Officer

The Free Clinic
3100 East 45th Street
Cleveland, OH 44127, United States
Phone: (216) 766-0492
Email: [email protected] (do not send PHI via unsecured email)

Thank you for trusting The Free Clinic with your health care needs. Your privacy is our priority.