Privacy Center
Our Commitment to Privacy
BHSN is committed to protecting the privacy, security, and dignity of the individuals we serve, our workforce, and our partners. Our approach to privacy is grounded in our core values of Integrity and Connection.
Integrity means we handle information ethically, responsibly, and transparently—doing the right thing even when no one is watching.
Connection means we respect the trust placed in us and recognize that privacy is essential to safe, respectful, and person-centered relationships.
Privacy is not only a legal obligation—it is central to trauma-informed care, trust, and ethical service delivery. We take a proactive approach to safeguarding personal and health information and continually evaluate our practices to meet or exceed federal and New York State requirements, including HIPAA, 42 CFR Part 2, and applicable Office of Mental Health (OMH) and Office of Addiction Services and Supports (OASAS) standards.
How We Use Information
Information is used only as permitted or required by law and may include, but is not limited to:
-
Providing treatment, care coordination, and support services
-
Payment and health care operations
-
Quality improvement, compliance, and risk management
-
Program oversight, audits, and reporting
-
Responding to inquiries and fulfilling requests
How We Share Information
We only share information when permitted by law and when necessary, including, but not limited to:
-
With health care providers and partners involved in your care
-
With payers and oversight entities
-
With vendors and subcontractors under Business Associate Agreements
-
When required by law, regulation, or court order
When information must be shared, we disclose only the minimum necessary to meet the purpose of the disclosure.
Data Security & Safeguards
We use layered administrative, technical, and physical safeguards designed to protect information, including:
-
Role-based access controls
-
Multi-factor authentication
-
Secure systems and encrypted data where appropriate
-
Workforce privacy, security, and confidentiality training
-
Ongoing internal audits, risk assessments, and compliance monitoring
-
Vendor oversight and Business Associate Agreements
Your Rights Regarding Your Health Information
You have the right to:
-
Access, inspect, and/or receive a copy of your records in accordance with state and federal regulations
-
Request corrections or amendments to your records
-
Request restrictions on certain uses and disclosures of your information
-
Receive an accounting of disclosures, when applicable
-
Ask questions about how your information is used or shared
-
File a privacy concern or complaint without fear of retaliation
-
Revoke your authorization to use or disclose health information, except where action has already been taken
-
Receive notice in the event of a breach of your health information, as required by law
Click here for Notice of Privacy Practices
BHSN is committed to ensuring privacy information is accessible to all individuals. Privacy materials are available in alternative formats and languages upon request. Interpretation and accommodation services are provided at no cost.
For More Information
If you have questions about our privacy practices, your rights, or concerns about how information is handled, you may contact our Compliance Officer:
📞 Phone: 518-563-8206 ext. 2500
📧 Email: Compliance@bhsn.org
👉 Report a Concern Anonymously (Healthicity Audit and Compliance Solutions)
Medical Records Contact
If you have questions about your medical record or wish to request copies of your records, you may contact the Medical Records Department:
📞 Phone: 518-563-8000 ext. 7209
📠 Fax: 518-563-9001
📧 Email: medicalrecords@bhsn.org
Frequently Asked Privacy Questions
We only share information when permitted or required by law. Certain substance use disorder records receive additional protections under federal law.
Information is disclosed to law enforcement only when legally required or permitted, such as in response to a valid court order.
If a breach occurs, BHSN follows established incident response and notification procedures and will notify affected individuals as required by law.
Records are retained in accordance with state and federal retention requirements and securely disposed of when no longer required.