Behavioral Health Field

Privacy Policy

Your Privacy Is Important to us

The staff of Behavioral Health Field, Inc (“BH Field”) respects your privacy. It’s our policy to ensure that the operational activities and professional organization affairs between our agency and our clients are kept confidentially to the greatest possible extent. In Accordance with the HIPPA Privacy Rule, June 2, 2008, BH Field is required by law to maintain the privacy of your “Protected Health Information” (PHI) about you, to notify you of your legal rights, and to follow the privacy policies described in this notice. “PHI” means any information that we create or receive that identifies you and relates to your health or payment for services.

Use and Disclosure of Information about You

Your PHI will be used and disclosed to others as necessary to provide the best service to you. Here are some examples:

Throughout our provision of service to you, members of our staff may see your clinical record. This includes Behavior Analysts, Behaviors Technicians, and Paraprofessionals;
Information may be provided to your health Insurance or another treatment provider to arrange for a referral or clinical consultation. Your PHI will be used or disclosed as needed to arrange for payment for ABA service to you.

For example, information regarding your diagnosis and the service we delivered is included in the bills that BH Field submit to your health insurance plan. This information may be required by your health plan to confirm that the service rendered is covered by your benefit program and medically necessary. It may also be necessary to use or disclose PHI for our health care operations or those of another organization that have a relationship with you. For example, our quality assurance staffs reviewing records to be sure that BH Field deliver appropriate treatment of high quality. Your health plan may wish to review your records to be sure that BH Field meet national standards for quality of care.

Our Policy

At BH Field, our policy is to obtain a general written permission to use and disclose your PHI for treatment, payment, or health care operations purposes. You will be asked to sign a Consent form to permit all such uses and disclosures of your information. - and - also to obtain specific written permission for every disclosure of PHI to third parties other than for payment purposes. You will be asked to sign an Authorization form for disclosure to each person or organization that receives the information, However; If there is an emergency, BH Field will disclose your PHI as needed to enable people to care for you.

Disclosure to your family and friends: If you are an adult, you have the right to control disclosure of information about you to any other person, including family members or friends. If you ask BH Field to keep your information confidential, BH Field will respect your wishes. But if you don’t object, BH Field will share information with family members or friends involved in your care as needed to enable them to help you.
Disclosure to health oversight agencies: BH Field will disclose PHI to government agencies.
Disclosures to child protection agencies: BH Field will disclose PHI as needed to comply with the state law requiring reports of suspected incidents of child abuse or neglect.
Other disclosures without written permission: There are other circumstances in which BH Field may be required by law to disclose PHI without your permission. This may include:Pursuant to court order;
To public health authorities;
To law enforcement officials in some circumstances;
To federal officials for lawful military or intelligence activities;
To researchers involved in approved research projects;
As otherwise required by law.

Written permission by you is necessary to disclose PHI to a third party, except for the circumstances described above. If a request for disclosure of records or information is received by our office, BH Field will contact you to ask whether you authorize or refuse such disclosure. If you refuse to authorize disclosure, or if it is not possible for us to contact you, BH Field will not disclose your information without a court order. Each request for disclosure will have a specific name and address to which the information will be sent. You will never be asked to sign a non-specific release of information form.

Your Legal Rights

Confidential communication: You may request that communications to you, such as appointment reminders, bills, or explanations of health benefits be made in a confidential manner. BH Field will accommodate any such request, if you provide a means for us to process payment transactions.
Restrictions on use and disclosure of your information: You have the right to request restrictions on our use of your PHI for purposes, or our disclosure of that information to certain third parties. BH Field is not obligated to agree to a request restriction, but we will consider your request.
Revoke a Consent or Authorization: You may revoke a written Consent or Authorization for us to use or disclose your PHI. The revocation will not affect any previous use or disclosure of your information.
Name a personal representative: A “personal representative” of a patient may act on their behalf in exercising their privacy rights. This includes the parent or legal guardian of a minor. An individual can also grant another person the right to act as his or her personal representative in an advance directive or living will.

Exercise Your Rights

Contact us at any time if you have questions about our policies and procedures, individual rights, and complaints. The contact person can be reached at info@bhfield.com. This is a summary of your rights and protections under the federal health information privacy law. You can learn more about health information privacy and your rights in a fact sheet called “Your Health Information Privacy Rights.” You can get this from the website at www.hhs.gov/ocr/hipaa

Cookies and Website Analytics

This section is about bhfield.com only. It is separate from the protected health information described above: the cookies on this website are not used to identify clients, and nothing a visitor does on this site is linked to a clinical record.

Some cookies are necessary for the site to work at all. These are always active, because without them the site cannot remember whether you are reading in English or Spanish, keep a staff member signed in to the internal console, or record the cookie choice you make here.

Everything else is optional and off until you allow it. When you first visit, we ask, and we treat no answer as no permission — analytics and advertising technologies are not loaded at all until you choose to allow them, not merely loaded and told to stay quiet.

Essential — two cookies, neither of which can be switched off and neither of which is used for analytics or advertising. One is set when you choose a language, or when a staff member signs in to the internal console, and lasts seven days. The other records the cookie choice you make here and lasts six months, after which we ask again.
Analytics — helps us see which pages people actually use, so we can improve them and write about what families are looking for. This is provided by Google Analytics, loaded through Google Tag Manager, and information about your visit is processed by Google.
Advertising — covers advertising and campaign-measurement technologies, so that if we run a campaign we can tell whether it reached the families searching for services. These are also provided by Google.

You can change your mind at any time. Select “Cookie preferences” at the bottom of any page to review each category and turn it on or off. Withdrawing permission takes effect immediately and reloads the page so that anything already running is removed. You can also clear or block cookies in your browser settings; if you clear them, we will ask again on your next visit.

If your browser sends a Global Privacy Control signal, we treat it as a request not to use your information for targeted advertising, and the advertising category stays off and cannot be turned on while that signal is present. Analytics remains your own choice, because that signal concerns selling or sharing information rather than our own measurement of this website. We do not sell personal information.

The staff console and the invitation-only research pages set no optional cookies and are excluded from analytics entirely, so no consent is requested there.

The BHField app

This section explains what information the BHField mobile app for iPhone, iPad and Android (the “app”) collects, how Behavioral Health Field, Inc (“BH Field”, “we”) uses it, who it is shared with, and the choices you have. It adds to the Privacy Policy above and our Notice of Privacy Practices, which continue to govern all Protected Health Information (PHI) we hold.

The app is for two groups of people: BH Field staff (such as Registered Behavior Technicians and Board Certified Behavior Analysts) and the parents and guardians of the children we serve. It is not directed to children, and children do not use it or create accounts in it.

Information the app collects

Account information

Your name, email address and password when you sign in or sign up. Passwords are handled by our sign-in provider, Auth0; BH Field never sees or stores your password. Staff accounts are created by BH Field; parents and guardians are invited by their child’s care team or sign up with the email the clinic has on file.

Health and care information

For staff: the session data you record (attendance, targets, trials, behaviors, notes and signatures) for the children in your caseload. For parents and guardians: the information about your own children that the app shows you, such as schedules, sessions and progress. This is PHI and is protected under HIPAA and our Notice of Privacy Practices.

Messages, photos and calls

Chat messages, and the photos and files you choose to send in a conversation or set as your profile photo. Audio and video calls between staff and families are carried live and are not recorded; we keep only a log of each call (who took part, when, and how long).

Mandy, the in-app assistant

When you ask Mandy a question, your question and the information Mandy needs to answer it (for staff, their own caseload; for families, their own children) are processed by an artificial intelligence model hosted by Amazon Web Services (Amazon Bedrock). If you ask out loud, your voice is streamed to Amazon Transcribe to turn it into text, and the audio is not stored. Conversations with Mandy are kept in your account so you can see them again. The app asks for your permission before Mandy is used for the first time. The permission belongs to your account, so it applies on every device you sign in on, and you can withdraw it at any time in Menu → Mandy.

Device permissions

Camera: only when you take a photo for a chat or your profile, or turn your camera on in a call.
Photos: only the pictures you choose to attach.
Microphone: only during calls and when you ask Mandy a question out loud.
Face ID or Touch ID: to unlock the app. Your biometric data stays on your device and is never sent to us.

The app does not collect your location, your contacts, or your browsing history.

Diagnostics

To find and fix problems, the app sends crash and error reports to Sentry and records how screens are used with LogRocket. Both are configured so that no PHI leaves your device through them: all text on the screen is hidden from recordings, screens with photos, signatures, chat conversations and calls are not recorded, and network data, console logs and your IP address are not captured. You are identified to them only by an internal user number, never by name or email.

How we use information

To provide care and the app’s features: session data collection, schedules, progress, chat, calls and Mandy.
To keep your account secure and to confirm who you are.
To meet our clinical, legal and insurance record-keeping obligations.
To find, diagnose and fix technical problems in the app.

We do not sell your information, we do not use it for advertising, and the app does not track you across other companies’ apps or websites.

Who we share information with

Only with service providers that help us run the app, under contracts that limit their use of it to that purpose and, where they handle PHI, under Business Associate Agreements as HIPAA requires. Each of them must protect your information at least as well as this policy does:

Auth0 (Okta): sign-in and account security.
Amazon Web Services: secure storage of files, the Mandy assistant (Amazon Bedrock) and voice-to-text (Amazon Transcribe).
Stream (GetStream): chat messages and audio and video calls.
Fly.io: hosting of our servers.
Sentry and LogRocket: crash reports and usage diagnostics, without PHI as described above.

Sharing information with these providers is part of how we provide care and run our operations, which HIPAA allows, so it does not need the separate written authorization that our Privacy Policy asks for before PHI is disclosed to anyone else. They may use it only to provide their service to us. We may also disclose information when the law requires it, as described in our Notice of Privacy Practices.

How long we keep information

Clinical records, including session data, are kept for as long as federal and Georgia law and our payers require, even if you stop using the app. Messages with the care team and conversations with Mandy are kept with the care record too, also after an account is deleted. Diagnostic data is kept by Sentry and LogRocket for a limited period and then deleted.

Your choices and rights

Delete your account: in the app, open Menu → Delete account. For parents and guardians this deletes your sign-in, at once or, if that cannot be done at that moment, by our team shortly after; your children’s clinical records stay with the clinic, as their care and the law require. Staff accounts are closed by an administrator when you send the request from the same screen. You can also ask us by email at info@bhfield.com.
Turn off device permissions at any time in your device’s Settings.
Withdraw your permission for Mandy at any time in Menu → Mandy.
Ask to see or correct your information, or exercise any other right described in our Notice of Privacy Practices, by contacting us.

Security

Information is encrypted in transit and at rest. Access to the app requires your sign-in, can be locked with Face ID or Touch ID, and shows each person only what their role allows: staff see only their own caseload, and families only their own children.

Changes to this policy

If we change this policy, we will update this section and, for important changes, let you know in the app.

Contact us

Behavioral Health Field, Inc, 1401 Georgian Park, Suite 220, Peachtree City, GA 30269. Email info@bhfield.com or call (877) 438-1265.