Notice of Privacy Practices
Protected Health Information and Student Health Records
Last Reviewed: October 2026
Department: Sierra College Health Services
IMPORTANT: This notice describes how your medical and mental health information may be used or disclosed, how your information is protected, and how you may exercise your privacy rights. Please review it carefully.
1. Our Commitment to Your Privacy
Sierra College Health Services is committed to maintaining the privacy, confidentiality, and security of personal health information.
We recognize that information concerning your physical health, mental health, medical history, treatment, and personal circumstances is sensitive. We maintain policies and procedures designed to protect this information from unauthorized access, use, or disclosure.
Our responsibilities include:
- Maintaining the confidentiality and security of health records.
- Limiting access to individuals authorized to perform appropriate responsibilities.
- Using and disclosing health information only as permitted or required by applicable law.
- Providing individuals with information about their privacy rights.
- Responding to privacy concerns and complaints.
- Notifying affected individuals of certain privacy or security breaches when required by law.
2. Applicable Privacy Laws
Sierra College Health Services operates within a public educational institution. Depending on the type of record, patient, and services provided, health information may be protected by different federal and California laws.
Family Educational Rights and Privacy Act (FERPA)
Health records maintained by Sierra College concerning enrolled students generally fall under FERPA, either as education records or qualifying student treatment records.
Student treatment records are records maintained by recognized healthcare professionals, used only for treatment, and disclosed only to individuals providing treatment, subject to applicable exceptions.
When student treatment records are used or disclosed for purposes other than treatment, their classification and applicable FERPA protections may change.
Health Insurance Portability and Accountability Act (HIPAA)
HIPAA establishes federal privacy and security requirements for covered healthcare entities and certain business associates.
HIPAA may apply to certain Sierra College healthcare operations or records not excluded from HIPAA under FERPA. When HIPAA applies, the protections and rights described in the HIPAA-specific sections of this notice apply.
California Privacy and Confidentiality Laws
Additional California laws may provide protections for medical information, mental health treatment, psychotherapy records, reproductive health information, and other sensitive records.
When applicable laws establish different requirements, Sierra College Health Services will follow the requirements governing the specific information and disclosure.
3. Information We Maintain
Depending on the services provided, Sierra College Health Services may collect and maintain:
- Personal identification and contact information.
- Medical histories and health assessments.
- Physical examinations and clinical findings.
- Laboratory results, immunizations, and screening information.
- Diagnoses, medications, and treatment plans.
- Mental health assessments, progress notes, and counseling records.
- Referrals and coordination-of-care documentation.
- Insurance, billing, and payment information.
- Other information necessary to provide healthcare services.
Records may be maintained electronically or in paper form, consistent with applicable college policies and legal requirements.
4. Uses and Disclosures for Treatment, Payment, and Healthcare Operations
When permitted by the laws applicable to a particular record, Sierra College Health Services may use or disclose information for treatment, payment, and healthcare operations.
A. Treatment
Information may be used to provide, coordinate, or manage healthcare services.
Examples include:
- Sharing relevant information among healthcare professionals involved in your treatment.
- Coordinating care with outside healthcare providers.
- Ordering laboratory testing or diagnostic services.
- Communicating with pharmacies about prescriptions.
- Making referrals to appropriate medical or mental health specialists.
- Coordinating follow-up care.
Information will be shared only as permitted by applicable confidentiality requirements.
B. Payment
When legally authorized, health information may be used or disclosed to obtain reimbursement or payment for healthcare services.
Examples include:
- Submitting insurance claims.
- Verifying insurance eligibility.
- Providing information required for payment determinations.
- Responding to requests for medical necessity documentation.
- Reviewing billing accuracy.
- Conducting authorized payment audits.
Insurance-related disclosures will follow applicable privacy, consent, and confidentiality requirements.
C. Healthcare Operations
Information may be used or disclosed, when authorized, for activities necessary to maintain effective healthcare operations.
Examples include:
- Quality improvement and clinical performance reviews.
- Staff supervision and training.
- Licensing, credentialing, and accreditation.
- Compliance reviews and authorized audits.
- Administrative activities supporting healthcare delivery.
- Evaluating service effectiveness and patient safety.
5. Other Uses and Disclosures Permitted or Required by Law
Certain circumstances may permit or require the disclosure of health information without an individual's written authorization.
These disclosures are subject to applicable federal and California requirements.
A. Required by Law
Information may be disclosed when required by federal, state, or local law.
B. Public Health Activities
Information may be disclosed to authorized public health agencies for activities such as:
- Reporting communicable diseases.
- Reporting certain injuries or health conditions.
- Supporting public health investigations.
- Reporting adverse events associated with medications or medical devices.
- Complying with legally required disease surveillance activities.
C. Abuse, Neglect, and Domestic Violence
Healthcare professionals may be required or permitted to report suspected abuse, neglect, or other circumstances involving vulnerable individuals.
Disclosures will be made only as authorized or required by applicable reporting laws.
D. Health Oversight Activities
Information may be disclosed to authorized agencies conducting:
- Licensing or credentialing reviews.
- Healthcare audits.
- Compliance investigations.
- Inspections.
- Other legally authorized oversight activities.
E. Judicial and Administrative Proceedings
Information may be disclosed in response to valid legal processes when permitted or required by law.
Such processes may include court orders, administrative orders, subpoenas, or other lawful requests.
Additional protections may apply to mental health, psychotherapy, and other sensitive records.
F. Law Enforcement
Limited disclosures may be permitted or required for legally authorized law enforcement purposes.
Examples include reporting certain injuries, complying with valid legal orders, or responding to circumstances specifically authorized by law.
A law enforcement request does not automatically authorize disclosure of confidential health records.
G. Coroners, Medical Examiners, and Funeral Directors
Information may be disclosed when legally authorized for identification, determining cause of death, or other official responsibilities.
H. Organ and Tissue Donation
Information may be disclosed to authorized organizations involved in organ, eye, or tissue donation when permitted by law.
I. Research
Information may be used or disclosed for research only when applicable legal requirements are satisfied, including necessary approvals, authorizations, or permitted exceptions.
J. Serious Threats to Health or Safety
When permitted by law, information may be disclosed to appropriate individuals or authorities when necessary to prevent or reduce a serious threat to health or safety.
Disclosures will be limited to those authorized under applicable law.
K. Government Functions
Certain disclosures may be permitted for authorized military, national security, correctional, or other government functions.
L. Workers' Compensation
Information may be disclosed when necessary to comply with applicable workers' compensation laws.
6. Family Members, Friends, and Others Involved in Your Care
When permitted by applicable law, limited health information may be shared with individuals involved in your healthcare or payment for healthcare.
Depending on the circumstances, your agreement, opportunity to object, or written consent may be required.
We will not assume that a family relationship automatically authorizes access to confidential medical or mental health information.
Students may request information about the circumstances under which their records can be shared with parents, spouses, partners, or other individuals.
7. Uses and Disclosures Requiring Written Authorization
Certain uses or disclosures require written authorization or consent.
Examples may include:
- Disclosures not otherwise permitted by law.
- Certain disclosures of psychotherapy notes.
- Certain marketing activities.
- Sale of protected health information.
- Other disclosures requiring authorization under federal or California law.
An authorization will identify the information to be disclosed, the recipient, the purpose, and other required details.
Revoking Authorization
You may revoke an authorization in writing, subject to applicable legal requirements.
Revocation generally does not affect actions already taken in reliance on a valid authorization.
8. Mental Health and Psychotherapy Records
Mental health information receives important confidentiality protections under applicable federal and California laws.
Mental health records may include assessments, diagnoses, treatment plans, progress notes, and related clinical documentation.
Separately maintained psychotherapy notes, as defined under HIPAA, receive additional protections when HIPAA applies.
Disclosure of mental health information may require additional authorization or may be permitted under specific legal exceptions, including certain safety-related and mandatory reporting circumstances.
Sierra College Health Services will follow applicable professional confidentiality obligations and legal requirements when maintaining or disclosing mental health information.
9. Substance Use Disorder Treatment Records
Certain substance use disorder treatment records may be subject to additional federal confidentiality protections under 42 CFR Part 2.
When Part 2 applies, special rules may govern:
- Patient consent.
- Permitted uses and disclosures.
- Redisclosure of treatment information.
- Legal proceedings involving patient records.
- Patient rights and confidentiality complaints.
- Breach notification obligations.
Records protected by Part 2 generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against a patient except as specifically permitted by federal law.
Sierra College Health Services will comply with Part 2 requirements to the extent they apply to its programs, records, or activities.
10. Your Rights Regarding Health Information
Your specific rights depend on the laws governing the records involved.
A. Right to Access Your Records
You may have the right to inspect or obtain copies of your medical or mental health records.
HIPAA-covered records generally provide a right of access to information in a designated record set, subject to limited exceptions.
FERPA education records provide eligible students with inspection and review rights.
Qualifying FERPA treatment records have different access provisions, including the ability to have records reviewed by an appropriate professional of the student's choice.
Applicable California law may provide additional access rights.
Requests will be handled according to the requirements governing the records involved.
B. Right to Request an Amendment
You may request corrections or amendments to records you believe are inaccurate or incomplete.
Sierra College Health Services will review requests according to applicable law.
If a request is denied, you may have the right to submit a statement of disagreement or pursue other applicable review procedures.
C. Right to Request Restrictions
When HIPAA applies, you may request restrictions on certain uses or disclosures of your protected health information.
We are not required to agree to every requested restriction.
However, when HIPAA applies, certain restrictions on disclosures to health plans are mandatory when an individual pays in full out of pocket for a healthcare item or service and other legal conditions are satisfied.
D. Right to Request Confidential Communications
You may request that Health Services communicate with you through alternative methods or at alternative locations when permitted by applicable law.
For example, you may request communications through a particular telephone number or mailing address.
Reasonable requests will be accommodated as required by law.
E. Right to an Accounting of Disclosures
When HIPAA applies, you may request an accounting of certain disclosures of your protected health information.
Not all disclosures are included in an accounting. Applicable exclusions, time periods, and procedural requirements will be followed.
F. Right to Receive a Copy of This Notice
You may request a paper or electronic copy of the applicable Notice of Privacy Practices.
G. Right to Designate a Personal Representative
When permitted by applicable law, an authorized personal representative may exercise certain rights on your behalf.
Appropriate documentation of legal authority may be required.
H. Right to File a Complaint
You may submit a complaint if you believe your health information has been improperly accessed, used, or disclosed.
You will not be retaliated against for submitting a privacy complaint.
11. Privacy and Security of Electronic Health Information
Sierra College Health Services maintains administrative, technical, and physical safeguards appropriate to the information it maintains and the laws that apply.
These safeguards may include:
- Access controls for electronic records.
- Individual user authentication.
- Secure record storage.
- Workforce confidentiality training.
- Policies governing authorized access.
- Security monitoring and incident response procedures.
- Secure handling and disposal of records.
Access to records is limited according to applicable privacy requirements and authorized operational responsibilities.
12. Breach Notification
If health information is accessed, used, or disclosed in a manner that violates applicable privacy or security requirements, Sierra College Health Services will evaluate the incident and take appropriate action.
When legally required, affected individuals and appropriate government agencies will be notified.
Notification requirements depend on the nature of the information, the applicable privacy law, and the circumstances of the incident.
13. Our Responsibilities
Sierra College Health Services is responsible for:
- Protecting health information in accordance with applicable law.
- Following approved privacy and confidentiality policies.
- Providing required privacy notices.
- Responding to requests concerning privacy rights.
- Maintaining appropriate administrative and security safeguards.
- Investigating reported privacy concerns.
- Providing legally required breach notifications.
- Updating privacy practices when laws or operational requirements change.
When a HIPAA Notice of Privacy Practices applies, Sierra College Health Services will follow the terms of the notice currently in effect.
14. Changes to This Notice
Sierra College Health Services reserves the right to revise its privacy practices and notices as permitted by law.
Revisions may be necessary because of changes in federal or California law, healthcare operations, technology, or institutional policies.
Updated notices will be made available through appropriate college communication channels and upon request.
Material revisions to HIPAA notices will be distributed or posted as required by applicable regulations.
15. Privacy Questions and Complaints
If you have questions about the confidentiality of your health information, wish to exercise an applicable privacy right, or believe your privacy has been violated, please contact Sierra College Health Services.
Privacy Officer
Sierra College Health Services
5100 Sierra College Blvd.
Rocklin, CA 95677
Nevada County Campus
250 Sierra College Drive
Grass Valley, CA 95945
Health Services Main Phone: (916) 660-7490
Designated Privacy Officer: [Confirm current designation and direct contact information]
Individuals with concerns involving HIPAA-covered information may also submit complaints to the U.S. Department of Health and Human Services, Office for Civil Rights.
File an HHS Civil Rights or HIPAA Complaint
For concerns involving FERPA-protected student records, information about federal student privacy rights is available through the U.S. Department of Education.
U.S. Department of Education — Student Privacy
16. Additional Information
For more information about Sierra College Health Services, available healthcare services, or questions about medical and mental health confidentiality, contact Health Services.
Visit Sierra College Health Services
This notice is intended to describe the privacy practices and rights applicable to Sierra College Health Services. It must be reviewed and approved for consistency with current college operations, applicable federal and California laws, and any required program-specific notices before becoming effective.