HIPAA Privacy Notice
Effective: September 23, 2013
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW ITCAREFULLY.
This notice will tell you how Developmental Disabilities Resource Center (DDRC) may use and disclose or share protected health information about you(individual receiving services). Protected health information means any healthinformation about you that identifies you or for which there is a reasonablebasis to believe the information can be used to identify you. In the headerabove, that information is referred to as "medical information."
This notice also will tell you about your rights and our duties with respectto protected health information about you. In addition, it will tell you how to complain to us if you believe we have violated your privacy rights.
How We May Use and Share Protected Health Information About You
Developmental Disability Determination
DDRC is responsible for determining a developmental disability for individuals interested in accessing developmental disability services. Protected health information is reviewed by developmental disability professionals withexpertise in this area. For example, individuals may be referred for assessmentsand protected health information may be shared with clinicians to assist in the evaluation.
Treatment
DDRC may use protected health information about you to obtain, provide, coordinateor manage the services, supports, and health care you receive from us and other providers. We may disclose protected health information about you to doctors, nurses, developmental disability professionals, resource and service coordinators,case managers, psychologists, social workers, direct support staff and other agency staff, volunteers and other persons who are involved in supporting you or providing care.
We may consult with other health care providers concerning you and, as part of the consultation, share your protected health information with them. For example, staff may discuss your information to develop and carry out your individualized service plan (SP). Staff may share information to coordinate needed services, such as medical tests, transportation to a doctor’s visit, physical therapy, etc. Staff may need to share protected health information to entities outside of our organization (for example, another provider or a state/local agency) to access benefits or obtain new services for you.
Payment
DDRC may use and disclose protected health information about you so that we can be paid for services we provide for you or purchase on your behalf. This can include billing a third party payer, such as Medicaid, Colorado Health Care Policy & Financing or Colorado Division for Developmental Disabilities. For example, we may share your protected health information with a federal disability determination contractor to ensure you are eligible for Medicaid. We may also provide the Division for Developmental Disabilities information about the services provided to you so we will be reimbursed for those services.
Health Care Operations
DDRC may use and share protected health information about you for our own operations to ensure services are appropriate and high quality. For example, this protected health information may be used to monitor the performance of staff providing services, for quality improvement of services being provided, to the Human Rights Committee to safeguard rights of individuals receiving services, to train staff and/or volunteers, or for external audits and reviews including accreditation and licensing.
How We Will Contact You
Unless you tell us otherwise in writing, we may contact you by telephone, e-mail, mail or fax, at either your home or your workplace. At either location, we may leave messages for you on the answering machine or by voice mail. For example, DDRC may contact you about upcoming appointments for meetings, treatment or services. If you want to request that we communicate to you in a certain way orat a certain location, see the “Right to Receive Confidential Communications” section of this notice.
Alternative Treatment and Service Options
DDRC may use and disclose protected health information about you so that you may be contacted about alternative treatment and service options that may be of interest to you. We will not provide protected health information to alternative treatment or service providers without your express written authorization outside of emergency situations.
Sharing Information with Family and Others
DDRC may disclose to a parent/guardian, personal representative, family member, other relative, a close personal friend, or any other person identified by you, protected health information about you that is directly relevant to that person's involvement with the services and supports you receive or payment for those services and supports. We also may use or disclose protected health information about you to notify, or assist in notifying, those persons of your location, general condition, or death. In the event of your death, we may disclose to any of those persons who were involved in your care for payment for health care prior to your death, protected health information about you that is relevant tothat person’s involvement, unless doing so is inconsistent with any prior expressed preference of you that is known to us.
If there is anyone that we may contact in the above situations that you DO NOT want us to disclose protected health information about you to, please notify your Resource Coordinator or Director of Resource Coordination/Privacy Officer, 11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363.
Disaster Relief
DDRC may use or share protected health information about you to a public or private entity authorized by law or by its charter to assist in disaster relief efforts. This will be done to coordinate with those entities in notifying a parent/guardian, personal representative, family member, other relative, close personal friend, or other person identified by you of your location, general condition or death.
Required by Law
DDRC may use or disclose protected health information about you when required to do so by law such as in response to a court order or subpoena.
Public Health Activities
DDRC may use or disclose your protected health information about you for public health activities and purposes including but not limited to: preventing orcontrolling disease, injury or disability; reporting disease or infection exposure; reporting to the United States Food and Drug administration problems with products and reactions to medications.
Proof of Immunization
DDRC does not generally use or maintain immunization records. However, should proof of immunization be requested we may use or disclose immunization information to a school about you: (a) if you are a student or prospective student of theschool; (b) the information is limited to proof of immunization; (c) the schoolis required by State or other law to have the proof of immunization prior to admitting you; and, (d) we obtain and document the agreement to the disclosure from either: (1) your parent, guardian, or other person standing in locoparentis of you if you are an unemancipated minor, or (2) from you if you are an adult or an emancipated minor.
Mistreatment, Abuse, Neglect, Exploitation or Domestic Violence
DDRC may disclose protected health information about you to a government and/or regulatory authority authorized by law to receive reports of mistreatment, abuse, neglect, exploitation or domestic violence, if we believe you are a victim, perpetrator or witness of mistreatment, abuse, neglect, exploitation or domestic violence. This will occur to the extent the disclosure is: (a) required by law; (b) agreed to by you or your personal representative; or, (c) authorized by law and we believe the disclosure is necessary to prevent serious harm to you or to other potential victims, or, if you are incapacitated and certain other conditions are met, a law enforcement or other public official represents that immediate enforcement activity depends on the disclosure.
Health Oversight Activities
DDRC may disclose protected health information about you to a health oversight agency for activities authorized by law, including audits, investigations, inspections, licensure or disciplinary actions. These include but are not limited to the U.S. Department of Health and Human Services, the Office of Civil Rights, the Colorado Department of Human Services, Colorado Departmentof Health and Environment and. Colorado Health Care Policy and Financing.
Judicial and Administrative Proceedings
DDRC may disclose protected health information about you in the course of any judicial or administrative proceeding in response to an order of the courtor administrative tribunal. We also may disclose protected health information about you in response to a subpoena, discovery request, or other legal process but only if efforts have been made to tell you about the request or to obtain an order protecting the information to be shared.
For Law Enforcement Purposes
DDRC may disclose specific protected health information about you to a law enforcement official for law enforcement purposes such as: 1) as required by law; 2) in response to a court, grand jury or administrative order, warrant or subpoena; 3) to identify or locate a suspect, fugitive, material witness ormissing person; 4) about an actual or suspected victim of a crime and that person agrees to the disclosure and, if unable to obtain agreement, in limited circumstances, the information may still be disclosed; 5) to alert law enforcement officials to a death if we suspect the death may have resulted from criminal conduct; 6) about crimes that occur in our programs and services; 7) to report a crime in emergency circumstances.
Coroners, Medical Examiners
DDRC may disclose protected health information about you to a coroner or medical examiner when necessary to perform their duties such as identifying a deceased person and determining cause of death.
Funeral Directors
DDRC may disclose protected health information about you to funeral directors as necessary for them to carry out their duties.
Organ, Eye or Tissue Donation
If DDRC has a written record of your intent to be an organ, eye or tissue donor, we may disclose protected health information about you to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of organs, eyes or tissue. If you are incapacitated, we will share protected health information only as authorized by your personal representative.
Research
In rare situations, DDRC may use or share protected health information about you for research, but only with your written authorization. Informed consent from participants, their guardians or the parents of a minor must be obtained. Such consent may be given only after consultation with the interdisciplinary team and a developmental disabilities professional not affiliated with the service agency from which the person receives services. Any research will be reviewed and approvedby the DDRC Human Rights Committee.
To Avert Serious Threat to Health or Safety
DDRC may use or disclose protected health information about you if we believe the use or disclosure is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public. We also may release information about you if we believe the disclosure is necessary for law enforcement authorities to identify or apprehend an individual who admitted participation ina violent crime or who is an escapee from a correctional institution or from lawful custody.
Specialized Government Functions
DDRC may disclose protected health information about you to authorized federal officials for the conduct of intelligence, counter-intelligence, national security activities authorized by law or protection to the President of the United States, certain other federal officials, foreign heads of state, to conduct investigations authorized by certain federal laws or required security clearances.
Correctional Institutions
DDRC may disclose protected health information about an inmate or other individual to a correctional institution or law enforcement official having custody the inmate or other individual. The disclosure will be made if the disclosure is necessary: (a) to provide health care to such individuals; (b) for the health and safety of such individuals and other inmates;, (c) the health and safety of the officers, employees and others at the correctional institution; (d) the health and safety of such individuals and officers or persons responsible for the transporting of inmates or transferring from one institution to another; (e) law enforcement onthe premises of the correctional institution; or (f) the administration and maintenanceof the safety, security and good order of the correctional institution.
Workers Compensation
DDRC may share protected health information about you to the extent necessary to comply with workers’ compensation and similar laws that provide benefits for work-related injuries or illness without regard to fault.
Fundraising
DDRC may use and disclose protected health information about you to contact you to raise funds for DDRC. We may disclose protected health information to a business associate of DDRC or a foundation related to DDRC so that business associate or foundation may contact you to raise money for the benefit of DDRC. We will only release: (a) demographic information relating to you, including your name, address, other contact information, and date of birth and b) type of service information.
You have the right to opt out of receiving fundraising communications. If you do not want DDRC or its foundation to contact you for fundraising, you must notify the Director of Development at 11177 W. 8th Avenue, Lakewood, CO 80215, provide written notice of your desire to opt out and include your name, address and the name of the person receiving service.
Certain Uses and Disclosures that Require Your Written Authorization
Psychotherapy Notes
Your authorization is required before we may use or disclose psychotherapy notes unless the use or disclosure is: (a) by the originator of the psychotherapy notes for treatment; (b) for our own training programs for students, trainees, or practitioners in mental health; (c) to defend ourselves in a legal action or other proceeding brought by you; (d) when required by law; or, (e) permitted by law for oversight of the originator of the psychotherapy notes.
Marketing
DDRC does not use your protected health information for marketing. However we may communicate with you about a new product or service offering which may occur without your authorization. When an authorization is required to communicate with you about a product or service to encourage you to purchase the product or service, the authorization will state when financial remuneration to DDRC is involved.
Sale of Information
DDRC does not sell your information. Your authorization is required for any disclosure of your protected health information when the disclosure is in exchange for director indirect remuneration from or on behalf of the recipient of the protected health information. However, your authorization may not be required under certain conditions if the disclosure is: (a) for public health purposes; (b) for research purposes; (c) for treatment and payment; (d) if we are being sold, transferred, merged or consolidated; (e) to a business associate of ours for activities undertaken on our behalf; (f) to you when requested by you; (g) required by law; (h) when permittedby applicable law where the only remuneration received by us is a fee permitted by law.
Other Uses and Disclosures
Other uses and disclosures will be made only with your written authorization. You may revoke such an authorization at any time by notifying the Director of Resource Coordination/Privacy Officer, 11177 W. 8th Ave., Lakewood, CO, 80215, in writing of your desire to revoke it. However, if you revoke such an authorization, it will not have any affect on actions taken by us in reliance on it.
Your Rights Regarding Your Protected Health Information
Right to Request Restrictions
You have the right to request that we restrict the use or release of protected health information about you to carry out treatment, payment, or health care operations.You also have the right to request that we restrict the uses or releases we make to: (a) a family member, other relative, a close personal friend or any other person identified by you; or, (b) public or private entities for disaster relief efforts. For example, you could ask that we not share protected health information about you with your brother or sister.
DDRC is not required to agree to requested restrictions with one exception: disclosures to a health plan if, a) it is for payment or health care operations not required by law and, b) the protected health information pertains solely to a health care item or services paid in full to DDRC by the individual or on behalf of the individual (other than the health plan).
However, if we do agree, we will follow that restriction unless the information is needed to provide emergency treatment. Even if we agree to a restriction, either you or DDRC can later terminate the restriction. We cannot agree to limit uses and disclosures that are required by law.
You may request a restriction at any time. Requests must be made in writing and include (a) what information you want to limit; (b) whether you want to limit use or release or both; and, (c) to whom you want the limits to apply (for example,release of information to your brother). For assistance in completing the request form, contact your DDRC Privacy Officer at 303-233-3363.
Right to Receive Confidential Communications
You have the right to request that we communicate protected health information about you to you in a certain way or at a certain location. For example, you can ask that we only contact you by mail, phone or at home. We will not require you to tell us why you are asking for the confidential communication. DDRC will make efforts to accommodate your request, however, we may not be able to meet your restriction andmay require an alternate address or other method to contact you to accomplish required treatment, payment and health care operation functions.
If you want to request alternative communication, you must do so in writing to the DDRC Privacy Officer, 11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363 .Your request must specify how, where or when you request to be contacted.
Right to Inspect and Copy Your Protected Health Information
You have the right to inspect and obtain a copy of protected health information about you, for as long as the information is maintained except for psychotherapy notes or information compiled in anticipation of a civil, criminal or administrativeaction or proceeding. To inspect or copy protected health information about you, you must submit your request in writing to the DDRC Privacy Officer, 11177 W. 8thAvenue, Lakewood, Colorado, 80215, 303-233-3363. Your request should state specifically what protected health information you want to inspect or copy.
DDRC will act on your request within thirty (30) working days after we receive your request. If we grant your request, in whole or in part, we will inform you of our acceptance of your request and provide access and copying. The information will be provided in the form or format requested if readily producible in that form or format. Your first copy will be provided at no charge. Additional copying and mailing charges may be assessed.
DDRC may deny your request to inspect and copy protected health information. If DDRC denies your request, we will inform you of the basis for the denial, how you may request a review of your denial, and how you may complain. DDRC will designate an impartial decision-maker to hear requests for review of denials.
Right to Request Amendment
You have the right to request that DDRC amend any protected health information that you feel may be incorrect or missing, as long as this protected health information about you is maintained by DDRC.
To request an amendment, you must submit your request in writing to DDRC’s Privacy Officer, DDRC, 11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363. Your request must state the amendment desired and provide a reason in support of that amendment. We will act on your request within sixty (60) calendar days after we receive your request. If DDRC grants the request, in whole or in part, we will inform you of our acceptance and seek your identification of, and agreement to share the amendment with relevant other persons. We also will make the appropriate amendment to the protected health information by appending the information.
DDRC may deny your request to amend protected health information about you. We may deny your request if it is not in writing or if it does not provide a reason in support of the amendment. In addition, we may deny your request if you ask us to amend protected health information that: (a) was not created by DDRC, unless the originator is no longer available to act on the requested amendment; (b) is not part of the protected health information maintained by DDRC; (c) would not be available for you to inspect or copy; or; (d) is shown to be accurate and complete.
If DDRC denies your request, we will inform you of the basis for the denial. You will have the right to submit a statement disagreeing with our denial. We may prepare a rebuttal to that statement. Your request for amendment, our denial of the request, your statement of disagreement, if any, and our rebuttal, if any, will then be appended to the protected health information involved. All of that will then be included with any subsequent disclosure of the information, or, at our election, we may include a summary of any of that information.
If you do not submit a statement of disagreement, you may ask that we include your request for amendment and our denial with any future disclosures of the information. We will include your request for amendment and our denial (or a summary of that information) with any subsequent disclosure of the protected health information involved.
You have the right to complain about our denial of your request. You may do this by putting your complaint in writing to the DDRC HIPAA Complaint Officer, 11177 W. 8th Ave., Lakewood, CO, 80215.
Right to an Accounting of Disclosures
You have the right to receive an accounting of disclosures of protected health information about you. The accounting may be for up to six (6) years prior to the date on which you request the accounting or for a shorter period as the individual may request.
The right to an accounting of disclosures does not apply to the following types of disclosures: (a) to carry out treatment, payment and health care operations; (b) disclosures of your protected health information made to you; (c) incidental releases; (d) disclosures you have authorized; (e) to persons involved in your care; (f) for disaster relief, national security or intelligence purposes; (g) to correctional institutions or law enforcement officials when in custody; (h) disclosures that are part of a limited data set for purposes of research, public health, or health care operations (a limited data set is where things that would directly identify you have been removed).
To request an accounting of disclosures, you must submit your request in writing to the Privacy Officer, 11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363. Your request must state a time period for the disclosures. It may not be longer than six (6) years from the date we receive your request.
Usually, we will act on your request within sixty 60) calendar days after we receive your request. Within that time, we will either provide the accounting of releases to you or give you a written statement of when we will provide the accounting and why the delay is necessary.
There will be no charge for the first list we provide to you in any twelve (12) month period. For additional lists in a twelve (12) month period, we may charge you for the cost of providing the list. DDRC will notify you of the cost involved and give you an opportunity to withdraw or modify your request before you are charged.
Right to a Copy of This Notice
You have the right to obtain a paper copy of our Notice of Privacy Practices. You may obtain a paper copy even though you may have agreed to receive the notice electronically. You may request a copy of our Notice of Privacy Practices at any time.
You may obtain a copy of our Notice of Privacy Practices over the Internet at our web site, www.ddrcco.com, or by contacting your Resource Coordinator or the DDRC Executive Assistant, 11177 W. 8th Ave, Lakewood, CO, 80215 or call 303-233-3363.
Our Responsibilities
Generally
DDRC is required by law to maintain the privacy of protected health information about you, to provide individuals with notice of our legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured protected health information. We are required toabide by the terms of our Notice of Privacy Practices in effect at the time.
Our Right to Change Notice of Privacy Practices
DDRC reserves the right to change this notice. We reserve the right to make the new notice’s provisions effective for all protected health information that we maintain, including that created or received by us prior to the effective date of the new notice.
Availability of Notice of Privacy Practices
A copy of current Notice of Privacy Practices will be posted in all facilities and on our web site, www.ddrcco.com. At any time you may obtain a copy of our current Notice of Privacy Practices. To obtain a paper copy of this notice, please contact the DDRC Executive Assistant, 11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363.
Effective Date of Notice
The effective date of notice is stated on the first page this notice.
Complaints
To file a complaint with DDRC, contact our Customer Relations Manager, 11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363. All complaints should be submittedin writing. To file a complaint with the United States Secretary of Health and Human Services, send your complaint to him or her in care of: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington,D.C. 20201.
Questions and Information
If you have any questions or want more information concerning this Notice of Privacy Practices, please contact DDRC’s Privacy Officer, 11177 W. 8th Ave., Lakewood, Colorado, 80215, 303-233-3363.