HIPAA Privacy Notice
NOTICE OF PRIVACY PRACTICES
Effective: September 23, 2013
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED ANDDISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW ITCAREFULLY.
This notice will tell you how Developmental Disabilities Resource Center (DDRC)may use and disclose or share protected health information about you(individual receiving services). Protected health information means any healthinformation about you that identifies you or for which there is a reasonablebasis to believe the information can be used to identify you. In the headerabove, that information is referred to as "medical information."
This notice also will tell you about your rights and our duties with respectto protected health information about you. In addition, it will tell you howto complain to us if you believe we have violated your privacy rights.
How We May Use and Share Protected Health Information About You
Developmental Disability Determination
DDRC is responsible for determining a developmental disability for individualsinterested in accessing developmental disability services. Protected healthinformation is reviewed by developmental disability professionals withexpertise in this area. For example, individuals may be referred for assessmentsand protected health information may be shared with clinicians to assist in theevaluation.
DDRC may use protected health information about you to obtain, provide, coordinateor manage the services, supports, and health care you receive from us and otherproviders. We may disclose protected health information about you to doctors,nurses, developmental disability professionals, resource and service coordinators,case managers, psychologists, social workers, direct support staff and otheragency staff, volunteers and other persons who are involved in supporting youor providing care.
We may consult with other health care providers concerning you and, as part ofthe consultation, share your protected health information with them. For example,staff may discuss your information to develop and carry out your individualizedservice plan (SP). Staff may share information to coordinate needed services,such as medical tests, transportation to a doctor’s visit, physical therapy, etc.Staff may need to share protected health information to entities outside of ourorganization (for example, another provider or a state/local agency) to accessbenefits or obtain new services for you.
DDRC may use and disclose protected health information about you so that wecan be paid for services we provide for you or purchase on your behalf. Thiscan include billing a third party payer, such as Medicaid, Colorado Health CarePolicy & Financing or Colorado Division for Developmental Disabilities. Forexample, we may share your protected health information with a federal disabilitydetermination contractor to ensure you are eligible for Medicaid. We may alsoprovide the Division for Developmental Disabilities information about the servicesprovided to you so we will be reimbursed for those services.
Health Care Operations
DDRC may use and share protected health information about you for our ownoperations to ensure services are appropriate and high quality. For example,this protected health information may be used to monitor the performance ofstaff providing services, for quality improvement of services being provided,to the Human Rights Committee to safeguard rights of individuals receiving services,to train staff and/or volunteers, or for external audits and reviews includingaccreditation and licensing.
How We Will Contact You
Unless you tell us otherwise in writing, we may contact you by telephone, e-mail,mail or fax, at either your home or your workplace. At either location, we mayleave messages for you on the answering machine or by voice mail. For example,DDRC may contact you about upcoming appointments for meetings, treatment orservices. If you want to request that we communicate to you in a certain way orat a certain location, see the “Right to Receive Confidential Communications”section of this notice.
Alternative Treatment and Service Options
DDRC may use and disclose protected health information about you so that you maybe contacted about alternative treatment and service options that may be of interestto you. We will not provide protected health information to alternative treatmentor service providers without your express written authorization outside ofemergency situations.
Sharing Information with Family and Others
DDRC may disclose to a parent/guardian, personal representative, family member,other relative, a close personal friend, or any other person identified by you,protected health information about you that is directly relevant to that person'sinvolvement with the services and supports you receive or payment for thoseservices and supports. We also may use or disclose protected health informationabout you to notify, or assist in notifying, those persons of your location,general condition, or death. In the event of your death, we may disclose to anyof those persons who were involved in your care for payment for health careprior to your death, protected health information about you that is relevant tothat person’s involvement, unless doing so is inconsistent with any prior expressedpreference of you that is known to us.
If there is anyone that we may contact in the above situations that you DO NOTwant us to disclose protected health information about you to, please notifyyour Resource Coordinator or Director of Resource Coordination/Privacy Officer,11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363.
DDRC may use or share protected health information about you to a public or privateentity authorized by law or by its charter to assist in disaster relief efforts.This will be done to coordinate with those entities in notifying a parent/guardian,personal representative, family member, other relative, close personal friend,or other person identified by you of your location, general condition or death.
Required by Law
DDRC may use or disclose protected health information about you when requiredto do so by law such as in response to a court order or subpoena.
Public Health Activities
DDRC may use or disclose your protected health information about you for publichealth activities and purposes including but not limited to: preventing orcontrolling disease, injury or disability; reporting disease or infectionexposure; reporting to the United States Food and Drug administration problemswith products and reactions to medications.
Proof of Immunization
DDRC does not generally use or maintain immunization records. However, shouldproof of immunization be requested we may use or disclose immunization informationto a school about you: (a) if you are a student or prospective student of theschool; (b) the information is limited to proof of immunization; (c) the schoolis required by State or other law to have the proof of immunization prior toadmitting you; and, (d) we obtain and document the agreement to the disclosurefrom either: (1) your parent, guardian, or other person standing in locoparentis of you if you are an unemancipated minor, or (2) from you if you arean adult or an emancipated minor.
Mistreatment, Abuse, Neglect, Exploitation or Domestic Violence
DDRC may disclose protected health information about you to a governmentand/or regulatory authority authorized by law to receive reports of mistreatment,abuse, neglect, exploitation or domestic violence, if we believe you are a victim,perpetrator or witness of mistreatment, abuse, neglect, exploitation or domesticviolence. This will occur to the extent the disclosure is: (a) required by law;(b) agreed to by you or your personal representative; or, (c) authorized by lawand we believe the disclosure is necessary to prevent serious harm to you or toother potential victims, or, if you are incapacitated and certain other conditionsare met, a law enforcement or other public official represents that immediateenforcement activity depends on the disclosure.
Health Oversight Activities
DDRC may disclose protected health information about you to a health oversightagency for activities authorized by law, including audits, investigations,inspections, licensure or disciplinary actions. These include but are notlimited to the U.S. Department of Health and Human Services, the Office ofCivil Rights, the Colorado Department of Human Services, Colorado Departmentof Health and Environment and. Colorado Health Care Policy and Financing.
Judicial and Administrative Proceedings
DDRC may disclose protected health information about you in the course ofany judicial or administrative proceeding in response to an order of the courtor administrative tribunal. We also may disclose protected health informationabout you in response to a subpoena, discovery request, or other legal processbut only if efforts have been made to tell you about the request or to obtainan order protecting the information to be shared.
For Law Enforcement Purposes
DDRC may disclose specific protected health information about you to a lawenforcement official for law enforcement purposes such as:1) as required bylaw; 2) in response to a court, grand jury or administrative order, warrant orsubpoena; 3) to identify or locate a suspect, fugitive, material witness ormissing person; 4) about an actual or suspected victim of a crime and thatperson agrees to the disclosure and, if unable to obtain agreement, in limitedcircumstances, the information may still be disclosed; 5) to alert law enforcementofficials to a death if we suspect the death may have resulted from criminal conduct;6) about crimes that occur in our programs and services; 7) to report a crime inemergency circumstances.
Coroners, Medical Examiners
DDRC may disclose protected health information about you to a coroner or medicalexaminer when necessary to perform their duties such as identifying a deceasedperson and determining cause of death.
DDRC may disclose protected health information about you to funeral directorsas necessary for them to carry out their duties.
Organ, Eye or Tissue Donation
If DDRC has a written record of your intent to be an organ, eye or tissue donor,we may disclose protected health information about you to organ procurementorganizations or other entities engaged in the procurement, banking or transplantationof organs, eyes or tissue. If you are incapacitated, we will share protected healthinformation only as authorized by your personal representative.
In rare situations, DDRC may use or share protected health information aboutyou for research, but only with your written authorization. Informed consent fromparticipants, their guardians or the parents of a minor must be obtained. Suchconsent may be given only after consultation with the interdisciplinary team anda developmental disabilities professional not affiliated with the service agencyfrom which the person receives services. Any research will be reviewed and approvedby the DDRC Human Rights Committee.
To Avert Serious Threat to Health or Safety
DDRC may use or disclose protected health information about you if we believethe use or disclosure is necessary to prevent or lessen a serious or imminentthreat to the health or safety of a person or the public. We also may releaseinformation about you if we believe the disclosure is necessary for law enforcementauthorities to identify or apprehend an individual who admitted participation ina violent crime or who is an escapee from a correctional institution or from lawfulcustody.
Specialized Government Functions
DDRC may disclose protected health information about you to authorized federalofficials for the conduct of intelligence, counter-intelligence, national securityactivities authorized by law or protection to the President of the United States,certain other federal officials, foreign heads of state, to conduct investigationsauthorized by certain federal laws or required security clearances.
DDRC may disclose protected health information about an inmate or other individualto a correctional institution or law enforcement official having custody the inmateor other individual. The disclosure will be made if the disclosure is necessary:(a) to provide health care to such individuals; (b) for the health and safety ofsuch individuals and other inmates;, (c) the health and safety of the officers,employees and others at the correctional institution; (d) the health and safetyof such individuals and officers or persons responsible for the transporting ofinmates or transferring from one institution to another; (e) law enforcement onthe premises of the correctional institution; or (f) the administration and maintenanceof the safety, security and good order of the correctional institution.
DDRC may share protected health information about you to the extent necessaryto comply with workers’ compensation and similar laws that provide benefits forwork-related injuries or illness without regard to fault.
DDRC may use and disclose protected health information about you to contactyou to raise funds for DDRC. We may disclose protected health information toa business associate of DDRC or a foundation related to DDRC so that businessassociate or foundation may contact you to raise money for the benefit of DDRC.We will only release: (a) demographic information relating to you, includingyour name, address, other contact information, and date of birth and b) typeof service information.
You have the right to opt out of receiving fundraising communications. If youdo not want DDRC or its foundation to contact you for fundraising, you mustnotify the Director of Development at 11177 W. 8th Avenue, Lakewood, CO 80215,provide written notice of your desire to opt out and include your name, addressand the name of the person receiving service.
Certain Uses and Disclosures that Require Your Written Authorization
Your authorization is required before we may use or disclose psychotherapynotes unless the use or disclosure is: (a) by the originator of the psychotherapynotes for treatment; (b) for our own training programs for students, trainees,or practitioners in mental health; (c) to defend ourselves in a legal action orother proceeding brought by you; (d) when required by law; or, (e) permitted bylaw for oversight of the originator of the psychotherapy notes.
DDRC does not use your protected health information for marketing. However wemay communicate with you about a new product or service offering which may occurwithout your authorization. When an authorization is required to communicate withyou about a product or service to encourage you to purchase the product or service,the authorization will state when financial remuneration to DDRC is involved.
Sale of Information
DDRC does not sell your information. Your authorization is required for any disclosureof your protected health information when the disclosure is in exchange for director indirect remuneration from or on behalf of the recipient of the protected healthinformation. However, your authorization may not be required under certain conditionsif the disclosure is: (a) for public health purposes; (b) for research purposes;(c) for treatment and payment; (d) if we are being sold, transferred, merged orconsolidated; (e) to a business associate of ours for activities undertaken onour behalf; (f) to you when requested by you; (g) required by law; (h) when permittedby applicable law where the only remuneration received by us is a fee permittedby law.
Other Uses and Disclosures
Other uses and disclosures will be made only with your written authorization.You may revoke such an authorization at any time by notifying the Director ofResource Coordination/Privacy Officer, 11177 W. 8th Ave., Lakewood, CO, 80215,in writing of your desire to revoke it. However, if you revoke such an authorization,it will not have any affect on actions taken by us in reliance on it.
Your Rights Regarding Your Protected Health Information
Right to Request Restrictions
You have the right to request that we restrict the use or release of protectedhealth information about you to carry out treatment, payment, or health care operations.You also have the right to request that we restrict the uses or releases we maketo: (a) a family member, other relative, a close personal friend or any other personidentified by you; or, (b) public or private entities for disaster relief efforts.For example, you could ask that we not share protected health information about youwith your brother or sister.
DDRC is not required to agree to requested restrictions with one exception: disclosuresto a health plan if, a) it is for payment or health care operations not requiredby law and, b) the protected health information pertains solely to a health careitem or services paid in full to DDRC by the individual or on behalf of the individual(other than the health plan).
However, if we do agree, we will follow that restriction unless the informationis needed to provide emergency treatment. Even if we agree to a restriction, eitheryou or DDRC can later terminate the restriction. We cannot agree to limit usesand disclosures that are required by law.
You may request a restriction at any time. Requests must be made in writing andinclude (a) what information you want to limit; (b) whether you want to limit useor release or both; and, (c) to whom you want the limits to apply (for example,release of information to your brother). For assistance in completing the requestform, contact your DDRC Privacy Officer at 303-233-3363.
Right to Receive Confidential Communications
You have the right to request that we communicate protected health information aboutyou to you in a certain way or at a certain location. For example, you can ask thatwe only contact you by mail, phone or at home. We will not require you to tell uswhy you are asking for the confidential communication. DDRC will make efforts toaccommodate your request, however, we may not be able to meet your restriction andmay require an alternate address or other method to contact you to accomplish requiredtreatment, payment and health care operation functions.
If you want to request alternative communication, you must do so in writing to theDDRC Privacy Officer, 11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363.Your request must specify how, where or when you request to be contacted.
Right to Inspect and Copy Your Protected Health Information
You have the right to inspect and obtain a copy of protected health informationabout you, for as long as the information is maintained except for psychotherapynotes or information compiled in anticipation of a civil, criminal or administrativeaction or proceeding. To inspect or copy protected health information about you,you must submit your request in writing to the DDRC Privacy Officer, 11177 W. 8thAvenue, Lakewood, Colorado, 80215, 303-233-3363. Your request should state specificallywhat protected health information you want to inspect or copy.
DDRC will act on your request within thirty (30) working days after we receive yourrequest. If we grant your request, in whole or in part, we will inform you of ouracceptance of your request and provide access and copying. The information will beprovided in the form or format requested if readily producible in that form or format.Your first copy will be provided at no charge. Additional copying and mailing chargesmay be assessed.
DDRC may deny your request to inspect and copy protected health information. If DDRCdenies your request, we will inform you of the basis for the denial, how you mayrequest a review of your denial, and how you may complain. DDRC will designate animpartial decision-maker to hear requests for review of denials.
Right to Request Amendment
You have the right to request that DDRC amend any protected health information that you feel may be incorrect or missing, as long as this protected health information about you is maintained by DDRC.
To request an amendment, you must submit your request in writing to DDRC’s Privacy Officer, DDRC, 11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363. Your request must state the amendment desired and provide a reason in support of that amendment. We will act on your request within sixty (60) calendar days after we receive your request. If DDRC grants the request, in whole or in part, we will inform you of our acceptance and seek your identification of, and agreement to share the amendment with relevant other persons. We also will make the appropriate amendment to the protected health information by appending the information.
DDRC may deny your request to amend protected health information about you. We may deny your request if it is not in writing or if it does not provide a reason in support of the amendment. In addition, we may deny your request if you ask us to amend protected health information that: (a) was not created by DDRC, unless the originator is no longer available to act on the requested amendment; (b) is not part of the protected health information maintained by DDRC; (c) would not be available for you to inspect or copy; or; (d) is shown to be accurate and complete.
If DDRC denies your request, we will inform you of the basis for the denial. You will have the right to submit a statement disagreeing with our denial. We may prepare a rebuttal to that statement. Your request for amendment, our denial of the request, your statement of disagreement, if any, and our rebuttal, if any, will then be appended to the protected health information involved. All of that will then be included with any subsequent disclosure of the information, or, at our election, we may include a summary of any of that information.
If you do not submit a statement of disagreement, you may ask that we include your request for amendment and our denial with any future disclosures of the information. We will include your request for amendment and our denial (or a summary of that information) with any subsequent disclosure of the protected health information involved.
You have the right to complain about our denial of your request. You may do this by putting your complaint in writing to the DDRC HIPAA Complaint Officer, 11177 W. 8th Ave., Lakewood, CO, 80215.
Right to an Accounting of Disclosures
You have the right to receive an accounting of disclosures of protected health information about you. The accounting may be for up to six (6) years prior to the date on which you request the accounting or for a shorter period as the individual may request.
The right to an accounting of disclosures does not apply to the following types of disclosures: (a) to carry out treatment, payment and health care operations; (b) disclosures of your protected health information made to you; (c) incidental releases; (d) disclosures you have authorized; (e) to persons involved in your care; (f) for disaster relief, national security or intelligence purposes; (g) to correctional institutions or law enforcement officials when in custody; (h) disclosures that are part of a limited data set for purposes of research, public health, or health care operations (a limited data set is where things that would directly identify you have been removed).
To request an accounting of disclosures, you must submit your request in writing to the Privacy Officer, 11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363. Your request must state a time period for the disclosures. It may not be longer than six (6) years from the date we receive your request.
Usually, we will act on your request within sixty 60) calendar days after we receive your request. Within that time, we will either provide the accounting of releases to you or give you a written statement of when we will provide the accounting and why the delay is necessary.
There will be no charge for the first list we provide to you in any twelve (12) month period. For additional lists in a twelve (12) month period, we may charge you for the cost of providing the list. DDRC will notify you of the cost involved and give you an opportunity to withdraw or modify your request before you are charged.
Right to a Copy of This Notice
You have the right to obtain a paper copy of our Notice of Privacy Practices. You may obtain a paper copy even though you may have agreed to receive the notice electronically. You may request a copy of our Notice of Privacy Practices at any time.
You may obtain a copy of our Notice of Privacy Practices over the Internet at our web site, www.ddrcco.com, or by contacting your Resource Coordinator or the DDRC Executive Assistant, 11177 W. 8th Ave, Lakewood, CO, 80215 or call 303-233-3363.
DDRC is required by law to maintain the privacy of protected health informationabout you, to provide individuals with notice of our legal duties and privacy practiceswith respect to protected health information, and to notify affected individualsfollowing a breach of unsecured protected health information. We are required toabide by the terms of our Notice of Privacy Practices in effect at the time.
Our Right to Change Notice of Privacy Practices
DDRC reserves the right to change this notice. We reserve the right to make thenew notice’s provisions effective for all protected health information that we maintain,including that created or received by us prior to the effective date of the new notice.
Availability of Notice of Privacy Practices
A copy of current Notice of Privacy Practices will be posted in all facilities andon our web site, www.ddrcco.com. At any time you may obtain a copy of our currentNotice of Privacy Practices. To obtain a paper copy of this notice, please contactthe DDRC Executive Assistant, 11177 W. 8th Avenue, Lakewood, Colorado, 80215, 303-233-3363.
Effective Date of Notice
The effective date of notice is stated on the first page this notice.
To file a complaint with DDRC, contact our Customer Relations Manager, 11177 W.8th Avenue, Lakewood, Colorado, 80215, 303-233-3363. All complaints should be submittedin writing. To file a complaint with the United States Secretary of Health and HumanServices, send your complaint to him or her in care of: Office for Civil Rights,U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington,D.C. 20201.
Questions and Information
If you have any questions or want more information concerning this Notice of Privacy Practices, please contact DDRC’s Privacy Officer, 11177 W. 8th Ave., Lakewood, Colorado, 80215, 303-233-3363.