HIPAA Policies

COLE COUNTY SPECIAL SERVICES AND
COLE COUNTY RESIDENTIAL SERVICES, INC.
REVISED NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE
USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS
INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice describes how Cole County Special Services (CCSS) and Cole County Residential Services, Inc. (CCRSI) protects the protected health information (PHI) it has about you. When this information becomes a part of your record, it serves as a basis for developing a plan of services for you, a means of communicating with the health professionals who contribute to your care and a source of verification that services were provided. This Notice also describes your legal rights with regard to your personal protected health information (PHI). We are required by federal law to maintain the privacy of this personal protected health information (PHI) and to provide you with notice of our legal duties and privacy practices.

HOW CCSS/CCRSI MAY USE AND DISCLOSE PROTECTED HEALTH
INFORMATION (PHI) ABOUT YOU

CCSS/CCRSI may use and disclose your protected health information (PHI) to physicians, nurses, dietitians, therapists, or others who are involved in your care and who will provide you with treatment or services. Protected health information (PHI) includes information that we create or receive that identifies you and your past, present or future health status or care, the provision of care, or payment for that health care. The primary reasons for which we may use and disclose your protected health information (PHI) are as follows:

1. To provide treatment or services to you: This refers to the provision and coordination of your care by your Case Manager/Support Coordinator, or your doctor,  therapist or other health care provider. For example, if you need assistance with your speech, we may contact a speech therapist to arrange services for you.
2. For payment of services provided to you: Your protected health information (PHI) will be used to obtain payment for services you receive. This may include information that your health insurance plan may require before it approves or pays for health care services. For example, obtaining approval for a hearing aid may require that your protected health information (PHI) be disclosed to Medicaid. We may also provide your protected health information (PHI) to our billing department to prepare a bill to send to your insurance company, including Medicare or Medicaid, for payment for services provided.
3. For healthcare operations: We may use or disclose your protected health information (PHI) to support the business activities of our offices, including quality assessment, employee review activities, compliance reviews, and accreditation surveys. These activities are referred to as “health care operations.”

The following are circumstances where CCSS/CCRSI may use or disclose your protected health information (PHI) without first obtaining your Authorization for purposes other than treatment, payment, or health care operations.
1. For Permitted or Required by Law Activities.
2. Appointment Reminders/Other Health Services: We may use or disclose your protected health information (PHI) to contact you at the address and/or telephone number you give us to provide appointment reminders, information about treatment alternatives,  or other health-related benefits and services that may be of interest to you. We may also use and disclose your protected health information (PHI) for other marketing activities. For example, your name and address may be used to send you a newsletter about the services  we offer. We may also send you information about products or services that we believe may be beneficial to you.
3. Communication with Family or Personal Representative: Unless you object, we may disclose to a member of your family, relative, close friend or person you identify your protected health information (PHI) that directly relates to that person’s involvement in  your health care. If you are unable to agree or object to such a disclosure, we may  disclose such information, as necessary, if we determine that it is in your best interest based on our professional judgment. In the event of your death, we may share your protected health information (PHI) with family members and others who were involved in your care, unless you have previously expressed your wish that we not do so.
4. Emergencies: We may use or disclose your protected health information (PHI) in an emergency treatment situation. If this happens, we shall try to obtain your consent as soon as reasonably practicable after the delivery of treatment.
5. Communication Barriers: We may use and disclose your protected health information (PHI) if we attempt to obtain consent from you, but are unable to do so due to substantial communication barriers, and we determine using professional judgment that you intend to consent to use or disclosure under the circumstances.
6. Public Health: As required by law, we may disclose your protected health information (PHI) to a public health or legal authority charged with preventing or controlling disease, injury, or disability. For example, we may be required to disclose the fact that you have a communicable disease.
7. Health Oversight: We may disclose protected health information (PHI) to a health oversight agency for activities authorized by law; such as, audits, investigations, and inspections. Oversight agencies include government agencies that oversee the health care system, government benefit programs, other government regulatory programs, and civil rights laws.
8. Abuse or Neglect: We may disclose your protected health information (PHI) to the governmental entity or agency authorized to receive such information if we believe that you have been a victim of abuse, neglect, or domestic violence.
9. Food and Drug Administration: We may disclose your protected health information (PHI) to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, track products; to enable product recalls; to make repairs or replacements; or to conduct post-marketing surveillance.
10.Legal Proceedings: We may disclose protected health information (PHI) in response to an order of a court or administrative tribunal.
11.Law Enforcement: We may disclose limited protected health information (PHI) for law enforcement purposes to identify or locate a victim, suspect, fugitive or material witness, missing person, or for reporting a crime that occurred on our property or that may have caused a need for emergency services.
12.Coroners, Funeral Directors, and Organ Donation: We may disclose protected health information (PHI) to a coroner or medical examiner for identification purposes, determining cause of death, or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose medical/protected health information (PHI) to a funeral director to permit the funeral director to carry out his lawful duties. We may disclose such information in reasonable anticipation of death. Protected health information (PHI) may be used and disclosed for cadaveric organ, eye, or tissue donation purposes.
13.Workers’ Compensation: Your protected health information (PHI) may be disclosed by us as authorized to comply with workers’ compensation laws and other similar legally established programs.
14.Serious Threat to Health or Safety: We may use or disclose protected health information (PHI) if we believe in good faith that it is necessary to lessen or prevent a serious and imminent threat to the health and safety of a person or the public.
15.Specialized Government Functions: Your personal protected health information (PHI) may be disclosed to other entities that are covered by this law that are government programs providing public benefits. For example, we may share information with the Department of Social Services to determine your spenddown requirements, or with the Department of Health and Senior Services to coordinate care for a child with special health needs.
16.Inmates: If you are an inmate of a correctional institution or in the custody of law enforcement, we may release protected health information (PHI) about you as may be necessary for the institution to provide care to you to protect your health and safety, or the health and safety of others, or for the safety and security of the institution.
17.Immunization Records: We may disclose proof of immunizations to schools; however, we will seek to obtain the written or oral agreement of the parent, guardian, emancipated minor, or person acting in loco parentis (Latin for “in the place of a parent).

The following are circumstances where CCSS/CCRSI may use or disclose your protected health information (PHI) only after obtaining your authorization.
1. Most Uses and Disclosures of Psychotherapy Notes: Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group or family counseling session that are kept separately from the rest of your health record. These notes will typically not be used or disclosed without your Authorization. However, psychotherapy notes do not include medication prescription and monitoring, the times of your counseling session, the type of treatment furnished, results of tests, or a summary of your diagnosis, functional status, treatment plan, symptoms, prognosis and progress, which are subject to restrictions that apply to the use or disclosure of those records.
2. Marketing: If CCSS/CCRSI wants to include a photograph of you or to obtain a quote from you for inclusion in the Agency’s annual report, or on its website, or in other media presentations, we will ask for your Authorization to do so. We will also obtain your  authorization before communicating with you about a health related product or service in a situation in which CCSS/CCRSI will receive payment in exchange for the communication, with the exception of communications with you about government and government-sponsored programs or general health promotions.
3. Communication with Others Who May Not Be Covered by the Federal
Privacy Law:
a. To refer you to other agencies that may be able to provide services that you express an interest in receiving; such as, Vocational Rehabilitation, and CCSS/CCRSI.
b. To provide your attorney with information you would like to share with him/her.
c. To communicate with the public schools to coordinate school-related goals with your plan of care.
d. To discuss your needs with a member of the Missouri General Assembly for the purpose of education related to funding for programs.
4. Sale of Protected Health Information (PHI): To communicate with others regarding your protected health information (PHI) if CCSS/CCRSI or one of its Business Associates will receive direct or indirect payment in exchange for the disclosure of your protected health information (PHI). This does not apply to public health activities for purposes related to your treatment or for payment of services provided by CCSS/CCRSI, for research purposes if the payment is costbased, for services rendered by a Business Associate if the payment is costbased, for providing you access to your protected health information (PHI), or as required by law.

You may revoke an authorization, in writing, at any time except to the extent that we have already taken action in good faith relying on the authorization. Any other uses and disclosures not specified in this Notice require an authorization. 

YOUR RIGHTS REGARDING PROTECTED HEALTH INFORMATION (PHI)
CCSS/CCRSI MAINTAINS ABOUT YOU

Your Rights And How You May Exercise These Rights.

Right to Inspect and Copy: You have the right to inspect and copy your protected health information (PHI). You may inspect and obtain a copy of protected health information (PHI) about you that is contained in a designated record set for as long as we maintain the protected health information (PHI). A “designated record set” contains medical and billing records about you that we maintain and any other records that we use for making decisions about you. You may be charged a fee for the costs of copying, mailing or other such costs associated with your request. Under federal law, however, you may not inspect or copy the following records; psychotherapy notes; information compiled in reasonable anticipation of or use in a civil, criminal, or administrative action or proceeding, and protected health information (PHI) that is subject to law that prohibits access to protected health information (PHI). If your request for access is denied, you may request that the decision be reviewed. Requests for access should be directed in writing to the CCSS/CCRSI Privacy Officer listed in this notice.
If the protected health information (PHI) that you are requesting to copy is maintained electronically, you may request an electronic copy of such information and we will provide you with access in the electronic form and format requested, if it is readily
producible in such form and format. If it is not, we will produce it in a readable electronic form and format as we mutually agree. We will act on your request within 30 days of receipt, unless it becomes necessary to request an additional 30-day extension. We will let you know the reason for the delay and the expected date of completion. If you request transmittal of an electronic copy of your protected health information (PHI) to another person, you must designate in a written document signed by you, the person to receive such information, and where to send the information. CCSS/CCRSI may charge a reasonable cost-based fee for the supplies to create a paper copy or portable electronic media, the cost of postage if you want the portable media mailed to you. There are no fees for handling and retrieval.
Right to Request a Restriction: You have the right to request a restriction of our protected health information (PHI). This means you may ask us not to use or disclose any part of your protected health information (PHI) for the purposes of treatment, payment, or healthcare operations. You may also request that any part of your protected health information (PHI) not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice of Privacy Practices. Your request must state the specific restriction requested and to whom you want the restriction to apply. We are not required to agree to a restriction that you may request, except as stated below. If we believe it is in your best interest to permit use and disclosure of your protected health information (PHI), your protected health information (PHI) will not be restricted. If we do agree to the requested restriction, we may not use or disclose your protected health information (PHI) in violation of that restriction unless it is needed to provide emergency treatment. To request a restriction, you must make your request in writing. You must tell what information you want to restrict; whether you want to limit our use, disclosure or both; and to whom you want the restrictions to apply. We will not agree to restrictions on uses or disclosures that are legally required.
If you request a restriction on the disclosure of protected health information (PHI) to a health plan, and the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law, and the information pertains solely to a health care item or service for which you or a person on your behalf paid the covered
entity out-of-pocket in full, we will restrict the disclosure of protected health information (PHI), but it is your responsibility to notify other providers with whom we may disclose your information of this restriction.
Right to Request to Receive Confidential Communications: You have the right to request to receive confidential communications from CCSS/CCRSI by alternative means or at an alternative location. Communications involving personal protected health information (PHI) may be provided to you at an alternative location or by an alternative means of communication. We will accommodate reasonable requests if you clearly state on the request that disclosure could endanger you. To request confidential communications, you must make your request in writing to the CCSS/CCRSI Privacy Officer and specify how or where you wish to be contacted.
Right to Request an Amendment: You may have the right to request an amendment to your protected health information (PHI). If you believe your personal protected health information (PHI) is incorrect or that an important part of it is missing, you may request an amendment of protected health information (PHI) about you for as long as we maintain this information. You must request the amendment in writing and specify the reason for your request. We may deny your request if the information was not created by us, it is not part of the information that you are permitted to inspect and copy, it is accurate and complete. If we deny your request, you have the right to file a statement of disagreement with us, and we may prepare a rebuttal to your statement, and we will provide you with a copy of such rebuttal. Requests should be directed to the CCSS/CCRSI Privacy Officer.
Right to Receive an Accounting of Certain Disclosures: You have the right to receive an accounting of certain disclosures we have made, if any, of your protected medical/health information. This right applies to disclosures for purposes other than treatment, payment, or healthcare operations as described in this Notice of Privacy Practices. It excludes disclosures we may have made to you, to family members or friends involved in your care, or for notification purposes. You have the right to receive specific information regarding these disclosures that occurred during the six years prior to the date of the request, or such shorter time period as you may request. The right to receive this information is subject to certain exceptions, restrictions, and limitations.
Right to Opt-Out of Receiving Communications: You have the right to opt-out of receiving communications to raise funds for CCSS/CCRSI when your protected health information (PHI) would be used for the purpose of raising funds. CCSS/CCRSI does not solicit funds from its clients and does not anticipate that it will do so. Should the agency decide to engage in fundraising, you will have the opportunity to let us know that you do not wish to receive communications for the purpose of raising funds for CCSS/CCRSI.
Right to Be Notified If There Is a Breach of Unsecured PHI: You have the right to be notified if there is a breach of unsecured protected health information (PHI) about you. We are required by law to maintain the privacy of your protected health information (PHI). If we use or disclose your unsecured protected health information (PHI) in a way that is considered to be a breach as defined by law, you will receive a notification of the breach of your unsecured protected health information (PHI) from us. Right to Obtain a Paper Copy of This Notice: You have the right to obtain a paper copy of this notice from us upon request, even if you have agreed to accept this notice electronically. You may also obtain a copy of this notice at our website http://CCSS/CCRSI.org/index.html.

If you wish to exercise any of these rights, please contact the CCSS/CCRSI Privacy Officer:
Barbara F. Oetting
1908 Boggs Creek Road
Jefferson City, MO 65101-5580
573-634-4555

YOU HAVE THE RIGHT TO FILE A COMPLAINT
The Privacy Rule, developed under authority of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), prohibits the alleged violating party from taking retaliatory action against anyone for filing a complaint with the Office of Civil Rights (OCR). You should notify OCR immediately in the event of any retaliatory action. If you have questions or would like additional information, or if you believe your privacy rights have been violated, you may contact the CCSS/CCRSI Privacy Officer,  Barbara Oetting, 1908 Boggs Creek Road, Jefferson City, MO 65101, 573-634-4555 for assistance or for further information about the complaint process. If you are receiving services available through the Department of Mental Health, you may contact and file a complaint with the Department’s Office of Constituent Services. They may do so online at http://dmh.mo.gov/constituentservices/index.htm and the toll free number is 800-364-9687. You may write to the Department of Mental Health, P.O. Box 687, Jefferson City, MO 65102. All persons also have the right to file a complaint with the Region VII Office for Civil Rights, U.S. Department of Health and Human Services. You may call them at 816-426-7277 or 816-426-7065 TDD. You may write to them at 601 East 12th Street,  Room 248, Kansas City, MO 64106. You may fax your complaint to 816-426-3686. If you need help filing a complaint or have a question about the complaint form, please call  the Office for Civil Rights (OCR) toll-free number at 800-368-1019.
It is recommended that you use the Office for Civil Rights Protected Health Information (PHI) Privacy Complaint Form.

Complaint requirements:
• Submit your complaint in any written format by mail, fax, or email;
• Name, address and phone number of the covered entity involved; and describe the acts or omissions you believe violated the requirements of the Privacy Rule; how, why and when do you believe your (or someone else’s) health information privacy rights were violated, or the Privacy Rule otherwise was violated.
• File within 180 days of when you knew that the act or omission of the complaint occurred. OCR may extend the 180-day period if you can show “good cause.” You may submit a complaint electronically with the same information requested on the Privacy Complaint Form. To do so, go to www.hhs.gov/ocr/privacyhowtofile.html This revised notice was published and became effective September 2013. We are required to abide by the terms of this Notice of Privacy Practices. We may change the terms of our notice at any time. The new notice will be effective for all protected health information (PHI) that we maintain at that time. Our revised Notice of Privacy Practices is available on our website at CCRSI.org, it is posted in our main office, and it is available at the main desk at our office at 1908 Boggs Creek Road, Jefferson City, Missouri. A paper copy may be sent to you in the mail. If special accommodations are necessary for you to communicate a question or complaint, please let us know.

Revised September 2013