Notice of Privacy Practices
Effective: April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice will tell you how we may use (i.e. within KETCH) and disclose (i.e. outside of KETCH) protected health information about you. To make this easier to understand, we will use the term “sharing” to mean the same as “use and disclose”. Protected health information means any health information about you that identifies you or for which we think the information can be used to identify you. In the big, black print above, that information is referred to as “medical information.” In this notice, we simply call all of that protected health information, “health information.”

This notice will also tell you about your rights and our duties to protect your health information. This notice will also tell you how to complain to us if you believe we have violated your privacy rights.

How We May Share Health Information About You

We share health information about you for a number of different purposes. Each of those purposes is described below.

• For Treatment.
  We may share health information about you to provide, coordinate or manage the services, supports, and health care you receive from us and other providers. We may share health information about you to doctors, nurses, Targeted Case Managers, psychologists, social workers, direct support staff and other agency staff, volunteers and other persons who are involved in supporting you or providing care. We may consult with other service providers concerning you and, as part of the consultation, share your health information with them. For example, staff may discuss your information to develop and carry out your person centered plan; the Behavior Management Committee may review and approve behavior supports plans, behavior contracts, and psychotropic medication plans. Staff may share information to coordinate needed services, such as medical tests, transportation to a doctor’s visit, physical therapy, etc. Staff may need to share health information to groups outside of KETCH (for example, another provider or a state/local agency, such as Social and Rehabilitation Services - SRS or COMCARE) to get new services for you.
  
• For Payment.
  We may share health information about you so we can be paid for the services we provide to you. This can include billing a third party payor, such as Medicaid, COMCARE or other state agency (such as SRS), or your insurance company. For example, we may need to give information to the state Medicaid program to make sure you are eligible for the medical assistance program and also give them information about the services we provide to you so we will be paid for those services.
  
• For Health Care Operations.
  We may share health information about you for our own operations. This is necessary for us to operate KETCH and to maintain quality for persons served. For example, we may use health information about you to review the services we provide and to determine how good of a job our staff are doing in supporting you. We may share health information about you to train our staff and volunteers. We also may use the information to study ways to better manage our organization, or for accreditation (such as for the Commission on Accreditation of Rehabilitation Facilities - CARF) or licensing (SRS) activities.
  
• How We Will Contact You.
  Unless you tell us differently in writing, we may contact you by either telephone or by mail at either your home or your workplace. At either location, we may leave messages for you on the answering machine or voice mail. If you want us to contact you in a certain way or at a certain location, see “Right to Receive Confidential Communications” on page 5 of this Notice.
  
  • Appointment Reminders.
    We may share health information about you in order to contact you and remind you of an appointment for treatment or services. Postcards may be sent to you in the mail to remind you of appointment times.
    
  • Treatment and Service Alternatives.
    We may share health information about you to contact you about treatment and service options that may be of interest to you.
    
  • Health Related Benefits and Services.
    We may share health information about you to contact you about health-related benefits and services that may be of interest to you.
    
• Marketing Communications.
  We may share health information about you to contact you about a product or service to encourage you to purchase the product or service. This may be:
  
  • To describe a health-related product or service that is provided by KETCH
  • For your treatment
  • For case management or care coordination for you
  • To suggest different treatments, therapies, health care providers, or settings of care

  We may communicate face-to-face with you about products and services.
  All other sharing of health information about you by us to communicate about a product or service to encourage the purchase or use of a product or service will be done only with your written authorization. There is a form to be filled out for this purpose. It is called, “Authorization” Form #860.

• Fundraising.
  We may share health information about you to raise funds for KETCH. We will only release demographic information, such as your name and address, and the dates you received services from KETCH. If you do not want KETCH to contact you for fundraising, you must notify the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700 in writing.
  
• Disclosures to Family and Others.
  We may share health information with a parent/guardian, personal representative, family member, or any other person identified by you, but only information that is important to that person’s involvement with the services and supports you receive or payment for those services and supports. We also may share health information about you to notify those same persons of your location, general condition, or death. If there is anyone that you do not want us to share health information with about you to, please notify the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700 or tell our staff member who is providing services to you. There is a form to fill out for this purpose. It is called, “Request for Restrictions on Uses and Disclosures for Treatment, Payment and Health Care Operations” Form #861.
  
• Disaster Relief.
  We may share health information about you to a group authorized by law or by its charter to assist in disaster relief efforts. This will be done to coordinate with those groups in notifying a parent/guardian, personal representative, family member, or any other person identified by you of your location, general condition or death.
  
• Required by Law.
  We may share health information about you when we are required to do so by law.
  
• Public Health Activities.
  We may share health information about you for public health activities and purposes. This includes reporting health information to a public health authority that is authorized by law to gather information to help prevent or control diseases. It also includes reporting for purposes of activities related to the quality, safety or effectiveness of a United States Food and Drug administration regulated product or activity.
  
• Victims of Abuse, Neglect or Exploitation.
  We may share health information about you to a public health or government authority (such as SRS) authorized by law to receive reports of abuse, neglect, or exploitation, if we believe you are a victim of abuse, neglect, or exploitation. We will follow the rules of the law in sharing information in these cases.
  
• Health Oversight Activities.
  We may share health information about you to a health oversight agency (such as COMCARE or SRS) for activities authorized by law, including audits, investigations, inspections, or licensure. These types of activities are necessary to make sure that the health care system, government benefit programs, and other services which have to follow government regulations are working properly.
  
• Judicial and Administrative Proceedings.
  We may share health information about you in the course of any judicial or administrative proceeding if the court requires us to do so. We may also share health information about you in response to a subpoena, discovery request, or other legal process but only if efforts have been made to tell you about the request or to get an order protecting the information to be shared.
  
• Disclosures for Law Enforcement Purposes.
  We may disclose health information about you to a law enforcement official for law enforcement purposes:
  
  1. As required by law.
  2. In response to a court, grand jury or administrative order, warrant or subpoena.
  3. To identify or locate a suspect, fugitive, material witness or missing person.
  4. About an actual or suspected victim of a crime and the victim agrees to the disclosure. If we are unable to get that person’s agreement, in limited circumstances, the information may still be shared.
  5. To notify law enforcement officials of a death if we suspect the death may have resulted from criminal conduct.
  6. About crimes that occur at KETCH.
  7. To report a crime in emergency circumstances.
     
• Coroners and Medical Examiners.
  We may share health information about you with a coroner or medical examiner for purposes such as identifying you if you die and determining the cause of your death.
  
• Funeral Directors.
  We may share health information about you with funeral directors as necessary for them to carry out their duties.
  
• Organ, Eye or Tissue Donation.
  To help with organ, eye or tissue donation and transplantation, we may share health information about you with organ procurement organizations or other groups who work in the procurement, banking or transplantation of organs, eyes or tissue.
  
• Research.
  Under certain circumstances, we may share health information about you for research. Before we share health information for research, the research will have been approved through an approval process. We may, however, share health information about you to a researcher to allow them to prepare for the project, but no health information will leave KETCH during the period of time that person is reviewing the information.
  
• To Avert Serious Threat to Health or Safety.
  We may share protected health information about you if we believe doing so is necessary to prevent or lessen a serious threat to the health or safety of a person or the public. We also may release information about you if we believe it is necessary for law enforcement authorities to identify or capture an individual who admitted being involved in a violent crime or who is an escapee from a correctional institution or from lawful custody.
  
• National Security and Intelligence.
  We may share health information about you with authorized federal officials for the conduct of intelligence, counter-intelligence, and other national security activities authorized by law.
  
• Protective Services for the President.
  We may share health information about you with authorized federal officials so they can provide protection to the President of the United States, certain other federal officials, or foreign heads of state.
  
• Inmates; Persons in Custody.
  We may share health information about you with a correctional institution or law enforcement official having custody of you. This will be done if necessary: (a) to provide health care to you; (b) for the health and safety of others; or, (c) the safety, security and good order of the correctional institution.
  
• Workers Compensation.
  We may share health information about you as necessary to follow workers’ compensation and similar laws that provide benefits for work-related injuries or illness.
  
• Other Uses and Disclosures.
  Other instances of sharing information will be done only with your written authorization. There is a form for this purpose. It is called, “Authorization” Form #860. You may change your mind about such an authorization (and not want your health information to be shared) at any time by notifying the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700 in writing of your desire. However, if you change your mind about such an authorization, it will not have any affect on information shared by KETCH before you changed your mind.

Your Rights With Respect to Health Information About You.

You have the following rights about health information that we keep about you.

• Right to Request Restrictions.
  You have the right to ask for certain restrictions (or limits) about how we use or share health information about you to carry out treatment, payment, or health care operations. You also have the right to ask for certain limits about sharing information with: (a) a parent (if they are not your legal guardian); (b) a family member, or any other person identified by you; or, (c) public or private entities for disaster relief efforts. For example, you could ask that we not share health information about you to your brother or sister.

  To make such a request, you may do so at any time by contacting the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700 and by telling us: (a) what information you want to limit, and (b) to whom you want the limits to apply (for example, disclosures to your brother or sister). There is a form to be filled out for this purpose. It is called the “Request for Restrictions on Uses and Disclosures for Treatment, Payment and Health Care Operations” Form #861.

  We are not required to agree to any limits that you ask for. However, if we do agree, we will follow that limit unless the information is needed to provide emergency treatment. Even if we agree to the limits you’ve asked for, either you or we can later change our minds about following the limit. There is a form to be filled out for this purpose. It is called the “Request to Terminate Restrictions on Uses and Disclosures for Treatment, Payment and Health Care Operations” Form #862.

• Right to Receive Confidential Communications.
  You have the right to ask that we communicate health information to you in a certain way or at a certain location. For example, you can ask that we only contact you by mail or at work. We will not require you to tell us why you are asking for the confidential communication.

  If you want to ask for confidential communication, you must do so in writing to the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700. Your request must state how or where you can be contacted. There is a form to be filled out for this purpose. It is called the “Request for Alternative Means of Communication of Protected Health Information” Form #863.

  We will accommodate your request. However, we may ask for information from you about how you will pay for any additional costs KETCH might have in order to meet your request. We may also ask for some other way to communicate with you.

• Right to Access and Copy.
  With very few exceptions, you have the right to access (look at) and get a copy of health information about you.

  To look at or copy health information about you, you must turn in your request in writing to the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700. Your request should state specifically what health information you want to inspect or copy. There is a form to be filled out for this purpose. It is called the “Request for Access to Protected Health Information” Form #864. If you ask for a copy of the information, we may charge a fee for the costs of copying and, if you ask that it be mailed to you, the cost of mailing.

  After we receive your request in writing, we will make a decision within thirty (30) calendar days. We will let you know what our decision is. If we agree with your request, then we will give you the chance to look at the information and get copies.

  We may not agree to your request to look at and copy health information if the information was gathered in anticipation of, or use in, a civil, criminal or administrative action or proceeding;

  If we don’t agree with your request, we will let you know the reason for the denial, how you may have our disagreement reviewed, and how you may complain. There is a form to fill out for this purpose. It is called, “Documentation of Complaint Against KETCH Regarding HIPAA Privacy Regulations and Policies” Form #867. If you ask for a review of our disagreement, it will be done by a licensed health care professional chosen by us who was not directly involved in the denial. We will go along with the decision made by the license health care professional.

• Right to Amend.
  You have the right to ask us to amend (or change) health information about you. You have this right as long as the health information is maintained by us.

  To ask for information to be changed, you must put this in writing to the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700. It must state what information you want to change and give a reason to explain why the information should be changed. There is a form to complete for this purpose. It is called “Request for Amendment to Protected Health Information” Form #865.

  After we have received your request in writing, we will make our decision within sixty (60) calendar days. We will let you know what our decision is. If we agree with your request, then we will make the changes you asked for. We will also ask you to let us know the names of other people who need to be told about the changes to the information. We will also let others, who have a need to know, of the changes.

  We may not agree with your request, possibly because it wasn’t in writing, or didn’t give reasons why the information should be changed. Other reasons we may not agree with your request could be because the information:

1. Was not created by us, unless the person or group that created the information is no longer available to change the information
2. Is not part of the health information maintained by us
3. Would not be available for you to inspect or copy; or,
4. Is accurate and complete.

If we don’t agree with your request, we will let you know the reason why. You will have the right to give us a statement disagreeing with our denial. Your statement may not be more than 1 page. We may prepare a response to that statement. Your request for changing information, our denial of the request, your statement of disagreement, if any, and our response, if any, will then be attached to the health information involved. All of that will then be included with any future sharing of the information, or, we may decide to use a summary of any of that information.

You also will have the right to complain about our denial of your request. There is a form to fill out for this purpose. It is called, “Documentation of Complaint Against KETCH Regarding HIPAA Privacy Regulations and Policies” Form #867.

1. Right to an Accounting of Disclosures.
   You have the right to receive an accounting (or listing) of information we share about you up to 6 years prior to the date you ask for it, but not before April 14, 2003.

   You will not be able to get a listing of the following times we share information:

   1. To carry out treatment, payment and health care operations
   2. About you with you
   3. That is part of another time information was shared
   4. That you have authorized
   5. For disaster relief purposes
   6. For national security or intelligence purposes
   7. With correctional institutions or law enforcement officials
   8. That is part of a limited data set for purposes of research, public health, or health care operations (a limited data set is where things that would directly identify you have been removed)
   9. That happened prior to April 14, 2003

In some situations, a listing of times when your health information was shared by KETCH to a law enforcement official or a health oversight agency may not be reported to you.

To request a listing of times when health information was shared about you, put this in writing to the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700. Your request must state a time period for the disclosures. It may not be longer than six (6) years from the date we receive your request and may not include dates before April 14, 2003. There is a form to be filled out for this purpose. It is called, “Request for Accounting of Disclosures” Form #866.

After we receive your request in writing, we will take action within sixty (60) calendar days. We will either give you the list of times when your health information was shared or give you a written statement of when we will give you the list and the reason for the delay.

There is no charge for the first listing we provide to you in any twelve (12) month period. For more listings, we may charge you for the cost of providing the list. If there will be a charge, we will let you know the cost involved and give you a chance to change your mind about your request.

• Right to Copy of this Notice.
  You have the right to get a copy of this Notice of Privacy Practices. You can print this web page and/or you may ask for a paper copy. This can be done at any time by contacting the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700.

Our Duties

• Generally.
  We are required by law to keep your health information private and to explain KETCH’s legal duties and practices that will be followed to make sure your information is protected and kept confidential.

  We are required to follow the rules in our Notice of Privacy Practices in effect at the time.

• Our Right to Change Notice of Privacy Practices.
  We reserve the right to change this Notice of Privacy Practices. We reserve the right to make the new notice’s provisions effective for all health information that we keep, including that which was created or received by us prior to the effective date of the new notice. If major changes are made to the practices listed in this Notice, we will provide you with a new Notice of Privacy Practices.
  
• Availability of Notice of Privacy Practices.
  A copy of our current Notice of Privacy Practices will be posted in the reception areas of KETCH buildings at the following Wichita addresses: 1006 E. Waterman, 201 S. Ida, 210 S. Ida, and 233 S. Laura. A copy of the current notice will also be posted on our web site, www.ketch.org.
  
• Complaints.
  You may complain to us and to the United States Secretary of Health and Human Services if you believe your privacy rights have been violated by us.

  To file a complaint with us, contact the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700. All complaints should be submitted in writing. There is a form to fill out for this purpose. It is called, “Documentation of Complaint Against KETCH Regarding HIPAA Privacy Regulations and Policies” Form #867.

  To file a complaint with the United States Secretary of Health and Human Services, send your complaint to him or her in care of: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201. No one will get mad or be upset with you for filing a complaint. That is your right.

• Questions and Information.
  If you have any questions or want more information concerning this Notice of Privacy Practices, please contact the KETCH Privacy Officer, 1006 E. Waterman Wichita, KS 67211 (316) 383-8700.