St. Lawrence NYSARC has legal obligations to create, receive, use, collect, store, and share confidential or legally protected health information regarding our consumers and our employees. Since many of our records include personal details about your life, including your physical and mental condition at various times in your life, medications or other treatments prescribed for you, as well as the symptoms you might display in the course of receiving treatment or taking medication, we understand that medical information about you and your health is personal. Many of our consumers and employees prefer not to divulge or to share this kind of information with anyone who does not need to know any of these details. We are committed to protecting medical information about you. We create a record of the care and services you receive at this Agency. We need this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all of the records of your care generated by St. Lawrence NYSARC, whether made by our personnel or by your other health care providers. Your personal health care provider may have different policies or notices regarding that person's use and disclosure of your medical information created in that provider's office or clinic. This notice describes how St. Lawrence NYSARC may use and disclose your protected health information (PHI*) in order to carry out treatment, obtain payment, conduct health care operations, and for other purposes required or permitted by law. It also describes your rights to get access and to control your protected health information (PHI*).

We have implemented and maintain special procedures, consistent with state and federal legal requirements, to limit access to protected health information to only those people who need it in order to carry out or to support treatment, payment, or health care operations or to other persons or organizations who otherwise have a legal right to receive that confidential or legally protected health information. Those special procedures include a continuing education program regarding the need and methods for maintaining confidentiality of protected health information as well as physical, electronic, and administrative safeguards that comply with applicable regulatory standards to reasonably protect that information.

This notice will tell you about the ways in which we may use and disclose medical information about you. We also describe your rights and certain obligations we have regarding the use and disclosure of medical information also known as protected health information (PHI*) *PHI stands for protected health information and consists of individually identifiable (including demographic information) like your address, age, sex, and birth date relating to your health, to the health care provided to you, or to the payment for that care. This notice refers to PHI or to medical information interchangeably.

We are required by law to:

• Make sure that medical information that identifies you is kept private;
  

• Give you this notice of our legal duties and privacy practices with respect to medical information about you; and
  

• Follow the terms of the notice that is currently in effect.

This notice describes St. Lawrence NYSARC's practices and the privacy practices that the Agency requires of:

• Any health care provider authorized to enter information about you into the medical records we keep.

• Any member of a volunteer group we allow to help you while you are involved in Agency programs.

• All employees, staff, and other Agency personnel.

• Services provided in our organization through contacts with business associates. Examples include psychological assessments, physician services in an emergency department, radiology, certain laboratory tests, certain clinical treatments and evaluations. When these services are contracted, we may disclose your health information to our business associate so that the business associate can perform the job we've asked them to do and bill you or your third party payer for services rendered. To protect your health information, however, we require each of our business associates to appropriately safeguard your information from unlawful use or disclosure.

The following categories describe different ways that we use and disclose medical information without your authorization and without specifically notifying you. For each category of uses or disclosures we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information without your authorization will fall within one of the categories.

• For Treatment: We may use medical information about you to provide you with medical treatment or services. We may disclose medical information about you to doctors, nurses, technicians, medical students, or other people who are involved in providing you health care. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. In addition, the doctor may need to tell the physical therapist any restrictions on your movement so that we can arrange for appropriate therapy. Different departments of the Agency also may share medical information about you in order to coordinate the different things you need, such as programs, therapies, lab work, and clinical services. We also may disclose medical information about you to people outside the Agency who may be involved in your health care such as family members, or others providing services for your care. We may disclose a list of your medications to a doctor in order to assist that person in diagnosing or treating an infection you may have.

• For Payment: We may use and disclose medical information about you so that the treatment and services you receive from St. Lawrence NYSARC may be billed to and payment may be collected from you, an insurance company, or a third party. For example, we may need to give your health plan information about services you received at the Agency so your health plan will pay us or reimburse you for the services. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment. For example, we may need to reveal the kind and frequency of treatment we provide you in order to receive payment for it from Medicaid or other persons who are required to pay.

• For Health Care Operations: We may use and disclose medical information about you for health care operations. These uses and disclosures are necessary to run the Agency and make sure that all of our consumers and employees receive quality care. For example, we may use medical information to review our treatment and services and to evaluate the performance of our staff in caring for you as a consumer. We may also combine medical information about many Agency employees or consumers to decide what additional services that St. Lawrence NYSARC should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to doctors, nurses, technicians, medical students, and other health care personnel for review and learning purposes. We may also combine the medical information we have with medical information from other providers to compare how we are doing and see where we can make improvements in the care and services we offer. We remove information that identifies you from this set of medical information so others may use it to study health care and health care delivery without learning who the specific patients are. We may use or disclose medical information about you to make certain that we are providing you with the appropriate treatment or programs you need to have. We may also use or disclose this information to measure your progress.

• Appointment Reminders: We may use and disclose medical information to contact you as a reminder that you have an appointment for treatment, services, or medical care as a part of your individualized service plan or a wellness program. We may use this information to make sure you keep treatment appointments you have.

• Treatment Alternatives: We may use and disclose medical information to tell you about or to recommend possible treatment options or alternatives that may be of interest to you or your family.

• Health-Related Benefits and Services: We may use and disclose medical information to tell you about health-related benefits or services that may be of interest to you or to your family.

• Fundraising Activities: St. Lawrence NYSARC or its related Foundation may use certain information (name, address, telephone number, dates of service, age, siblings, and gender) to contact you or your relatives in the future to raise money for the benefit of St. Lawrence NYSARC. The money raised is used to expand and improve the programs and services we provide. If you do not wish to be contacted for fund raising efforts by St. Lawrence NYSARC, please notify the Executive Director Daphne A. Pickert in writing that you do not want to be contacted in this way. Sometimes an alternative or optional treatment or program may be beneficial to you or to your family.

• Directory: Unless you notify us that you object, we will use your name, location in facilities, general condition, and religious affiliation for directory purposes. This information may be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name. If you do not wish to be included in our directory, please notify the Compliance and Privacy Officer, Dennis Durant, in writing that you do not want to be included in our directory in this way. Sometimes new programs or services become available to new groups of people who would benefit from them.

• Individuals Involved in Your Care: We may release medical information about you to a friend or family member who is involved in your health care only if that person is appointed as your health care proxy or you give your authorization. We may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, and location.

• As Required by Law: We will disclose medical information about you when required to do so by federal, state, or local law.

To avert a Serious Threat to Health or Safety: We may use and disclose medical information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat to you.

SPECIAL SITUATIONS.

• Organ and Tissue Donation: If you are an organ donor, we may release medical information to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

• Military and Veterans: If you are a member of the Armed Forces, we may release medical information about you as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority.

If you are a member of the Armed Forces, we may disclose medical information about you to the Department of Veterans Affairs upon your separation or discharge from military services.

This disclosure is necessary for the Department of Veterans Affairs to determine if you are eligible for certain benefits. We may use and disclose to components of the Department of Veterans Affairs medical information about you to determine whether you are eligible for certain benefits.

• Workers' Compensation: We may release medical information about you for workers compensation or similar programs. These programs provide benefits for work-related injuries or illness.
  

• Public Health Risks: We may disclose medical information about you for public health activities. These activities generally include the following:

• To prevent or control disease, injury or disability;

• To report births and deaths;

• To report child abuse or neglect;

• To report reactions to medications or problems with products;

• To notify people of recalls of products they may be using;

• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.

• To notify the appropriate government authority if we believe a consumer or an employee has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure when required or authorized by law.

• Health Oversight Activities: We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes: If you are involved in a lawsuit or dispute, we may disclose medical information about you in response to a court or administrative order. We may also disclose medical information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

• Law Enforcement: We may release medical information if asked to do so by a law enforcement official:

• In response to a court order, subpoena, warrant, summons, or similar process;

• To identify or locate a suspect, fugitive, material witness, or missing person;

• About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement;

• About a death we believe may be the result of criminal conduct;

• About criminal conduct at the Agency; and

• In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description, or location of the person who committed the crime.

• Coroners, Medical Examiners, and Funeral Directors: We may release medical information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release medical information about consumers and employees to funeral directors as necessary to carry out their duties.

• National Security and Intelligence Activities: We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

• Protective Services for the President and Others: We may disclose medical information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.

• Security Clearances: We may use medical information about you to make decisions regarding your medical suitability for a security clearance or service abroad. We may also release your medical suitability determination to the officials in the Department of State who need access to that information for these purposes.

1. Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Violation of the federal law and regulations by St. Lawrence NYSARC is a crime. Suspected violations may be reported to appropriate authorities in accordance with federal regulations.

Federal law and regulations do not protect any information about a crime committed by an employee or a consumer either at the Agency's properties or against any person who works for St. Lawrence NYSARC or about any threat to commit such a crime.

Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities.

YOUR RIGHTS REGARDING MEDICAL INFORMATION ABOUT YOU. You have the following rights regarding medical information we maintain about you.

Right to Inspect and Copy. You have the right to inspect and obtain a copy of your PHI from our records including medical records and billing records if we have either of them. If we do not have records containing the PHI that you request and if we know where that information is kept, we will inform you in writing where you should direct your request for access to that PHI. We will charge you a fee for the costs of copying, mailing, labor, and supplies associated with responding to your request, and you must pay that fee before we you may receive the copies you have requested. We will provide you with legible paper copy of the records you request unless we mutually agree that some other kind of copy is acceptable. If you want to inspect or copy information from our records, you must make a written request addressed to Dennis Durant our Privacy and Compliance Officer at 6 Commerce Lane Canton, New York 13617. We will try to meet your request for access to your PHI in our records in a timely manner including arranging a convenient time and place for you to inspect the PHI that you seek. We will supervise your access to our records. In order to allow for the necessary searches required, you must give us your written request for access to inspect and copy your PHI at least 60 days before you need the information. We will inform you in writing no later than 30 days after we receive your request, that we have either accepted or rejected your request for access and how we will provide you that access. If we decide we cannot give you the access you have requested to your PHI, we will inform you in writing of the reasons for refusing your request. If we deny your request for access to make decisions about you, you must submit your request to Dennis Durant, Compliance and Privacy Officer, in writing. If you request a copy of the information, we will charge a fee for the costs of copying and providing you the information. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed. Another health care professional chosen by St. Lawrence NYSARC will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

• Right to Amend. If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for St. Lawrence NYSARC.

To request an amendment, your request must be made in writing and submitted to Dennis Durant, Compliance and Privacy Officer. In addition, you must provide a reason that supports your request to amend the records.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;

• Is not part of the medical information kept by or for St. Lawrence NYSARC;

• Is not part of the information which you would be permitted to inspect and copy.

• Right to Accounting of Disclosures. You have the right to request an "accounting of disclosures". This is a list of the disclosures we made of medical information about you. HIPAA defines disclosures as "the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information". This includes disclosures to or by business associates of the covered entity. There is a number of exclusions that do not require tracking.

Disclosures that do not require Tracking. Not all disclosures require tracking or need to be accounted for upon request by an individual. The following disclosures of PHI are excluded from an accounting of disclosures:

1. Disclosures made for treatment, payment, and healthcare operation purposes.

2. Disclosures made to the individual.

3. Disclosures made for directory purposes.

4. Disclosures made to persons involved in the individual's care.

5. Disclosures made for national security or intelligence purposes.

6. Disclosures to correctional institutions or law enforcement officials.

7. Disclosures made prior to the date of compliance with the privacy standards.

To request this list or accounting of disclosures, you must submit your request to Dennis Durant, Compliance and Privacy Officer, in writing. Your request must state a time period which may not be longer than six years and may not include dates before HIPAA effective date of April 14, 2003. Your request should indicate why you want the list (for example, on paper, electronically). We will charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

• Right to Request Restrictions. You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information about a surgery you had.

We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.

To request restrictions, you must make your request in writing to Dennis Durant, Compliance and Privacy Officer. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse or to another relative.

• Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

• To request confidential communications, you must make your request in writing to Dennis Durant, Compliance and Privacy Officer. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

• Right to a Paper Copy of this Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are entitled to a paper copy of this notice. To obtain a paper copy of this notice, contact Dennis Durant, Compliance and Privacy Officer.

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current notice at the Agency and on our website. The notice will contain on the first page its effective date. In addition, each time we change this notice, we will offer you a copy of the current notice in effect and ask that you provide us with your written acknowledgment that we have done so.

Other uses and disclosures of medical information not covered by this notice or the laws that apply to us will be made only with your written authorization. If you provide us permission to use or disclose medical information about you, you may revoke that authorization, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. You should understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we and others have provided to you.

St. Lawrence NYSARC must remain accountable to you for your PHI as described in this Notice and as required by state and federal laws. We are required to provide you with this Notice of our duties and privacy practices concerning your PHI. Our information comes from a variety of sources including families, physicians, other health care providers, insurance companies and information clearing houses, state and federal agencies, schools, or other programs or services provided by other organizations or institutions to our consumers or our employees.