Privacy Policy

INSTRUCTIONS RELATING TO THE NOTICE OF PRIVACY PRACTICES

The Notice of Privacy Practices ("Notice") is the central document ensuring a covered entity's compliance with the HIPAA regulations. The Notice details the majority of the uses and disclosures of protected health information. The covered entity shall give a copy of the Notice to every individual the covered entity admits and obtain a written acknowledgement of the same. It is to the covered entity's benefit to draft the Notice with broad categories to include all uses and disclosures HIPAA permits to be covered by the Notice. These instructions should be consulted when using the Notice or when asked about certain information contained therein.

The Notice should contain the header phrase, the effective date, and the Privacy Officer's contact information on the first page of the document.

The first page of the document should also include a comprehensive list of all affiliates and others that are covered by the Notice. For example, if the covered entity is a mental retardation facility that has split each of its individual group homes into separate subsidiaries; the Notice should include all subsidiaries. The Notice should point out that all employees and others working on behalf of the provider are also subject to the notice. However, be careful not to include organizations over which the covered entity has no control, as the covered entity will be responsible for all affiliates listed.

The Notice should include a pledge that the covered entity will take certain measures appropriate to safeguard the patient's medical record information.

In addition, the Notice should also inform the patient of the procedures for changing the Notice, where on the Internet the Notice may be located, and where patients may obtain a paper copy of the notice. Finally, the Notice informs the patient that the covered entity must obtain an authorization for all uses and disclosures it does not detail in the Notice.

Uses and Disclosures

The balance of the Notice details the different uses and disclosures of protected health information to which the patient is consenting by acknowledging receipt of the Notice and receiving treatment at the covered entity. For each category of use or disclosure, the covered entity must: (1) define and explain the scope of the use or disclosure; and (2) provide an example of that type of use or disclosure. The Provider Alliance wrote this document as broadly as possible, within the bounds of the HIPAA and all other pertinent regulations, in order to maximize the uses and disclosures permitted under the Notice and minimize the use of authorization forms.

Basic Uses and Disclosures

The first substantive section of the Notice explains the difference between uses and disclosures and points out the three basic reasons to use or disclose protected health information:

For Treatment. Covered entities are encouraged to explain and define "treatment" broadly in order to minimize unnecessary authorization forms.

For Payment. This category relates to any use or disclosure of information relating to the making, receiving, or totaling of payment for medical services. This section should be considered to encompass most interactions between a covered entity and health insurers.

For Health Care Operations. This category is the "catch-all" that may be defined and explained in a broad form in order to cover almost all aspects of the administrative, management, and operational functions of a hospital. Health Care Operations may include all actions from staff reviews to budget management.

Uses and Disclosures Specific to Provider Alliance Organizations

Several categories of uses and disclosures unique to mental health and mental retardation facilities are included in the Notice. These categories were developed through discussion between the Provider Alliance and its legal counsel. While Provider Alliance organizations may use or disclose protected health information in other ways unique to their organization, each should consult legal counsel before adding those uses and disclosures to the Notice as not all uses and disclosures are properly included in the Notice.1 However, several that are properly included in the Notice are:

• Disclosures for the purpose of complying with Health Care Quality Unit regulations as well as other mandatory quality review procedures.
• Disclosures for the purpose of facilitating a patient's acceptance into a "day program."
• Disclosures for the purpose of facilitating a patient's acceptance into a "residential facility."
• Disclosures for the purpose of facilitating a patient's application for "in home services" and/or "family living arrangements."
• Disclosures for the purpose of facilitating a patient's application for employment.
• Disclosures to assist support coordinators and to facilitate communication between a support coordinator and the covered entity.
• Disclosures for the purpose of facilitating a patient's transfer to an unrelated facility (if a patient is transferred to a related facility, the covered entity would only be "using" the information because it is staying within the covered entity and the information transfer would presumably be acceptable).

Specific Uses and Disclosures

While many of the disclosures listed below may properly be included within one of the "basic uses and disclosures" categories, the Notice becomes more comprehensive with each of the following categories included. These categories relate to recurring or special interactions with third parties that the patient may recognize and about which they may raise questions. Reference to the Notice, and the specific category contained therein, clarifies any such disputes. The specific categories include uses and disclosures for the purpose of:

• Sending appointment reminders;
• Discussing treatment alternatives (not necessarily provided by the covered entity) with the patient;
• Discussing health related benefits and services (not necessarily provided by the covered entity) with the patient;
• Fundraising;
• Creating a directory of patients at the covered entity;
• Complying with federal, state, and local law;
• Complying with health oversight agencies (which may include both government agencies and government contractors);
• Averting a serious threat to health or safety;
• Facilitating organ and tissue donation;
• Assisting coroners and medical examiners;
• Assisting national intelligence agencies in an investigation;
• Complying with a request by officials charged with protecting the President of the United States;
• Assisting a correctional institution provide an inmate that is the subject of the protected health information with medical care or protection;
• Reporting public health activity and risks (child abuse, births and deaths, etc.);
• Disclosing information to individuals involved with a patient's treatment or care; or
• Research

Special Categories

The following categories are similar to those described above in that they could be considered a subset of treatment, payment, or health care operations, but they should be specifically enumerated in the Notice. These categories require additional explanation.

Disclosures for military purposes. Both active members and veterans of the armed forces are required to submit certain health information to military command authorities. The Notice allows the covered entity to disclose information to military command authorities for that purpose.

Workers' Compensation. The HIPAA regulations specifically exempt disclosures of workers' compensation claims from coverage. Thus, a covered entity may disclose information to employers or workers' compensation carriers without fear of HIPAA liability so long as the purpose of the disclosure relates to the workers' compensation claim.

Complying with an order of court. If the patient who is subject of the protected health information is involved in a lawsuit or dispute, the covered entity reserves the right to disclose protected health information pursuant to a court order or similar demand. Provider Alliance organizations must be careful, however, to distinguish between a court order and a simple demand from an attorney such as a document request, the latter of which may require an authorization. Provider Alliance organizations should consider collecting sample subpoenas and other administrative orders from local courts so employees can differentiate between court orders and attorney requests. If possible, the Provider Alliance organization should consult legal counsel before disclosing any information.

Complying with law enforcement officials. The Notice will not cover every interaction between the covered entity and law enforcement. If the law enforcement official has a legitimate and immediate need for the information, such as locating a fugitive or investigating a death or crime at the covered entity, it may disclose the minimal amount of information necessary for the law enforcement official to achieve his purpose. However, if the law enforcement official requests information for a non-emergent reason, the patient must sign an authorization form absent a search warrant, subpoena, or other order of court.

Patient Rights

• The other major section of the Notice pertains to the patient rights HIPAA grants. HIPAA demands that a covered entity detail each patient right in the Notice and explain how the patient may exercise that right.
• Right to Inspect and Copy. Covered entities must permit their patients to inspect and copy their protected health information in most circumstances. If the patient requests the covered entity mail the information, the covered entity may charge a reasonable, cost-based fee. The covered entity must act on the request within 30 days.
• In limited circumstances, the covered entity may deny the request. If it does, the patient may request an individual, unconnected to the original request, review the denial. Reasons for denial include:
• the information is not appropriate for disclosure (i.e., psychotherapy notes and information compiled for a criminal case or civil lawsuit);
• the information is used pursuant to federal research laws;
• the information was received from a confidential source;
• the disclosure would cause a life-threatening danger;
• the file includes information about another individual who might be harmed by the disclosure; or
• a personal representative requests the information but the covered entity, in its professional opinion, does not deem the disclosure appropriate.

Right to Append and Amend. Once a patient has reviewed his or her information, he or she may determine that certain information is incorrect or incomplete. The patient may then petition the covered entity to append or amend his or her protected health information. The patient only has a right to petition for such changes, i.e., the covered entity need not accept the changes.

The patient must request the change in writing to the Privacy Officer.

Requests may be denied summarily if:

• not supported by appropriate rationale;
• the information subject of the request was not created by the covered entity;
• the information subject of the request is not in the possession of the covered entity;
• the information subject of the request is not permitted to be inspected (see above); or
• the information already contained in the medical file is accurate and complete.
• If the covered entity does not accept the changes, the patient may include a statement of disagreement in their medical file.
• If the covered entity does agree to make the changes, it must notify all other individuals with access to that patients' protected health information and those to which the covered entity disclosed the information.

Right to an Accounting of Disclosures. In passing its August 2002 amendments to the HIPAA regulations, the Department of Health and Human Services limited the disclosures for which the covered entity must provide an accounting. However, the patient's right to an accounting of disclosures remains.

The patient may request an accounting of disclosures for a period of not more than six years and not pre-dating April 14, 2003.

The covered entity must comply with the request within 60 days.

The covered entity is required to provide an electronic or paper accounting for free every twelve (12) months. The covered entity may charge for any additional lists.

However, the covered entity need not create an account of disclosures made for the following purposes:

• treatment, payment or health care operations;
• to the individual;
• for a facility directory;
• for national security; or
• to a correctional institution.

Right to Request Restrictions. Much like the right to request amendments to the medical file, a patient may request a restriction on what information is disclosed and/or to whom it is disclosed. The covered entity need not agree with the restriction, but if it does, it must inform all entities and individuals to whom it gave the patient's protected health information of the restriction and ensure that they comply with the restriction on a moving forward basis.

The request for the restriction must be made in writing to the Privacy Officer and describe what information should be restricted, whether the patient is requesting a restriction on uses, disclosures, or both, and to whom the patient wants the limits to apply.

Right to Request Confidential Communications. The patient may limit the modes in which the covered entity communicates with the patient (i.e., no calls to work, no faxes, etc.).

Right to a paper copy of the notice.

Right to file a Complaint. The patient has a right to file a complaint with both the covered entity and the Office of Civil Rights. Procedures for filing a complaint with the covered entity should be included in the Notice. In addition, the Notice should note that the patient will not be penalized for filing a complaint.

HIPAA NOTICE OF PRIVACY PRACTICES AT Home & Community Services, Inc.

Effective Date: April 14, 2003
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
If you have any questions about this notice, please contact Home & Community Services's Privacy Officer, Kimberly McBane, at (724) 229-0851.

WHO WILL FOLLOW THIS NOTICE.

This notice describes the privacy practices of Home & Community Services and all of its Affiliates and other persons listed below (together, "Provider" or "we"). There are no "Affiliates" associated with Home & Community Services.

Any health care professional authorized to enter information into your medical chart.

All departments and units of the organization and its affiliates.

Any member of a volunteer group we allow to help you while you are receiving care from Home & Community Services.

All employees, staff, Board Members and other Home & Community Services personnel.

All of these persons and entities follow the terms of this notice and may share protected health information with each other for treatment, payment or provider operations purposes as described in this notice.

OUR PLEDGE REGARDING PROTECTED HEALTH INFORMATION:

We understand that protected health information about you and your health is personal. We are committed to protecting your protected health information. In order to provide you with quality care and to comply with legal requirements, we create a record of the care and services you receive from Home & Community Services. This notice applies to all of the records of your care maintained by Home & Community Services. Your other health care providers, such as your personal doctor, may have different policies or notices regarding the use and disclosure of your protected health information created and maintained in the doctor's own office or clinic.

This notice provides the ways in which Home & Community Services may use and disclose your protected health information. It also describes your rights and certain of Home & Community Services's obligations regarding use and disclosure of your protected health information.

Home & Community Services is required by law to:

• safeguard your protected health information;
• give you this notice of our legal duties and privacy practices with respect to your protected health information;
• follow the terms of this notice as currently in effect; and
• notify you of any changes to this notice.

HOW WE MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION ABOUT YOU.

The following categories describe different ways that we "use" and "disclose" your protected health information. Each category is followed by an explanation and in some instances an example. For purposes of this notice, the term "use" refers to protected health information that is used within Home & Community Services for your treatment, Home & Community Services's operations, or the payment of your care. The term "disclose" refers to protected health information that is given to outside entities for one of the purposes described in this notice. Whether your protected health information is used or disclosed, the use or disclosure will fall within one of the categories listed below and will be used or disclosed only in the minimal amount necessary to carry out the purpose. The term "may" means that Home & Community is permitted under federal law to use or disclose this information without obtaining an additional or specific authorization from you to do so. Even though Home & Community Services may be permitted to use or disclose information in a given instance, it does not mean that we will use or disclose the information. We will still try to assure that any use or disclosure is in your interest or is consistent with practices in the health care field.

For Treatment. We may use and disclose protected health information about you to provide you with medical treatment or services. We may disclose protected health information about you to doctors, nurses, technicians, medical students, and Home & Community Services personnel who are involved in taking care of you at Home & Community Services. For example, a doctor treating you for an injury may need to know if you have diabetes because diabetes may slow the healing process. In addition, Home & Community Services may need to tell the dietician if you have diabetes so that the dietician can arrange for appropriate meals. Different departments of Home & Community Services also may share protected health information about you in order to coordinate the different things you need. We also may disclose protected health information about you to people outside Home & Community Services who may be involved in your medical care when you are absent from Home & Community Services, such as family members, clergy, providers of day services, volunteers, Independent Support Coordinators, case managers, respite care workers and others we have engaged to provide services that are part of your care.

For Payment. We may use and disclose protected health information about you so that the treatment and services you receive from Home & Community Services or other providers may be billed to and payment may be collected from you, the government, an insurance company or a third party. For example, we may disclose information to the county or state mental health and/or mental retardation agency in order to receive payments for your treatment. We may also tell your insurer or governmental payor about a treatment you are going to receive to obtain prior approval or to determine whether your plan or the government will cover the cost of the treatment.

For Health Care Operations. We may use and disclose protected health information about you for Home & Community Services operations or operations of another provider or payor. These uses and disclosures are necessary to run Home & Community Services and make sure that all of our clients receive quality care. For example, we may use protected health information to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also combine protected health information about many Home & Community Services clients to decide what additional services Home & Community Services should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to doctors, nurses, technicians, medical students, direct care providers, behavioral therapists, special therapists, and other Provider personnel for review and learning purposes. We may also disclose information in order to comply with our incident reporting requirements under state, local, or federal law. We may also combine the protected health information we have with protected health information from other providers to compare how we are doing and see where we can make improvements in the care and services we offer. We may remove information that identifies you from this set of protected health information so others may use it to study health care and health care delivery without learning who the specific clients are.

Health Care Quality Units and Other Quality Review Organizations. We may disclose information to the Pennsylvania Department of Public Welfare, the Office of Mental Retardation, and other state and county mental health and mental retardation agencies through their appointed agents, including Health Care Quality Units and independent monitoring groups, in order to comply with Federal, state, and local laws and regulations.

Appointment Reminders. We may use and disclose protected health information to contact you as a reminder that you have an appointment for treatment or medical care at Home & Community Services.

Treatment Alternatives. We may use and disclose protected health information to tell you about or recommend possible treatment options or alternatives that may be of interest to you.

Health-Related Benefits and Services. We may use and disclose protected health information to tell you about health-related benefits or services that may be of interest to you. Fundraising Activities. We may use contact information, such as your name, address and phone number, and the dates you received treatment or services from Home & Community Services to contact you and your family members in an effort to raise money for Home & Community Services. We may disclose this contact information to a foundation related to Home & Community Services so that the foundation may contact you and your family members in raising money for Home & Community Services. If you do not want Home & Community Services or the foundation to contact you or your family members for fundraising efforts, you must notify the Privacy Officer in writing.

Provider Directory. We may include certain limited information about you in the Provider directory while you are a client of Home & Community Services. This information may include your name, location at Home & Community Services, your general condition, and your religious affiliation. The directory information, except for your religious affiliation, may also be released to people who ask for you by name. Your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they do not ask for you by name. This is so your family, friends and clergy can visit you at Home & Community Services and generally know how you are doing.

Individuals Involved in Your Care or Payment for Your Care. We may disclose protected health information about you to your family members, your personal friends or any other person identified by you, but we will only disclose information that we feel is relevant to that person's involvement in your care or the payment for your care. If you are feeling well enough to make decisions about your care, we will follow your directions as to who is sufficiently involved in your care to receive information. If you are not present or cannot make these decisions, we will make a decision based on whether we believe it is in your best interest for a family member or friend to receive private health information and how much information they should receive. Obviously, we are inclined to provide greater information to close family members than to friends.

We may also disclose information to disaster relief agencies or to family, friends or others in an effort to locate or identify family members or personal representatives. Research. Under certain circumstances, we may use and disclose protected health information about you for research purposes. For example, a research project may involve comparing the progress of all clients who received one therapy to those who received another, for the same condition. All research projects, however, are subject to a special approval process. This process evaluates a proposed research project and its use of protected health information, trying to balance the research needs with clients' need for privacy of their protected health information. Before we use or disclose protected health information for research, the project will have been approved through this research approval process, but we may, however, disclose protected health information about you to people preparing to conduct a research project, for example, to help them look for clients with specific medical needs, so long as the protected health information they review does not leave Home & Community Services. In certain situations, we are required to ask your specific permission, such as when the researcher will have access to your name, address or other information that reveals who you are, or will be involved in your care at Home & Community Services.

As Required By Law. We will disclose protected health information about you when required to do so by federal, state or local law. For instance, Home & Community Services is obligated to report to public health officials the occurrence of certain communicable diseases, or acts of violence. Additionally, Home & Community Services is required to report certain incidents to the Pennsylvania Department of Public Welfare.

To Avert a Serious Threat to Health or Safety. We may use and disclose protected health information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat. Day Providers. We may use and disclose information about you if necessary to facilitate your application for admission to, or use of, day programs such as supported employment and sheltered employment.

Residential Facilities. We may use and disclose information about you if necessary to facilitate your application for admission into, or use of, residential facilities. In-home Services. We may use and disclose information about you if necessary to facilitate your application for, or use of, in-home services.

Family Living Arrangements. We may use and disclose information about you if necessary to facilitate your application for admission into, or use of, family-living arrangements.

Supports Coordinators. We may use and disclose information about you as necessary for supports coordinators and case managers to complete their duties for you.

Transfers. We may use and disclose information about you to another Provider to which you are being transferred or which is considering you as a transfer.

Employers. We may use and disclose information about you to an employer or prospective employer in connection with your application for, or continuation of, employment.

SPECIAL SITUATIONS

Organ and Tissue Donation. If you are an organ or tissue donor, we may release protected health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Military and Veterans. If you are a member of the armed forces, we may release protected health information about you as required by military command authorities. We may also release protected health information about foreign military personnel to the appropriate foreign military authority.

Workers' Compensation. We may release protected health information about you for workers' compensation or similar programs. These programs provide benefits for work-related injuries or illness. Under the privacy regulations, workers' compensation claims are exempted from coverage, and thus we may release protected health information about you to your employer for workers' compensation purposes.

Public Health Risks. We may disclose protected health information about you for public health activities. These activities generally include the following:

• to prevent or control disease, injury or disability;
• to report births and deaths;
• to report child abuse or neglect;
• to report reactions to medications or problems with products;
• to notify people of recalls of products they may be using;
• to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
• to notify the appropriate government authority if we believe a client has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.

Health Oversight Activities. We may disclose protected health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. The federal government has determined that it must have access to this information to adequately monitor beneficiary eligibility for government programs (for example, Medicare or Medicaid), compliance with program standards, and/or civil rights laws.

Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose protected health information about you in response to a court or administrative order. We may also disclose protected health information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if appropriate efforts have been made to tell you about the request or to obtain an order protecting the information requested.

Law Enforcement. We may release protected health information if asked to do so by a law enforcement official:

• In response to a court order, subpoena, warrant, summons or similar process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement;
• About a death we believe may be the result of criminal conduct;
• About criminal conduct at Home & Community Services; and
• In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime. Coroners, Medical Examiners and Funeral Directors. We may release protected health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release protected health information about clients of Home & Community Services to funeral directors as necessary to allow them to carry out their duties.

National Security and Intelligence Activities. We may release protected health information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Protective Services for the President and Others. We may disclose protected health information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.

Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release protected health information about you to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

YOUR RIGHTS REGARDING MEDICAL INFORMATION ABOUT YOU.

You have the following rights regarding protected health information we maintain about you:

Right to Inspect and Copy. You have the right to inspect and copy protected health information that may be used to make decisions about your care. Usually, this includes medical and billing records, but does not include psychotherapy notes.

To inspect and copy protected health information that may be used to make decisions about you, you must submit your request in writing to the Privacy Officer. If you request a copy of the information, we customarily charge a fee for the costs of copying, mailing or other supplies associated with your request.

We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to protected health information, you may request that the denial be reviewed. Another licensed health care professional chosen by Home & Community Services will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

Right to Append and Amend. If you feel that protected health information we have about you is incorrect or incomplete, you may ask us to append or amend the information. You have the right to request an amendment for as long as the information is kept by or for Home & Community Services. If we do not agree to amend your information, you may add a supplemental statement to your records indicating why you believe the information should be changed. We will append or otherwise link your statement to your records.

To request an amendment, your request must be made in writing and submitted to the Privacy Officer. In addition, you must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;

Is not part of the protected health information kept by or for Home & Community Services;

Is not part of the information which you would be permitted to inspect and copy; or

Is accurate and complete.

Right to an Accounting of Disclosures. You have the right to request an "accounting of disclosures." This is a list of several types of the disclosures we made of protected health information about you.

To request this list or accounting of disclosures, you must submit your request in writing to the Privacy Officer. Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2003. Your request should indicate in what form you want the list (for example, on paper, electronically). The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limitation on the protected health information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the protected health information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information about a surgery you had.

We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.

To request restrictions, you must make your request in writing to the Privacy Officer. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing to the Privacy Officer. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice.

You may obtain a copy of this notice at our website, www.homeandcommunityservices.org

To obtain a paper copy of this notice, please write or call the Privacy Officer.

CHANGES TO THIS NOTICE

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for protected health information we already have about you as well as any information we receive in the future. We will post a copy of the current notice at our site. The notice will contain on the first page, in the top right-hand corner, the effective date. In addition, each time you register at or are admitted to Home & Community Services for treatment or health care services as an client, we will offer you a copy of the current notice in effect.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with Home & Community Services or with the Secretary of the Department of Health and Human Services. To file a complaint with Home & Community Services, contact our Compliancy Officer, Pam Jones at (724) 225-8145. All complaints must be submitted in writing. You will not be penalized for filing a complaint.

OTHER USES OF PROTECTED HEALTH INFORMATION.

Other uses and disclosures of protected health information not covered by this notice or the laws that apply to us will be made only with your written authorization. If you provide us permission to use or disclose protected health information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose protected health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.