Notice of Privacy Practices
This notice describes how medical information about you may be and disclosed and how you can get access to this information. Please review it carefully.
Your health information is private and should remain private. At Kennedy Donovan Center (KDC), we pledge to uphold the privacy of your protected health information, known as “PHI.” Federal laws such as the Health Insurance Portability and Accountability Act (HIPAA) and related state laws govern how we handle your PHI. This notice describes how we maintain our commitment to keeping your information private.
How We Use or Disclose Your PHI
During the course of services at KDC, we may use or disclose your PHI. We will only do so without your authorization when permitted or required under federal or state law. In all other circumstances, we will obtain your written authorization before we use or disclose your protected information. If you change your mind, you may revoke your authorization at any time. HIPAA allows us to use or disclose your PHI without your authorization for several purposes. The most common are as follows:
- TREATMENT – To provide or coordinate direct services and supports to you, our staff involved in your care may need to use or disclose your PHI. For example, a clinical staff member may use your information assist in developing or implementing a treatment plan. Or, we may disclose information to your primary care physician in assisting with treatment of a health condition.
- PAYMENT – We may use or disclose your PHI to as part of obtaining payment for the services we provide to you. This might mean we would disclose information to an insurance company in receiving authorization for services or to a funding agency in seeking payment for a bill.
- HEALTH CARE OPERATIONS – To perform some administrative activities and as part of our continuing efforts to improve the quality of the services that we provide, we may use or disclose your information for the operations of our programs. This might include our Quality Improvement staff reviewing your PHI during internal reviews of the services we provide or when providing training to our staff.
In addition to the above, we are permitted to and sometimes required by federal or state laws and regulations to use or disclose your PHI. Purposes which we are permitted or required to use or disclose your PHI without your authorization include:
- Sharing PHI with you, your personal representative, or family and close personal friends involved in your care, as long as you do not express your objection.
- In an emergency when you or your personal representative are not able to express your wishes.
- When required by law or in judicial or administrative proceedings as in response to a court order or valid subpoena.
- For public health activities, such as reporting a communicable disease or reporting an adverse drug reaction as required by the Food and Drug Administration.
- To report suspected abuse, neglect, or domestic violence as required by law.
- To government regulators, licensing agencies, or other agents authorized to determine KDC’s compliance with applicable rules and regulations.
- When properly requested by law enforcement officials such as in identifying a suspect, fugitive, material witness, or missing person or when reporting a crime on our premises.
- To a medical examiner for purposes of identifying a deceased person or determining the cause of death, or to a funeral director for making funeral arrangements.
- In connection with certain types of organ donor programs.
- For purposes of research when an oversight committee, called an institutional review board, has determined that there is minimal risk to the privacy of your PHI.
- For creating special types of health information that eliminate all legally required identifying information or information that would directly identify the subject of the information.
- If we reasonably believe that use or disclosure will avert a health hazard or to respond to a threat to public safety including a crime against another person.
- For national security purposes or if you are a member of the Armed Forces and it is deemed necessary by military command authorities.
- In accordance with the legal requirements of the Workers’ Compensation program.
- Using limited PHI as part of KDC’s fundraising efforts and communications.
In many cases, we may use or disclose your PHI, as summarized above, for treatment, payment, or health care operations or as required or permitted by law. In all other cases, we must ask for your written authorization with specific instructions and limits on our use or disclosure of your PHI. This includes, for example, uses or disclosures of psychotherapy notes, uses or disclosures for marketing purposes, or for any disclosure which is a sale of your PHI. You have the right to revoke your authorization if you change your mind later.
Your Privacy Rights and How to Exercise Them
- RIGHT TO REQUEST RESTRICTIONS ON THE USE OR DISCLOSURE OF YOUR PHI – You may request that we do not use or disclose your PHI in certain ways. Generally, we will honor your request if it is reasonable and permitted by law, however there may be times where we cannot honor your request. You must submit your request in writing and we will provide a written response within 30 days. If we do agree to your request, the restrictions may not apply in the event of an emergency. We also have the right to end the restriction if you agree verbally or in writing, or if we inform you of the termination, which will only apply to PHI created or received after the termination. We are required to honor requests to restrict disclosures to your health plan (insurer) if:
- The disclosure is for the purpose of carrying out payment or health care operations and is not required by law; and
- The PHI is only related to a health care item or service that you or someone other than your health plan paid us for in full.
- RIGHT TO RECEIVE CONFIDENTIAL COMMUNICATIONS – You may request that we communicate with you in a certain way or at a certain location. Your request and any change to your request must be in writing. We will make all reasonable efforts to honor your requests.
- RIGHT TO INSPECT AND COPY YOUR PHI – You may access and copy your PHI contained in your record, including treatment and billing records. Your request must be made in writing. We will act on the request within 30 days. A reasonable fee may be charged for related costs. Your request may be denied in some circumstances, such as if we have believed that access would endanger your health or safety or cause substantial harm to another person. If your request is denied, in most cases you will have an opportunity to request a review of the decision.
- RIGHT TO CORRECT OR AMEND YOUR PHI – If you believe your information is incomplete or incorrect, you have the right to request that we change it. Requests must be submitted in writing and must include the reason for your request. We will respond to your request within 30 days and will notify you either that a change to the record has been made or the reasons we are unable to make the change and how to appeal this decision. If denied, you have the right to file a statement of disagreement with the decision. We will provide a rebuttal to your statement and maintain appropriate records of all statements.
- RIGHT TO AN ACCOUNTING OF DISCLOSURES OF YOUR PHI – You have the right to request an accounting of disclosures of your PHI. This does not include disclosures: made to carry out treatment, payment, or health care operations; made directly to you; made incidentally; made with your authorization; made to individuals involved in your care; made for notification purposes permitted or required by law; and certain other disclosures. Requests must be submitted in writing and must specify the time period, not to exceed 6 years. We will respond within 60 days except that a 30-day extension may be necessary if your request for an accounting exceeds a 12-month period. You have the right to an accounting during any 12-month period at no cost. KDC may charge a reasonable fee for each additional request during a 12-month period.
- RIGHT TO RECEIVE A COPY OF THIS NOTICE – You have a right to receive a copy of this document at any time you request it, including a paper copy. An electronic copy of this notice is available on the KDC website (kdc.org). Copies of this notice will also be posted and available at all KDC administrative and program locations.
- RIGHT TO REVOKE YOUR AUTHORIZATION – You may revoke, in writing, the authorization you gave us for use or disclosure of your PHI. However, if we have relied on your consent or authorization, we may use or disclose your PHI up to the time you revoke your consent.
- RIGHT TO BE NOTIFIED OF A BREACH OF YOUR PHI – Should a breach of your unsecured PHI occur, we are required to notify you.
- RIGHT TO OPT OUT OF FUNDRAISING COMMUNICATIONS – You have the right to opt out of receiving fundraising communications. Doing so will not in any way affect the services you receive at KDC. You may also choose to opt back in at any time. To opt out of fundraising communications contact the KDC Development Department at firstname.lastname@example.org.
Our Duties in Maintaining Your Privacy and How We Fulfill Them
KDC strives to and is required by law to maintain the privacy of your PHI. This includes providing you with this notice of our legal duties and privacy practices that relate to your PHI as well as abiding by the terms of the notice currently in effect. This notice and any future revisions will apply to all PHI, including any created or received prior to it going into effect. We reserve the right to change our privacy practices and this notice at any time, when permitted or as required by law. We will provide you a copy of any revised notices upon your request and will post the new notice. Where any conflict exists between a state and federal law pertaining to the privacy of your PHI, we will honor the law that gives you greater rights or protections for your PHI. Should you have any questions about the privacy of your PHI or the content of this notice, please contact the KDC Privacy Officer at 508-772-1208 or email@example.com.
If You Feel Your Privacy Rights Have Been Violated
If you feel that your privacy rights have been violated, you may make a complaint to KDC or to United States Secretary of the Department of Health and Human Services Office for Civil Rights. If you file a complaint, we will not take any action against you or change our treatment of you in any way.
To make a complaint with KDC, please contact:
KDC Privacy Officer
1 Commercial Street
Foxboro, MA 02035
To make a complaint with US DHHS OCR, please contact:
Office for Civil Rights
U.S. Department of Health and Human Services
J.F. Kennedy Federal Building – Room 1875
Boston, MA 02203