(Rev. 3-24)

NOTICE OF PRIVACY PRACTICES

This Notice of Privacy Practices is effective as of May 24, 2016.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. You have the right to a paper copy of this Notice: You may request a copy at any time.

CareArc provides health care to patients in partnership with physicans and other professionals and organizations. The information in this Notice of Privacy Practices (Notice) will be followed by all the following entities, sites, and locations of the CareArc:

• All individuals employed by the CareArc
• All CareArc inpatient and outpatient departments
• Volunteers working at any CareArc facility
• Medical, nursing, dental, and other students present at any CareArc facility
• Any health care professional who treats you at any CareArc facility

Our Pledge Regarding your health information.

We are committed to protecting the confidentiality of our records containing information about you. The Notice applies to all records of your care created or received by the CareArc. Other healthcare providers from whom you obtain care and treatment may have different policies or notices regarding the use and disclosure of your health information created or received by that provider. Also, health plans in which you participate may have different policies or notices concerning information they receive about you.

CONTACT PERSON FOR QUESTIONS: If you have any questions about this Notice or our privacy practices relating to your health information please contact the following person:

CareArc
Attention: Privacy Officer/Compliance Coordinator
420 W. 15th Ave.
Emporia, KS 66801
Phone: 620-342-4864
Fax: 620-342-4937

Understanding your Health information: Its uses and Disclosures.

This Notice contains information in the following general categories:

• What is your health record / information?
• What are the responsibilities of CareArc when it comes to your health information?
• How will we use and disclose your medical information?
• Special situations – Sharing health information without your permission
• Other uses and disclosures – Revoking previous permission to use or disclose your health information
• Your rights regarding your health information
• What should you do if you have a complaint concerning your health records?
• If changes are made to this Notice, how to obtain a revised copy.

What is your Health Record / Infromation?

Each time you receive medical or health care from a hospital, physician, or other provider, a record of your visit is made. Typically, this record contains a history of your illnesses or injuries, symptoms, exam and laboratory results, treatment provided and treatment plans, and notes on future care. Depending on your health care situation your record may contain more or different information. How your health information is used is described on the following pages.

What are the reponsiblities of CareArc when it comes to your health information?

CareArc is required by law to:

• Keep your health information private and only disclose it when required to do so by law;
• Explain our legal duties and privacy practices in connection with your health records;
• Obey the rules found in this Notice;
• Inform you when we are unable to agree to a requested restriction that you have given us;
• Accommodate your reasonable request for an alternative means of delivery or destination when sending your health information.
• Notify affect individuals following a breach of unsecured protected health information.

We will not use or disclose your health information without your authorization, except as explained in this Notice or as required by law. Certain laws may require that we disclose your health information without your authorization. We are obligated to follow those laws.

How will we use and disclose your health information?

CareArc may use and disclose your health information for the following purposes without your express consent or authorization:

Treatment.

We may use health information about you to provide you with medical treatment or services. We may disclose health information about you to doctors, nurses, technicians, medical students, or other clinical staff or personnel who are involved in taking care of you at the CareArc. For example, a doctor treating you for a broken bone may need to know if you have diabetes because diabetes may slow the healing process.

Different departments of the CareArc also may share health information about you in order to coordinate the different services you need, such as prescriptions, lab work and x-rays. We also may disclose health information about you to people outside the CareArc who may be involved in your medical care while you are at the CareArc.

We may use and disclose health information to discuss with you treatment options or health-related benefits or services or to provide you with promotional gifts of nominal value.

Payment.

We may use and disclose health information about you so that the treatment and services you receive at the CareArc may be billed to an insurance company or a third party. We may also provide information to other health care providers to assist them in obtaining payment for services they provide to you. For example, we may need to give your health plan (health insurance Company) information about a medical procedure you received at CareArc so your health plan will pay us or reimburse you for the procedure. We may also tell your health plan about a dental treatment you are going to receive in order to obtain prior approval or to determine whether your plan will cover the treatment. This may include filing statutory liens to collect amounts owed to us for your treatment, care, and maintenance.

Healthcare operations.

We may use and disclose health information about you for our internal operations. These uses and disclosures are necessary to operate the CareArc and make sure that all of our patients receive quality care. For example, we may use health information to:

• Review our treatment and service plans and to evaluate the performance of our staff in caring for you.
• Combine health information about many CareArc patients to decide what additional services CareArc should offer, what services are not needed, and whether certain new treatments are effective.
• Disclose information to doctors, nurses, technicians, medical students, and other clinical personnel for review and learning purposes.
• Combine health information we have with health information from other clinics to compare how we are doing and see where we can make improvements in the care and services we offer.

Business Associates.

CareArc provides some services through contracts or arrangements with business associates. We require our business associates to appropriately safeguard your information.

Creation of de-identified health information.

We may remove information that identifies you from this set of health information so others may use it to study health care delivery without learning who the specific patients are. For example, cancer and trauma registries. Additional uses and disclosures for “health care operations” include:

• Activities relating to improving health or reducing health care costs;
• Protocol development;
• Care management;
• Training, accreditation, certification, licensing, credentialing, or other related activities;
• Underwriting and other insurance related activities;
• Medical review and auditing functions, including fraud and abuse detection and compliance review;
• Conducting or arranging for legal services for the CareArc, its staff or personnel;
• Business planning and development, business management and general administrative activities; and,
• Internal grievance resolution.

Appointment reminders.

We may use and disclose health information to contact you, a family member or friend involved in your health care or as authorized by you as a reminder that you have an appointment for treatment or medical care at our facility. Unless you direct us otherwise, we may leave messages your answering machine / voice mail system identifying CareArc and asking you to return our call.

Individuals involved in your care or payment for your care.

We may release health information about you to a friend or family member who is involved in your medical care. We may also give information to someone who helps pay for your care. We may also tell your family or friends your condition and that you are in our CareArc. In addition, we may disclose health information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location. The amount of information disclosed will depend on that person’s particular involvement in your care. If you want this information restricted you must tell us by using the required procedure.

Treatment alternatives.

We may use and disclose health information to tell you about, or recommend possible treatment options or alternatives that may be of interest to you.

Disclosures as required by law.

We will disclose health information about you when required to do so by federal, state or local law. This may include disclosures for: communicable diseases, wounds, abuse, neglect, disease/trauma registries, health oversight matters and other public policy requirements. We may be required to report this information without your permission.

To avert a serious threat to health or safety.

We may use and disclose health information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

Research.

Under certain circumstances, we may use and disclose health information about you for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received another, for the same condition. All research projects, however, are subject to a special approval process. This process evaluates a proposed research project and its use of health information, trying to balance the research needs with the patients’ need for privacy of their health information.

Before we use or disclose health information for research, the project will have been approved through this research approval process, but we may, however, disclose health information about you to people preparing to conduct a research project, for example, to help them look for patients with specific health needs, so long as the health information they review does not leave the CareArc. We will usually ask for your specific permission if the researcher will have access to your name, address or other information that reveals who you are, or will be involved in your care at the CareArc.

Disclosures for fundraising activities.

We may use health information about you to contact you in an effort to raise money for the CareArc and its operations. We may disclose health information to a foundation related to the CareArc so that the foundation may contact you in raising money for the CareArc. We only would release contact information, such as your name, address, phone number and the dates you received treatment or services at the CareArc. If you do not want the CareArc to contact you for fundraising efforts, you must notify the Contact Person listed on the first page of this Notice in writing.

Special Situations - Sharing Health Infromation Without Your Permission

Organ and tissue donation.

If you are an organ donor, we may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Military and Veterans.

If you are a member of the armed forces, we may release health information about you as required by military command authorities. We may also release health information about foreign military personnel to the appropriate foreign military authority.

Workers’ compensation.

We may release health information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Public health activities.

We may disclose health information about you without your permission for public health activities. These activities generally include the following:

• To prevent or control disease, injury or disability (e.g. disease or trauma registries);
• To report births and deaths;
• To report child abuse or neglect;
• To report reactions to medications or problems with products;
• To notify people of recalls of products they may be using;
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
• To notify the appropriate government authority if we believe a patient has been a victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.

Health oversight activities.

We may disclose health information without your permission to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, licensing functions, and compliance with civil rights laws.

Lawsuits and disputes.

If you are involved in a lawsuit or in a dispute, we may disclose health information about you in response to a court or administrative order. We may also disclose health information about you in response to a court or administrative order even if you are not involved in the lawsuit or dispute. We may also disclose health information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested or as otherwise permitted by law.

Law enforcement purposes.

We may release health information if asked to do so by a law enforcement official:

• In response to a court order, subpoena, warrant, summons or similar process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
• About a death we believe may be the result of criminal conduct;
• About criminal conduct at the CareArc; and,
• In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

Coroners, Medical Examiners and Funeral Directors.

We may release health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release health information about patients of the CareArc to funeral directors as necessary to carry out their duties.

National security and intelligence activities.

We may release health information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Protective services for the President and others.

We may disclose health information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.

Inmates.

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release health information about you to the correctional institution of law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Other Uses and Disclosures - Revoking Previous Permission to Use or Disclose your Health Information.

Other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written permission. For certain disclosures of your information you must complete an “authorization” form and submit to us. If you provide us permission to use or disclose health information about you, you may revoke that permission, in writing, at any time.

To revoke any permission already given to us or permission given to us in the future you must revoke that permission in writing by sending it to the Contact Person listed on the first page of this Notice. If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission. We are required to retain our records of the care that we provided to you.

What are your Health Information Rights?

Although your health record is the physical property of the healthcare practitioner or facility that compiled it, the information belongs to you. You have the following rights:

Right to inspect and copy your records.

You have the right to inspect and obtain a copy of certain health information that may be used to make decisions about your care. Usually, this includes medical and billing records, but does not include psychotherapy notes, information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding, information that is subject to special laws or other information not contained in the medical or billing records.

To inspect and obtain a copy of your health information you must submit your request in writing to the Contact Person listed on the first page of this Notice. If you request a copy of the information, we may charge a reasonable fee for copying, including labor and supplies, and the cost of postage. We may require that you pay such a fee prior to receiving the requested copies.

CareArc will not charge a fee for processing requests for releases to other health care providers, for continuing care, for school purposes, for insurance or for workers’ compensation purposes.

We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to health information, you will be told in writing. In certain circumstances, however, you may request that the denial be reviewed. If the original denial of access to the medical records was made by a licensed health care provider as allowed by law, another licensed healthcare professional chosen by CareArc will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review. You will be advised in writing of this reviewing official’s decision.

Right to amend your records.

If you feel that health information we have about you is incorrect or incomplete, you may ask us to amend / change the information. You have the right to request an amendment for as long as the information is kept by or for CareArc. To request an amendment, your request must be made in writing and submitted to the CareArc’s Contact Person listed on the first page of this Notice, including a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• Was not created by CareArc, unless the person or entity that created the information is no longer available to make the amendment;
• Is not part of the health information kept by or for CareArc;
• Is not part of the information which you would be permitted to inspect and copy; or
• Is accurate and complete.

If your request is denied, you will be informed of the reason for denial and will have an opportunity to submit a statement of disagreement to be maintained with your records.

Right to an accounting of disclosures.

You have the right to request, in certain circumstances, an “accounting of disclosures.” An “accounting” is a list of the disclosures we made of health information about you, with certain exceptions specifically defined by law.

To request this list or accounting of disclosures, you must submit your request in writing to the CareArc’s Contact Person listed on the first page of this Notice. Your request must state a period, which may not be longer than six years and may not include dates before April 14, 2003. Your request should indicate in what form you want the list (for example, on paper, electronically, or some other form). The first list you request within a 12 month period will be free. For additional lists, we may charge you for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to request restrictions.

You have the right to request a restriction on the health information we use or disclose about you for treatment, payment, or healthcare operations. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that (1) we not use or disclose information about a procedure you had or (2) that certain people not be told of certain information.

We are not required to agree to your request. Only the Privacy Official can agree to your request. If we do agree, we will notify you in writing and comply with your request unless the information is needed to provide you emergency treatment. If we agree to a restriction, we may terminate any restriction if you agree to the termination or if we inform you that we are terminating our agreement to the restriction. You may also terminate any restriction.

How to make a request. To request restrictions or limitations, you must make your request in writing to the Contact Person, listed on the first page of this Notice. To request restrictions, you must complete a specific form providing information we need to process your request. To obtain this form or to obtain more information concerning this process, please contact the person identified on the first page of this Notice. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.

Right to request alternate or confidential communications.

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing to the Contact Person listed on the first page of this Notice. We will not ask you the reason for your request. We may ask you for clarification so we can understand your request. You are not required to give an explanation. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Rights relating to Electronic Health Information (HIE) Exchange.

CareArc participates in electronic health information exchange, or HIE. New technology allows a provider or a health plan to make a single request through a health information organization, or HIO, to obtain electronic records for a specific patient from other HIE participants for purposes of treatment, payment, or health care operations.

You have two options with respect to HIE. First, you can permit authorized individuals to access your electronic health information though an HIO. If you choose this option, you do not have to do anything. Second, you can restrict access to all of your electronic health information (except access by properly authorized individuals as needed to report specific information as required by law). If you wish to restrict access, you must complete and submit a specific form available at http://www.khie.org. You cannot restrict access to certain information only; your choice is to permit or restrict access to all of your information.

If you have questions regarding HIE or HIOs, please visit http://www.khie.org for additional information. Your decision to restrict access through an HIO does not impact other disclosures of your health information. Provider and health plans may share your information directly through other means (e.g. fax or secure e-mail) without your specific written authorization.

If you receive health care services in a state other than Kansas, different rules may apply regarding restrictions on access to your electronic health information. Please communicate directly with your out-of-state health care provider about what action, if any you need to take to restrict access.

Right to a paper copy of this Notice.

You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice. To obtain a paper copy of this Notice you may contact the CareArc’s Contact Person listed on the first page of this Notice.

What should you do if you have a complaint concerning your medical records?

If you believe your privacy rights to health information about you have been violated by CareArc you may file a complaint with CareArc by contacting the Contact Person listed the first page of this Notice or with the Secretary of the Department of Health and Human Services, Office for Civil Rights. All complaints must be submitted in writing. YOU WILL NOT BE PENALIZED FOR FILING A COMPLAINT.

If Changes are made to this notice.

CareArc reserves the right to change the terms of this Notice and make the revised Notice effective with respect to all protected health information regardless of when the information was created. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice in CareArc. You will find the date the Notice became effective at the top of the first page below the title. In addition, each time you register at the CareArc for treatment or healthcare services, a copy of the current Notice in effect will be given to you if you request it.

Disclaimer: CareArc recognizes the necessity of providing important information in languages other than English. We will do our best to provide accurate and timely Spanish versions of CareArc’s communications. However, if there are any discrepancies between the Spanish and English versions of these documents, the English version is to be considered the official version. If you have any questions or comments, please contact our Privacy Officer/Compliance Coordinator (Privacy@CareArc.org or 620-342-4864).