Privacy Policy

Lutheran Family Services
Notice of Privacy Practices

Effective April 30, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT
YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who We Are
This Notice describes the privacy practices of Lutheran Family Services. For purposes of this Notice, the pronouns "we," "us," and "our" refer to Lutheran Family Services (LFS), programs that provide mental health services. It includes any person who assists in providing mental health services to you through any department or service of LFS at any LFS location or any business associate of LFS who performs a mental health service on behalf of LFS utilizing your health information.

Lutheran Family Services provides both mental health services, (such as counseling) and other types of services (such as adoption services) to individuals and families.

Our Privacy Responsibilities
Because we provide mental health services, we are required by law to protect the privacy of your protected health information (PHI). We are also required to give you this Notice which describes your rights as our client and our obligations regarding the use and disclosure of PHI for the provision of mental health services to you. We are required to comply with the terms of this Notice as it is currently in effect.

We reserve the right to make changes to this Notice and to make such changes effective for all PHI we maintain about you relating to the provision of mental health services, including PHI we already have. We will revise this Notice whenever there is a material change to uses and disclosures, your rights, our duties or other practices described in this Notice. If and when this Notice is changed, we will post a copy in our facilities in prominent locations and on our web site at www.lfsohio.org. We will also provide you with a copy of the revised Notice upon your request. Except when required by law, a material change to this Notice will not be implemented before the effective date of the new Notice, in which the material change is reflected.
Your Health Information

As a provider of behavioral health care services, we have highly sensitive and personal health information about our clients in our possession. Federal and state laws require us to keep your health information confidential unless we are specifically required or permitted by law to share information about you with others. The law is particularly restrictive regarding the use and disclosure of information which would identify you as a recipient of mental health services. We respect your privacy and will protect your health information in a lawful, responsible and professional manner.
As you read this notice, you will see the term "protected health information" or "PHI." For purposes of this Notice, protected health information or PHI is health information that identifies you (or information from which there is a reasonable basis to believe you could be identified) and is created or obtained by us for the purpose of providing mental health services to you. PHI may include information about your physical, mental, emotional and chemical dependency conditions, medical history, descriptions of symptoms, diagnoses, examinations, test results, treatment, treatment plans, as well as information related to payment for mental health services rendered.

I. HOW WE MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION ABOUT YOU
The following categories describe different ways that we may use and disclose your protected health information in relation to our provision of mental health services to you. The examples included with each category do not list every type of use or disclosure that may fall within that category, but are provided to give you some idea of what we may do with your PHI with and without your authorization.

AS A GENERAL RULE, USE AND DISCLOSURE OF PHI REQUIRES YOUR AUTHORIZATION.

As a general rule, we may not use or disclose PHI which would identify you as a patient receiving mental health services without your written authorization. After we disclose PHI pursuant to your authorization, we cannot guarantee that the recipient of your PHI will not further disclose your PHI. You can revoke your authorization at any time by giving our Privacy Officer written notice of your decision to revoke. If you revoke your authorization, we will no longer use or disclose PHI about you for the reasons covered by your authorization. However, we will not be able to take back any disclosures made prior to your revocation.

EXCEPTIONS TO GENERAL RULE AND SPECIAL SITUATIONS

Treatment, Payment and Health Care Operations
Treatment: We may use and disclose PHI about you within those parts of our
organizations involved in the provision of mental health services to you without written authorization to provide, coordinate, or manage your care and related services.
Individuals providing mental health services within our organizations may consult with each other regarding your treatment and coordinate and manage your health care with each other. For example, we may use your PHI to provide individual counseling to you as well as to assist you in obtaining appropriate resources for your mental health symptoms.

As a general rule, we may not disclose any PHI about you for treatment purposes either to those parts of our organizations that are providing other types of services to you or outside our organizations unless you have authorized the disclosure in writing. One exception to this general rule is that we may disclose limited PHI without your written authorization in order to respond to a medical emergency. For example, we may disclose PHI to medical personnel in the event you suffer a medical emergency such as a heart attack, stroke, life-threatening reaction to medication or a drug overdose.

Payment: We may use and disclose PHI for billing, claims management, and collection activities. If we are providing you mental health services, we must attempt to obtain your written authorization before we disclose PHI to be paid for those services; however, if you do not provide us with a written authorization, we are permitted to disclose PHI necessary to be paid for services provided to you. We will ask you to authorize us to use and disclose PHI so that we can bill and collect payment for the treatment and services provided to you.

The PHI we may need to disclose to others to be paid may include information that identifies you, your diagnosis, and procedures and supplies utilized during your treatment. Before providing treatment or services, we may need to share details with third party payors, such as your health insurer to verify coverage.

Health Care Operations: We may use and disclose PHI without your written authorization in order to perform business activities which are called health care operations. Health care operations include doing things that allow us to improve the quality of care we provide and to reduce health care costs. We may use information in your health record to assess the care provided in your case and others like it. This information will be used in an effort to improve the quality of patient care. Your protected health information may also be used to resolve any complaints you have.
Communications From Us to You: We may contact you without prior written authorization to remind you of appointments and to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you. We may also contact you for fundraising purposes. If we contact you for any of these purposes, we will do so in a way that does not identify you as a recipient of mental health services.

OTHER SPECIAL SITUATIONS

Communications to Individuals Involved in Your Care: We will not disclose PHI which would identify you as a patient receiving mental health services to anyone involved in your care unless you have authorized us to do so or unless the disclosure is otherwise permitted or required by law.
If we are providing mental health services to you, we may provide limited PHI to a family member who is involved in the provision, planning and monitoring of your services if your treating physician determines that the disclosure would be in your best interest and if you do not object. Such disclosures to family members are limited to medication information, a summary of your diagnosis and prognosis and a list of the services and personnel available to assist you and your family.

Communications to Disaster Relief Agencies: We may disclose limited PHI to disaster relief agencies so that they can notify others about your location, general condition or death with appropriate written authorization. We may do so without written authorization if we can do so in a way that does not identify you as a recipient of mental health services.

Uses or Disclosures Required By Law: We may use and disclose PHI without your written authorization if we are required to do so by federal, state, or local law. Any disclosure will be strictly limited to the requirements of the law.

Uses or Disclosures For Public Health Activities: In accordance with applicable law, we may use or disclose PHI to public health authorities or other authorized persons to carry out certain activities related to public health without your written authorization, so long as we do not identify you as a recipient of mental health services. Such disclosures may include disclosures to:
• Prevent or control disease, injury, or disability;
• Report disease, injury, birth, or death;
• Report reactions to medications or problems with products or devices regulated by the federal Food and Drug Administration or other activities related to the quality, safety, or effectiveness of FDA-regulated products or activities;
• Locate and notify persons of recalls of products they may be using; or

• Notify a person who may have been exposed to a communicable disease in order to control who may be at risk of contracting or spreading the disease.
Uses or Disclosures Regarding Abuse, Neglect, or Domestic Violence: We may disclose PHI without your written authorization, in accordance with applicable law, to designated authorities to report known or suspected child abuse or neglect. We may also disclose PHI without your written authorization, in accordance with applicable law, to designated authorities if we reasonably believe that you have been a victim of domestic violence, abuse or neglect. If the victims are adults, we will make every attempt to report in such a way that does not identify any person as a recipient of mental health,services.

Uses or Disclosures For Health Oversight Activities: In accordance with applicable law, we may disclose PHI without your written authorization to a health oversight agency performing oversight activities authorized by law. Such activities could include, for example, audits, investigations, inspections, licensure and disciplinary activities conducted by agencies required by law to take specified actions to monitor the health care system, certain governmental health care programs, and compliance with specific laws.
Uses or Disclosures For Lawsuits and Other Legal Proceedings: Before disclosing PHI related to a mental health client, we must receive written authorization from the client or a court order signed by a judge.
Uses or Disclosures For Law Enforcement: When required by law in specific .circumstances, we may disclose PHI to law enforcement officials without your written authorization. For example, we may disclose PHI about a crime committed at one of our facilities or against one of our employees. For other disclosures to law enforcement, we may disclose PHI without your written authorization only if we can do so in a way that does not breach any professional confidentiality obligation and if we can do so in a way that does not identify any individual as a recipient of mental health services.
Uses or Disclosures To Coroners and Medical Examiners: We may disclose PHI to coroners and medical examiners without appropriate written authorization to assist in the identification of a deceased person and to determine a cause of death. In other situations, we may only disclose PHI without written authorization from an appropriate representative if we can do so in a way that does not identify a person as a recipient of mental health services.

Uses or Disclosures For Organ and Tissue Donation: If you are an organ donor and if permitted by applicable law, we may disclose PHI without your written authorization to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant. In making such a disclosure, we will not identify you as a recipient of mental health services.

Uses or Disclosures For Research: We may use and disclose PHI for research purposes without your written authorization under certain limited circumstances. In general, we must obtain written authorization to use and disclose PHI for research purposes unless the research project meets the criteria established by federal law to ensure the ongoing privacy of PHI.
Uses or Disclosures To Avert a Serious Threat to Health and Safety: In accordance with applicable Ohio law and ethical standards, we may use or disclose PHI without your written authorization to prevent or lessen a serious threat to an individual's health and safety or to the health and safety of others.

Uses or Disclosures For Specialized Government Functions: Under certain circumstances, we may disclose PHI without your written authorization for certain c: governmental activities:

• For national security and intelligence activities. For example, we may disclose PHI to those federal authorities authorized to conduct national security activities pursuant to the National Security Act.
• To help provide protective services for the president and others specified by federal law.
Depending upon the situation, we may be required to make such disclosures in a way that does not identify you as a recipient of mental health services.
Uses or Disclosures For Worker’s Compensation: In accordance with your written -authorization, we may disclose PHI necessary to comply with laws relating to workers compensation or other similar programs established by law.

Disclosures required by the HIPAA Privacy Rule: We may be required to disclose PHI without your written authorization to the Secretary of the Department of Health and Human Services when directed by the Secretary in order to review our compliance with federal privacy rules.

II. YOUR RIGHTS REGARDING PROTECTED HEALTH INFORMATION ABOUT YOU

Under federal and state law, you have the following rights regarding PHI about you. All requests to exercise these rights must be submitted in writing to our Privacy Officer at the address listed in Section IV. below.
Inspection and Copying: In most cases, you have a right to inspect and obtain a copy of the information contained in the "designated record set" we keep regarding your care. This "designated record set" is the psychotherapy records and billing records maintained by or for Lutheran Family Services that are used to make decisions about the provision of mental health services to you. You have the right to inspect and copy these records unless your right to access particular identified information is specifically restricted in your treatment plan because a licensed health care professional has determined that providing you with the information is likely to endanger the life or physical safety of you or others. Any such restrictions will be explained to you and such restrictions must be renewed annually to retain their validity. In lieu of providing access, we may ask you to agree to a summary of the PHI you have requested.

If we deny your request to inspect and/or obtain a copy of any records about you, we will notify you in writing; explain the reason that we have denied your request; explain whether you may have that decision reviewed; and the process by which you may seek further review or file a complaint.
If you request copies, we will charge a fee for the cost of copying, mailing or other related supplies.

Amendment: If you believe the information in your designated record set (as described above) is incorrect or if important information is missing, you have the right to request that we amend the records. If we deny your request for an amendment, we will notify you in writing, and you may submit a written statement of disagreement to be added to your PHI. We may deny your request to amend your PHI if we determine that:

• The information about which you have requested an amendment was not created by us (unless you can demonstrate that the creator of the information is no longer available);
• The information is not part of the designated record set we maintain about you; or,
• If we determine that the record is complete and accurate.
Accounting of Disclosures: You have the right to obtain an accounting of the disclosures we have made of your PHI, except for disclosures made for treatment, payment, or health care operations purposes; certain disclosures required by law to be kept confidential; and, disclosures you specifically authorized.

Your written request must specify the time period for which you are requesting information. Your request may be for a period of up to six years starting after April 30, 2003. You may request that we provide you with an accounting of disclosures in paper or electronic form. Your request for an accounting in a 12-month period will be provided to you for a fee. It will be based upon our costs to producing the accounting. We will inform you of the cost before we begin to prepare the accounting of disclosures.
Notice of Privacy Practices: You have the right to request and obtain a paper copy of this Notice at any time, even if you have received an electronic copy of this Notice.

Request for Confidential Communications: You have the right to request that medical information be communicated to you in a confidential manner. For example, you may request that we send your mail to an address other than your home. Your written request must tell us the specific way that you would like us to communicate with you. You do not have to tell us why you are making such a request. However, we may need information from you regarding how your treatment is to be paid for before we can consider your request. We will agree to your request when it is reasonable for us to do so and will notify you, in writing, of our decision.

Request for Restrictions: You have the right to request restrictions on certain uses and disclosures of your information for treatment, payment or healthcare operations or to persons involved in your care, except when the uses or disclosures are required by law or are necessary to provide care in an emergency situation. We are not legally required to agree to your request. We will notify you, in writing, of our decision regarding your request.

III. QUESTIONS AND COMPLAINTS
If you have questions about our Notice or our privacy practices or require further information, please contact our Privacy Officer at the address noted below in Section IV.

You have the right to file a written complaint with our Privacy Officer at the address noted below in Section IV., if you believe your privacy rights have been violated. You may also file a written complaint with the Secretary of the United States Department of Health and Human Services at:

Region V Office of Civil Rights
The U.S. Department of Health and Human Services
233 N. Michigan Avenue, Suite 240
Chicago, Illinois 60601

We will not retaliate or take action against you for filing a complaint.

IV. PRIVACY OFFICER CONTACT INFORMATION
Our Privacy Officer can be contacted at:
Lutheran Family Services Privacy Officer
4100 Franklin Blvd
Cleveland, Ohio 44113

(216) 281-2500

Approved by LFS BOT

Rev 1//2008