THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT CHILDREN SERVED AND THEIR FAMILIES MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW THIS DOCUMENT CAREFULLY.

Cedarcrest is committed to fulfilling our responsibility to protect the privacy and confidentiality of information about the children and young adults we serve, their families and our staff. In response to the specific requirements of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the HITECH Act of 2009 (Health Information Technology for Economic Health Act), we have developed this Notice of Privacy Practices. This notice describes the privacy practices of Cedarcrest Center, the physicians and providers providing care at or for Cedarcrest Center. This notice also describes your rights and certain obligations we have regarding the use and disclosure of the protected health information of your child.

From time to time it may be necessary, and we reserve the right, to change our privacy practices and the terms of this Notice. Such changes will apply to all protected health information which we already have about your child1 as well as information we receive or create in the future. Should we do so during the period that your child is receiving care at Cedarcrest Center, we will provide you a copy of any such revisions. This and subsequent Notices will have the effective date at the top of the first page and at the bottom of the last page. The current Notice also will be posted at Cedarcrest Center and on our web site www.cedarcrestcenter.org. We hope that you will review this information carefully and contact the President/CEO who serves as the Cedarcrest Center’s Privacy Officer, with any questions or concerns.

I. OUR PRIVACY OBLIGATION
We are required by law to maintain the privacy of health information and provide you with a description of our privacy practices. When we use or disclose health information we are required to abide by the terms of this Notice or other Notice in effect at the time of the use or disclosure. In the event of a breach of privacy or security of your health information, you will be notified in accordance with the law and applicable regulations. Health information includes demographics, medical information which relates to your child’s past, present, or future physical or mental health or condition and health care services provided to your child, as well as billing information regarding the payment for those services. Cedarcrest Center has the following legal obligations regarding your child’s protected health information: 

• Make sure that protected health information is kept private.
• Give you this Notice of our legal responsibilities and privacy practices for the use and disclosure of protected health information.
• Follow the terms of the Privacy Notice currently in effect, and make any subsequent revisions available to you.
• Notify you if we are unable to agree to a requested restriction on any permitted use or disclosure of protected health information.
• Accommodate reasonable requests that you may make to communicate protected health information about your child by alternative means or at alternative locations.

II. ELECTRONIC MEDICAL RECORDS
Cedarcrest Center uses an electronic medical record (EMR) to store and retrieve much of your child’s health information. One of the advantages of Cedarcrest Center’s EMR is the ability to share and exchange health information among Cedarcrest personnel and other community health care providers who are involved in a child’s care. When Cedarcrest Center enters the information into the EMR, it may share that information by using shared clinical databases or health information exchanges. Cedarcrest Center may also receive information from other health care providers in the community who are involved with the care by using shared databases or health information exchanges. If you have any questions or concerns about the sharing or exchange of your information, please discuss them with our Social Worker, therapist or Director of Nursing Services.

III. USES AND DISCLOSURES WITH YOUR CONSENT OR AUTHORIZATION

A. Use and Disclosure with Your Consent: Before we provide medical care, except in an emergency or other special circumstances, we will ask you to read and sign a written consent authorizing us to use and disclose your health information for the following purposes: to provide treatment, to obtain payment for services, and to support health care operations such as quality improvement and customer service, as described below:

Treatment – We will use and disclose your child’s protected health information to provide, coordinate, or manage health care and any related services. This may include, with your consent, the coordination or management of your child’s health care with a third party, such as a primary care physician, lab facility or pharmacy, who at the request of our medical director becomes involved in your child’s care. In emergencies, we will use and disclose the necessary protected health information to provide the treatment required.

Payment – If you consent, protected health information will be used or disclosed, as needed, to obtain payment for health care services. This may include contacting Medicaid or your insurance company to determine eligibility or coverage and “medical necessity,” or to undertake utilization review activities. For example, obtaining prior approval for an admission might require that protected health information be disclosed.

Health Care Operations – We may use or disclose, as needed, your child’s protected health information to support Cedarcrest’s daily operational and business activities related to the child’s health care. These activities may include general administration, quality assurance activities, training of students, licensing, and conducting or arranging for other health care related activities. For example, we may use and disclose protected health information to nursing students completing internships at Cedarcrest. In some cases we may remove information that identifies your child from the information.

Other Permitted Uses and Disclosures

• • Appointment Reminders: We may use or disclose protected health information to contact you as a reminder that your child has an appointment for medical care or treatment.
  • Treatment Alternatives: We may use or disclose protected health information to tell you about or recommend treatment options or alternatives for your child.
  • Health-Related Benefits and Services: We may use and disclose demographic information to tell you about health-related benefits and services that may be of interest to you or your child.
  • Fundraising/Promotions: We may use and disclose demographic information for the purpose of raising funds for Cedarcrest, although you will have the ability to request that no further solicitations be made to you.
  • Business Associates: We will also share protected health information, as needed, with third-party “Business Associates” who provide services on Cedarcrest’s behalf, such as an auditor who reviews financial records or a billing agent for outpatient services. We require that our Business Associates protect your health information. Cedarcrest will have a contract with each Business Associate to help safeguard your child’s health information.

Uses and Disclosures That We May Make Unless You Object:

In the following situations, we may use or disclose your child’s protected health information if you do not object to our doing so by providing us with a written objection:

• • Facility Directory: We may include your child’s first name in a list (directory) of those children currently at our facility.
  • Individuals Involved in Care: We may use or disclose certain relevant personal information about your child to family friends or other persons you designate who are involved in your child’s health care or payment related to that care.
  • Disaster Relief: We may use or disclose your child’s protected health information to an authorized public or private entity assisting in disaster relief efforts so that you and your family can be notified of his or her location and general condition.

B. Use or Disclosure with Your Authorization. As described above, your consent only permits us to use your health information to treat you, receive payment for services, and for health care operations. We may use or disclose your health information for any reason other than these only when (1) you authorize us to use or disclose this information by signing an Authorization Form or (2) there is an exception described in Section V below.

Required Disclosures
We must disclose protected health information when required by federal, state or local law. For example, we must make disclosures to the Secretary of the Department of Health and Human Services (DHHS) for investigations or determinations of our compliance with laws regarding the protection of your child’s health information.

IV. USES AND DISCLOSURES NOT REQUIRING YOUR CONSENT OR AUTHORIZATION
There are limited times when we may use or disclose protected health information without your consent or authorization, such as for emergency care if required by law, if consent is requested and the parent/guardian is injured and unable to provide consent.

Public health disclosures: Disclosures made to prevent or control disease, injury, or disability, report reactions to medications or problems with medical products or notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.

Communicable disease reporting: When required by law, disclosure to provide notice to a person who may have been exposed or at risk of contracting a specific disease or condition.

Health oversight activities: Disclosures made to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections.

Reporting of suspected abuse or neglect: To government agencies authorized to receive reports of abuse or neglect.

As a response to judicial and administrative proceedings: Disclosures that are required by a court order or subpoena.

For law enforcement purposes: To law enforcement officials for certain purposes, including reporting of certain types of wounds or locating a suspect, fugitive, material witness or missing person.

Public safety/duty to warn: To warn of a serious threat to a clearly identified or reasonably identifiable person, or a serious threat of substantial damage to real property, but only to the threatened individual or law enforcement able to help prevent the threat.

Workers’ Compensation: Reporting authorized in connection with workers’ compensation programs.

Research activities: Only under certain circumstances permitted by federal law in which protocols are established to ensure privacy of health information.

Military activity and national security: To authorized federal officials for specialized government functions such as national security and intelligence, and to military command authorities regarding members of the armed forces.

Disaster relief efforts: To disclose information to an agency such as the Red Cross to contact you with information about your child.

Fundraising Communications: We may contact you to request a tax deductible contribution to support activities at Cedarcrest Center. In connection with any fundraising, we may disclose your demographic information, physician, department, outcome, health plan an opportunity to opt-out of any fundraising campaigns. To opt-out of fundraising communications, please contact our Privacy Officer, Cathy Gray by telephone at 603-358-3384 or by e-mail at cgray@cedarcrestcenter.org.

Marketing Communications: We may use or disclose your health information to identify health-related services and products that may be beneficial to your health and we may contact you about these services and products. To highlight services we provide you will have the opportunity to authorize such use.

Reporting to coroners, funeral directors, and organ donation agencies: To identify a deceased person, determine a cause of death or to enable these parties to carry out their authorized duties.

Uses and Disclosures Authorized by You
All other uses and disclosures of your child’s protected health information (for example, the use of your child’s likeness through photographs to be used in publications both material (newsletters, annual reports) or electronic (presentations or website)), will be made only after we receive written authorization from you as parent or legal guardian, or from your child in those limited instances in which a minor may sign an authorization under New Hampshire law. You have the right to revoke your authorization at any time in writing, except to the extent that we already have relied on it in making an authorized use or disclosure.

V. ORGANIZED HEALTH CARE ARRANGEMENT: Cedarcrest Center and its care team members present this document to you as a joint notice. Physicians and other caregivers may have access to your health information in their offices to assist in reviewing past treatment as it may affect present and future treatment plans. If your doctor is not employed by Cedarcrest Center, he or she may have different policies or notices regarding the doctor’s use or disclosure of the medical information created in the doctor’s office or clinic.

VI. YOUR INDIVIDUAL RIGHTS

Right to access medical records
You have the right to review and obtain a copy of the protected health information that is contained in medical and billing records for as long as we maintain the protected health information. To obtain this information, please send a written request addressed to our Privacy Officer. Please be aware that under certain very limited circumstances, Cedarcrest Center may deny your request to access and inspect the information, but you always have a right to copy this information. If you request a copy, we may charge a cost-based fee for the cost of copying, mailing and other associated costs.

Right to request confidential communications
You may request that we communicate with you about medical matters in a certain way or at a certain location. If you wish to receive confidential communications, please discuss this with our Social Worker who will then ask you to put your request in writing. We will accommodate reasonable requests, whenever possible.

Right to be notified in the event of a breach of your or yourchild’s health information
Cedarcrest Center is required by law to notify you in the event of a breach of unsecured protected health information when it has been or is reasonably believed to have ben accessed, acquired or disclosed in violation of the HIPAA Privacy Rule.

Right to request an amendment
If you believe that the information we have is inaccurate or incomplete, you may request an amendment to your child’s protected health information for as long as we maintain this information. While we will accept requests for amendment sent in writing to our Privacy Officer, we are not required to agree to the amendment and will notify you if we deny your request.

Right to request restrictions
You may ask us not to use or disclose any part of the medical information, or to release information to someone who is involved in your child’s care or the payment for services, like a family member, and for disaster relief purposes described above. The request must be made in writing to Cedarcrest Center’s Social Worker or Privacy Officer. Please specify what information you want restricted, whether you want to restrict our use, disclosure, or both; to whom you want the restriction to apply, and the expiration date of the restriction.

If the Cedarcrest Privacy Officer believes that the restriction is not in the best interest of either party, or cannot reasonably accommodate the request, Cedarcrest is not required to comply. If the restriction is mutually agreed upon, we will not use or disclose your child’s protected health information in violation of that restriction, unless it is needed to provide emergency treatment. Either of us may revoke a previously agreed upon restriction, at any time, in writing, but our revocation will not apply to protected health information that we have at the time of revocation.

Right to an accounting of disclosures
You may request that we provide you with an accounting of the disclosures we have made regarding your child’s protected health information by written request addressed to our Privacy Officer. This right applies to disclosures made for certain purposes other than treatment, payment, or health care operations as described in this Notice of Privacy Practices. The disclosure must have been made after April 14, 2003, and no more than 6 years prior to the date of request. This right excludes disclosures made to you, or to family members or friends involved with your child’s care, for notification purposes or pursuant to an authorization. The right to receive this information is subject to additional exceptions, restrictions, and limitations.

Right to obtain a copy of this notice
Paper copies of this notice are available at Cedarcrest, on the internet at www.cedarcrestcenter.org, and by written request to Cedarcrest’s Privacy Officer.

VII. ACKNOWLEDGMENT OF RECEIPT OF THIS NOTICE
We will ask you to sign an acknowledgment of receipt of this notice. Our intent is to make you aware of the possible uses and disclosures of your child’s protected health information and of the privacy rights of your child and his or her legal guardian. Health care services are not contingent upon your signed acknowledgment. If you decline to provide a signed acknowledgment, we will continue to provide treatment, and will use and disclose needed protected health information for treatment, payment, and health care operations and as otherwise permitted by law.

VIII. FEDERAL AND STATE PRIVACY LAWS
This Notice of Privacy Practices is provided to you as a requirement of the Health Insurance Portability and Accountability Act (HIPAA) and HITECH Act of 2009. There are several other privacy laws that also apply including the Freedom of Information Act, FERPA, the Privacy Act and the Alcohol, Drug Abuse, and Mental Health Administration Reorganization Act. To the extent they are more stringent or provide individuals with greater access to their protected health information, these laws have not been superseded by HIPAA and its related privacy rules and have been taken into consideration in developing our policies and this Notice of how we will use and disclose your protected health information.

IX. FOR FURTHER INFORMATION OR IF YOU HAVE A CONCERN
If you want further information about your privacy rights, or are concerned that we have violated your privacy rights, or disagree with a decision that we have made about your health information, please call Cedarcrest Center’s Social Worker or our Privacy Officer, Cathy Gray, President/CEO, at 603-358-3384 or by e-mail at cgray@cedarcrestcenter.org for additional information regarding content of this Notice of Privacy Practices or to discuss your concerns. You may also file written complaints with the Secretary of the U.S. Department of Health and Human Services. Upon request, we will provide you with the correct address for the Director. We will not retaliate against you if you file a complaint with the Director or us.

X. EFFECTIVE DATE AND DURATION OF THIS NOTICE
Effective Date. This Notice describes the privacy policy of Cedarcrest Center that became effective on September 23, 2013. Right to Change Terms of this Notice. We may change the terms of this Notice at any time. If we change this Notice, we may make the new terms effective for any information created or received prior to issuing the new Notice. We will post the new Notice in the reception area and on our Internet site at www.cedarcrestcenter.org. You may also obtain a new notice by contacting our Social Worker at 603-358-3384.