Medical Records

Notice of Privacy Practices

 

This Notice Describes How Medical Information About You For Services Delivered At The Mental Health Association May Be Used And Disclosed And How You Can Get Access To This Information. Please Review It Carefully.

​

OUR PLEDGE REGARDING MEDICAL INFORMATION

We are committed to protecting the confidentiality of your medical information. We create a record of the care and treatment you receive from Mental Health America of South Central Kansas (MHA). Such information may include work on treatment plan goals, symptoms, changes in your life, and information from other community service providers who are involved in your care and with whom you have signed a release. It also includes billing for services. We need this record to provide you with care and to meet certain legal requirements. This notice applies to all of the records held by MHA personnel. Depending upon the circumstances, Kansas law may further limit the disclosures MHA may make.
This notice will tell you about the ways in which we may use and disclose your medical information. We also describe your rights and certain obligations we have regarding the use and disclosure of your medical information. If you cannot read or comprehend this notice as written, let us know and we will read the notice to you. You may request a paper copy of this notice.

 

MHA is required by law to:
• Make sure that your medical information is kept private except as allowed by law;
• Give you this notice of our legal duties and privacy practices with respect to your medical information, and make a good faith effort to obtain your acknowledgement of receipt of this notice;
• If you are under the age of 18, this notice will be given to your parent or legal guardian who is responsible for consenting treatment;
• Follow the terms of the notice that is currently in effect. MHA does reserve the right to change this notice and its privacy policies as it feels necessary. A revised notice will be available upon request and will be available electronically or at the next treatment opportunity.

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION
MHA will not use or disclose your health information for any purpose not described in this Notice without your written authorization. MHA may use and disclose your health information without your written authorization for the following:
1. Treatment: We will use and disclose your health information in the course of providing, coordinating and/or managing your care and related services provided at MHA by your service providers and to other treaters. For example: Information obtained by an attendant care worker may be shared with your case manager; your therapist may share information with your psychiatrist or case manager.
2. Payment: We will use your health information in order to bill and collect payment from you, an insurance company or other third-party payers for services you receive at MHA. For example: Your health plan may be contacted to get prior approval for coverage of treatment you are going to receive or to determine whether your plan will pay for the treatment and services you receive.
3. Healthcare Operations: We will use your health information to assess the care and outcomes in your case and others like it to operate our business. Our health care operations include, among other things, the following functions: quality assessment and improvement activities; reviewing the qualifications and competence of providers; accreditation, and utilization review. For example: Your information could be used to evaluate the quality of care that you were provided, or your information may be combined with health information of other patients to evaluate the need for new services or treatment.
4. Client Survey: You will receive satisfaction surveys during service to help us evaluate our service and post-discharge to see how you are doing.
5. Appointment Reminders: You may receive appointment reminders in the mail or by phone. Appointment reminders may be left on voice mail at the phone number you have provided to us.
6. Fundraising: You may also receive information about MHA fundraising opportunities and may elect to opt out of these communications.
7. Research: Your PHI may be used by researchers when their research has been approved by an Institutional Review Board that has reviewed the research proposal and consent form and established protocols to ensure the privacy of your health information.
8. Coroners, Medical Examiners, and Funeral Directors: MHA may use/disclose PHI to the coroner, medical examiner, or funeral director as necessary for them to carry out their duties.
9. Organ and Tissue Donation: MHA may use/disclose PHI to organ procurement organizations or other entities engaged in procurement, banking or transplantation of organs/tissues for the purpose of transplant or donation.
10. Law Enforcement: PHI may be disclosed to a law enforcement official in response to a valid court order, subpoena or warrant, or in response to a official request for the purpose of identifying or locating a missing person, suspect or fugitive; about the victim of a crime; about a death we believe may be the result of criminal conduct; about criminal conduct at our offices; or in an emergency to report a crime, the location of a crime, victims of the crime or to identify the person who committed the crime.
11. Legal Proceedings: We may disclose/use your PHI in proceedings in response to an order, subpoena, discovery request or other lawful process.
12. Public Health Risks: Your PHI may be shared with the appropriate government agency relative to adverse events with respect to food, medications, products and product defects to facilitate product recalls, repairs or replacement, or for post marketing surveillance.
13. Treatment Coordination: We may discuss your treatment with family members or friends who are involved in your care. We may disclose PHI to an entity assisting in disaster relief efforts so that your family can be notified about your condition, status, and location.
14. Health Oversight Activities: to an agency for activities authorized by law, such as to prevent or control disease, injury or disability.
15. To Avert a Serious Threat to Health or Safety: We may use/disclose you PHI when necessary to prevent a serious threat to your health or safety or the health and safety of another person.
16. As Required by Law: We will disclose your PHI when required by federal, state or local law. This may include reporting of communicable disease, wounds, abuse, disease registries, health oversight and other public requirements.
17. Military and Veterans: MHA may use/disclose PHI to military command authorities as required by the Department of Veterans' Affairs authorities if you are a member of the military or a veteran.
18. National Security and Intelligence Activities: to authorize federal officials for conducting of intelligence or national security activities, including protective services to the President or other persons as authorized by law.
19. Workers Compensation: We may disclose health information about you for issues involving worker’s compensation or similar programs.
20. Health Related Benefits and Services: We may use your personal information to provide information to you regarding treatment alternatives or health related benefits which may be of interest to you.
21. Inmates/Persons in Custody: MHA may disclose PHI if you are in custody or presently incarcerated to a correctional facility or law enforcement official when the disclosure is necessary for treatment or safety of others.

OTHER USES AND DISCLOSURES OF YOUR HEALTH INFORMATION
Uses and disclosures of your health information that are not covered by this Notice or laws that apply to mental health treatment will be made only with your written authorization. If you provide us with written authorization to use or disclose your health information you may revoke that authorization in writing at any time. If you revoke your authorization, such information will not be used or disclosed after the date we receive the revocation. However, a revocation of an authorization does not apply to uses and disclosures prior to the date of the revocation.

YOUR HEALTH INFORMATION RIGHTS

​

You have the right to:

1. Request a restriction on certain uses and disclosures of your health information. Although you have a right to make such a request, please note that we are not required to agree to a requested restriction. If we agree to the restriction, you will be notified in writing. We may however terminate any restriction with or without your agreement. You will be notified that we are terminating our agreement to the restriction. Restrictions must be requested in writing and include what information you want to limit, whether you want to limit use or disclosure or both, to whom you want the restriction to apply.
2. Request an electronic copy of your PHI.
3. Inspect and obtain a copy of your PHI except for psychotherapy notes, information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding, or clinical laboratory information access to which is prohibited by law. You may be charged a reasonable fee for obtaining a copy of your records. You may also request that your PHI be sent in an electronic format to another individual.
4. Request amendment of your PHI, if you feel that your record is incorrect or incomplete. You have this right for as long as the information is maintained by MHA. Your request must be in writing with the reason(s) supporting your request and must be given to MHA’s Privacy Officer. Your request to amend your medical record may be denied if: it is not in writing; it does not include a reason to support the request; the information was not created by a provider while you received services from MHA; the information is not part of the medical record; the information is not part of the record which you would be permitted to inspect or copy; the information is accurate and complete. If your request for amendment is denied, you have the right to file a statement of disagreement that will be included with future disclosures of your PHI.
5. Obtain an accounting of disclosures of your PHI. An accounting will not include disclosures for treatment, payment and health care operations described in this Notice or disclosures made pursuant to your written authorization. To request a list of disclosures, you must submit your request in writing with the timeframe (which may not be longer than 3 years) and requested format of the list (print or electronic).
6. Request confidential communications and that we contact you about medical matters in a certain way or at a certain location.
7. Revoke your authorization to use or disclose health information except as to the extent that action has already been taken.
8. Request a paper copy of this Notice.
9. Be notified following a breach of your PHI.

REGARDING AN ELECTRONIC HEALTH INFORMATION EXCHANGE
MHA may participate in an electronic health information exchange, or HIE. New technology allows a provider or a health plan to make a single request through a health information organization, or HIO, to obtain electronic records for a specific patient from other HIE participants for purposes of treatment, payment, or health care operations. HIOs are required to use appropriate safeguards to prevent unauthorized uses and disclosures.
You have two options with respect to HIE. First, you may permit authorized individuals to access your electronic health information through an HIO. If you choose this option, you do not have to do anything.
Second, you may restrict access to all of your information through an HIO (except access by properly authorized individuals as needed to report specific information as required by law). If you want to restrict access to your records through the exchange, you must submit a request for restriction through the Kansas Health Information Exchange, Inc. Contact the KHIE Support Center at 785-783-8984 or visit www.khie.org for more information. You cannot restrict access to certain information only; your choice is to permit or restrict access to all of your information. Please be aware that the inability to access restricted information may result in a health care provider not having access to information necessary to provide appropriate care.
Even if you restrict access through an HIO, providers and health plans may share your information directly through other means (e.g., facsimile or secure e-mail) without your specific written authorization. Your information will also be available through the exchange by a properly authorized individual as necessary to report specific information to a government agency as required by law (for example, reporting of certain communicable diseases or suspected incidents of abuse).
For your protection, each request for restrictions is subject to verification procedures. Please allow sufficient time for your request to be processed. Your failure to provide all information required for verification may result in additional delay or denial of your request. If you receive health care services in a state other than Kansas, different rules may apply regarding restrictions on access to your electronic health information. Please communicate directly with your out- of-state health care provider regarding those rules.
If you have questions regarding HIE or HIOs, please visit http://www.khie.org for additional information.

HEALTH INFORMATION SECURITY

We require our employees and business associates to follow the Company’s security policies and procedures that limit access to health information about consumers to those employees and or entities that need it to perform their job responsibilities. In addition, the Association maintains physical, administrative and technical security measures to safeguard your protected health information.

​

COMPLAINTS

If you believe that your privacy rights have been violated you may file a complaint with the Secretary of Health and Human Services. You may also direct any complaints to MHA’s Privacy Officer at 555. N. Woodlawn, Suite 3105, Wichita, KS 67208. 316.685.1821. You will not be retaliated against for filing a complaint.

QUESTIONS ABOUT THIS NOTICE
If you have questions about your privacy rights as described in this Notice and/or about our responsibilities as to your health information, please contact MHA‘s Privacy Officer at the following address and/or phone number: Privacy Officer, 555 N. Woodlawn, Suite 3105,Wichita, Kansas 67208. Phone: (316) 685-1821

​

Electronic Communication Policy

​

Policy Statement:

This Privacy Policy describes the types of personal information collected by Mental Health America of South Central Kansas, Inc. (MHA) how we use such information, and to whom and under what circumstances we may disclose it.  This Privacy Policy applies to MHA’s website, and to any personal information obtained when Consumers call, email, or otherwise communicate with MHA.  By accessing the Site or otherwise interacting with us, a Consumer agrees to this Privacy Policy. We can modify this Privacy Policy at any time and will post the current version on our website. We encourage Consumers to periodically review our Privacy Policy to stay informed about how we are using the information we collect.

​

Procedure:

​

Information We Collect

For each Consumer, we may collect information such the e-mail addresses of those who send messages through our website or sign up for events on our website, the e-mail addresses of those who communicate with us via e-mail, information volunteered by a Consumer or their Guardian or caregiver (with consent).  We may collect this information and communications purposes, internal review, research, and to improve the quality of services, but personally identifiable information is not sold or rented for commercial purposes.

 

Text messaging and Email: If a user elects to use our text messaging service or email service to receive appointment reminders, welcome texts, alerts, and access to records,  MHA will obtain Consumer’s express consent to receive messages regarding appointment reminders, welcome texts, alerts, and access to records. The Consumer should give express permission before a staff sends them a text message. Consumers may give permission over text, on a form, on our website, or verbally.

If the Consumer initiates the text message or email exchange and the staff only responds with relevant information, then consent is implied, and no verbal or written permission is required.

Consumers will sign an Informed Consent at least annually indicating their preference for types of communication including text and email or no electronic communication. Texting phone numbers and email addresses will be confirmed at least annually. Communication preferences should be noted in the consumer’s chart.

​

Cookies: To help make our Site more responsive to the needs of our visitors, we invoke a standard feature found in browser software, called a "cookie", to assign each visitor a unique, random number, a sort of anonymous user ID that resides on a Consumer r computer. The cookie identifies the computer that a visitor uses to access the site but cannot access or read information from a Consumer r computer’s hard drive.  Consumers can delete or disable cookies at any time by changing the preferences in most web browsers.

 

For our internal purposes, we gather date, time, browser type, navigation history and IP address of all visitors to our site. We use this information for our internal security audit log, trend analysis and system administration, and to gather broad demographic information about our user base for aggregate use.  We collect more information with our Screening Tools, as discussed below.

​

Screening Tools

If a Consumer uses our screening tools on the site, will be linked to the Mental Health America National screening site. They will provide us and Mental Health America  National with personal information regarding their mental health conditions, such as depression or anxiety.  Voluntary demographic information, including age range, gender, race/ethnicity, household income, state, and zip code is also collected.   Mental Health America National endeavors to store screening data in a way that cannot be used to identify a Consumer.  For example, IP addresses associated with a particular screening session are protected by one-way hash so that they cannot be traced back to the original IP address.  Deidentified or aggregated data is provided to universities, health providers or others for research purposes, in all cases taking reasonable steps to ensure that such data cannot be associated with any individual.

​

Donor Information

MHA treats donor information that is collected offline in the same manner as it treats information collected online. Donor payment information may be collected through third-party processing services. MHA does NOT endorse companies, products or services and strictly prohibits the suggestion of endorsement, recommendation, or superiority of one company, product or service over another company, product, or service.

​

Other Ways We May Disclose A Consumer Information

We may also disclose information collected from and about a Consumer  as follows: (1) to other service providers for coordination of care; (2) to third parties with a Consumer r express consent ; (3) as necessary if we believe that there has been a violation of the Site Terms of Use or of our rights or the rights of any third party; (4) to respond to legal process (such as a search warrant, subpoena or court order) and provide information to law enforcement agencies or in connection with an investigation on matters related to public safety, as permitted by law, or otherwise as required by law; and (5) in the event that MHA or substantially all of its assets are acquired, a Consumer r personal information may be one of the transferred assets.

​

Links to Other Web Sites

When MHA’s site includes links to other sites, MHA does not assume any responsibility or liability for any communications or materials available at the sites to which it links, including responsibility or liability for their accuracy. No link on MHA’s site is a referral or endorsement of either the linked-to entity or any product or service.

​

Privacy Policy Changes

If our information practices change at some time in the future, we will post the policy changes to our Site to notify Consumers of these changes and may provide Consumers with the ability to opt out of these new uses. If Consumers are concerned about how their information is used, they should check back at  MHA’s site periodically.

​

Security Information

With respect to security: MHA endeavor to make sure that our Site and services provided by MHA are secure and protect personal information that we receive and implements safeguards to protect Consumer information from unauthorized access, use, and disclosure.  However, no Site or electronic communication is completely and perfectly secure, and Consumers should exercise care and judgment in ensuring that they follow good security practices, including accessing our site through a secure device and internet connection. MHA will implement reasonable security measures for electronic communication that include technical, physical, and administrative safeguards. MHA will also conduct regular testing and monitoring to ensure such controls are functioning as intended. Consumers agree to accept this risk when they give consent to received electronic communication.

Employees are to ensure email communication with consumers is encrypted by including the word “SECURE” at the beginning of the subject line. No consumer information should be exchanged over unencrypted email.

 

All sensitive information provided by individuals to MHA is considered confidential, unless otherwise noted. Information is never sold or traded. If MHA wishes to use any confidential information provided, the provider will be contacted, and a release form outlining its use will be provided. Individuals retain the right to request MHA remove their information from all mailings, both online and on paper at any time, and MHA will endeavor to remove the information in a reasonable manner, but delays between any such request and the discontinuation of related mailings can occur.

​

Consumer Options Concerning Personal Information

We provide all Consumers with the ability to make certain requests regarding their personal information.  For example, Consumers can request:

• information regarding the categories and specific information we have collected about them.

• correction of information we have about a Consumer that is incorrect; and

• deletion of information we have collected about a Consumer unless required in the health record.

Consumer exercise of these rights will have no adverse effect on the price and quality of MHA’s services. When Consumers exercise these rights and submit a request, MHA may verify their identity by asking for Consumer’s email address, telephone number, or other information. 

 

Opt-Out for Electronic Communication:   Expressed consent for electronic communication can be revoked at any point by signing a new Informed Consent and indicating the change in communication preferences.

 

To make any of these requests, please contact us as described below, under Contact Us.

​

Site Visitors from Outside the United States—Cross-Border Transfer

If a Consumer is visiting the site from outside the United States, their information may be transferred to, stored, and processed in the United States or other countries in accordance with this Privacy Policy.  The data protection and other applicable laws of the United States or other countries may not be as comprehensive as those laws or regulations in the Consumer’s country or may otherwise differ from the data protection or consumer protection laws in a Consumer’s country. Consumer information may be available to government authorities under lawful orders and law applicable in such jurisdictions. By using the site and/or providing personal information to us, Consumers consent to transfer of information to our facilities as described in this Privacy Policy.

 

Contact Us

If a Consumer has questions or concerns about this Privacy Policy or how MHA collects and uses personal information, they can contact us:

 

Email: info@mhasck.org

​

Telephone: 316-685-1821

 

• Obtain a Consumer’s implied consent to conversational messaging. If the Consumer initiates the text message exchange and the staff only responds with relevant information, then consent is implied, and no verbal or written permission is required.

• Obtain a Consumer’s express written consent to receive messages regarding appointment reminders, welcome texts, alerts, and access to records. The Consumer should give express permission before a staff sends them a text message. Consumers may give permission over text, on a form, on a website, or verbally.

Consumers will sign an Informed Consent at least annually indicating their preference for types of communication including text and email or no electronic communication. Texting phone numbers and email addresses will be confirmed at least annually. Communication preferences should be noted in the consumer’s chart.

These consents will be obtained prior to sending any electronic messaging.

 

PRIVACY AND SECURITY

MHA will not use opt-in lists that have been rented, sold, or shared to send messages. Message Senders should create and vet their own opt-in lists.

​

References:

Telephone Consumer Protection Act (TCPA)

Controlling the Assault of Non solicited Pornography and Marketing Act of 2003 (CAN-SPAM Act).