NOTICE OF PRIVACY PRACTICES

Effective date July 1, 2023

This notice describes how medical information about you may be used and disclosed and how you can get access to this information.

Please review it carefully.

Contact Our Privacy Officer at 316-744-2020.

WHY WE ARE PROVIDING THIS NOTICE:

St. Veronica Senior Behavioral Health Hospital at Catholic Care Center (SVSBH) compiles information relating to you and the treatment and services you receive. This information is called protected health information (PHI) and is maintained in a designated record set. We may use and disclose this information in various ways. Sometimes your agreement or authorization is necessary for us to use or disclose your information and sometimes it is not. This Notice describes how we use and disclose your protected health information and your rights. We are required by law to give you this Notice, and we are required to follow it. We may change this Notice at any time if the law changes or when our policies change.

USES AND DISCLOSURES OF YOUR HEALTH INFORMATION THAT MAY BE MADE WITHOUT YOUR AUTHORIZATION:

1. For Your Treatment. We may share your protected health information with other treatment providers. For example, information regarding your mental health may be shared with your primary care physician.

2. For Payment. We may share your protected health information with anyone who may pay for your treatment. For example, we may need to obtain a pre-authorization for treatment or send your health information to an insurance company so it may pay for treatment. However, if you pay out of pocket in full for your treatment and make a specific request that we not send information to your insurance company for that treatment, we will not send that information to your insurer except under certain circumstances.

3. For Our Healthcare Operations. We may use and disclose your protected health information when it is necessary for us to function as a business. For example, when we contract with other businesses to do specific tasks for us, we may share your protected health information related to those tasks. When we do this, the business agrees in the contract to protect your health information and use and disclose such health information only to the extent SVSBH would be able to do so. These businesses are called Business Associates. Another example is if we want to see how well our staff is doing, we may use your protected health information to review their performance.

4. For Appointment Reminders. We may use your protected health information to remind you of appointments, including leaving a voicemail message.

5. For Surveys. We may use and disclose your protected health information to contact you to assess your satisfaction with our services.

6. For Providing Your Information on Treatment Alternatives or Other Services. We may use and disclose protected health information to tell you about or recommend possible treatment options or alternatives that may be of interest to you. We may also use and disclose protected health information to tell you about health-

related benefits or services that may be of interest to you. In some cases the facility may receive payment for these activities. We will give you the opportunity to let us know if you no longer wish to receive this type of information.

7. To Discuss Your Treatment with Other People Who Are Involved with Your Care. We may disclose your health information to a friend or family member who is involved in your care. We may also disclose your health information to an organization assisting in a disaster relief effort so that your family can be notified about your condition, status, and location.

8. Research. Under certain circumstances, we may use and disclose your protected health information for medical research. All research projects, however, are subject to a special approval process. Before we use or disclose your health information for research, the project will have been approved.

9. As Required By Law. We will disclose your protected health information when the law requires us to do so.

10. To Avert a Serious Threat to Health or Safety. We may use and disclose your protected health information when necessary to prevent a serious threat to your health and safety or the health and safety of another person.

11. Organ and Tissue Donation. We may use or disclose your protected health information to an organ donation bank or to other organizations that handle organ procurement to assist with organ or tissue donation and transplantation.

12. Military and Veterans. The protected health information of members of the United States Armed Forces and members of a foreign military

authority may be disclosed as required by military command authorities.

13. Employers. We may disclose your protected health information to your employer if we provide you with health care services at your employer’s request and the services are related to an evaluation for medical surveillance of the workplace or to evaluate whether you have a work-related illness or injury. We will tell you when we make this type of disclosure.

14. Workers’ Compensation. We may release your protected health information for workers’ compensation or similar programs providing you benefits for work-related injuries or illness.

15. Public Health Risks. We may disclose your protected health information for public health activities which include the prevention or control of disease, injury or disability; to report births and deaths; to report child abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls of devices or products; to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; or to notify the appropriate government authority if we believe you have been the victim of abuse, neglect or domestic violence. If you agree, we can provide immunization information to schools.

16. Health Oversight Activities. We may disclose your protected health information to a health oversight agency for activities authorized by law. These activities are necessary for the government to monitor the health care system, government programs, and civil rights laws.

17. Legal Proceedings. We may disclose your protected health information when we receive a court or administrative order. We may also disclose your protected health information if we get a subpoena,

or another type of discovery request. If there is no court order or judicial subpoena, the attorneys must make an effort to tell you about the request for your protected health information.

18. Law Enforcement. When a law enforcement official requests your protected health information, it may be disclosed in response to a court order, subpoena, warrant, summons, or similar process. It may also be disclosed to help law enforcement identify or locate a suspect, fugitive, material witness, or missing person. We may also disclose protected health information about the victim of a crime; about a death we believe may be the result of criminal conduct; about criminal conduct at SVSBH; or in an emergency to report a crime, the location of the crime, victims of the crime, or to identify the person who committed the crime.

19. Coroners, Medical Examiners, and Funeral Directors. We may disclose your protected health information to a coroner, medical examiner, or a funeral director.

20.National Security and Intelligence Activities. When authorized by law, we may disclose your protected health information to federal officials for intelligence, counterintelligence, and other national security activities.

21. Protective Services for the President and Others. We may disclose your protected health information to certain federal officials so they may provide protection to the President, other persons, or foreign heads of state, or to conduct special investigations.

22. Inmates or Persons in Custody. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your protected health information to the correctional institution or a law enforcement official when it is necessary for the institution to provide you with health care; when it is necessary to

protect your health and safety or the health and safety of others; or when it is necessary for the safety and security of the correctional institution.

23. Fundraising. We may send you information as part of our fundraising activities. You have the right to opt out of receiving this type of communication.

OTHER USES AND DISCLOSURES:

1. Most uses and disclosures of psychotherapy notes, uses and disclosures for marketing purposes, and uses and disclosures that constitute a sale of protected health information require your authorization. HIPAA has a specific and narrow definition for “psychotherapy notes,” and mental health records generally are not included. SVSBH does not have protected health information that meets HIPAA’s definition of psychotherapy notes. Your authorization is necessary for a provider to disclose psychotherapy notes.

2. There are some circumstances when we directly or indirectly receive a financial (e.g., monetary payment) or non-financial (e.g., in-kind item or service) benefit from a use or disclosure of your protected health information. Your authorization is necessary for us to sell your protected health information. Your authorization is also necessary for some marketing uses of your protected health information.

3. Other uses and disclosures of your protected health information not covered by this Notice or the laws that apply to us will be made only with your written authorization. You may revoke your authorization in writing at any time, provided you notify us. If you revoke your authorization, it will not take back any disclosures we have already made.

YOUR HEALTH INFORMATION RIGHTS:

1. Right to Access. You have the right to access, or to inspect and obtain a copy of your protected health information. To exercise this right, you should contact the Privacy Officer because you must complete a specific form so we have the information we need to process your request. You may request that your records be provided in an electronic format and we can work together to agree on an appropriate electronic format. Or you can receive your records in a paper copy. You may also direct that your protected health information be sent in electronic format to another individual. You may be charged a reasonable fee for access. We can refuse access under certain circumstances. If we refuse access, we will tell you in writing and in some circumstances you may ask that a neutral person review the refusal.

2. Right to Amend Your Records. If you feel that your protected health information is incorrect or incomplete, you may ask that we amend your health records. To exercise this right, you must contact the Privacy Officer to complete a specific form stating your reason for the request and other information that we need to process your request. We can refuse your request if we did not create the information, if the information is not part of the information we maintain, if the information is part of information that you were denied access to, or if the information is accurate and complete as written. You will be notified in writing if your request is refused and you will be provided an opportunity to have your request included in your protected health information.

3. Right to an Accounting. You have a right to an accounting of disclosures of your protected health information that is maintained in a designated record set. This is a list of persons, government agencies, or businesses who have obtained your health information. To exercise this right, you should contact the Privacy Officer because you must complete a specific form to provide us with the information

that we need to process your request. There are specific time limits on such requests. You have the right to one accounting per year at no cost.

4. Right to a Restriction. You have the right to ask us to restrict disclosures of your protected health information. To exercise this right, you should contact the Privacy Officer because you must complete a specific form to provide us with the information that we need to process your request. If you self-pay for a service and do not want your health information to go to a third party payer, we will not send the information, unless it has already been sent or there is another specific reason we cannot accept your request. For example, if your treatment is a bundled service and cannot be unbundled and you do not wish to pay for the entire bundle, or the law requires us to bill the third party payer (e.g., a governmental payer), we cannot accept your request. We do not have to agree to any other restriction. If we have previously agreed to another type of restriction, we may end that restriction. If we end a restriction, we will inform you in writing.

5. Right to Communication Accommodation. You have the right to request that we communicate with you in a certain way or at a specific location. To exercise this right, you should contact the Privacy Officer because you must complete a specific form to provide us the information that we need to process your request.

6. Breach Notification. You have the right to be notified if we determine that there has been a breach of your protected health information.

7. Right to Obtain the Notice of Privacy Practices. You have the right to have a paper copy of this Notice. You may request a copy from the Privacy Officer or you may go to our website at https://www.catholiccarecenter.org/.

8. Right to File a Complaint. If you believe your privacy rights as described in this Notice have been violated, you may file a written complaint with our Privacy Officer or with the U.S. Department of Health and Human Services – Office for Civil Rights (Regional Office at Kansas City), 601 East 12th Street Room 248, Kansas City MO 64106, 816.426.7277, or through https://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html. You will not be penalized for filing a complaint.

CHANGES TO THIS NOTICE: We reserve the right to change this Notice at any time. We reserve the right to make the revised Notice effective for protected health information that we currently maintain in our possession, as well as for any protected health information we receive, use, or disclose in the future. A current copy of the Notice will be posted in our facility.