THE MARSH FOUNDATION

NOTICE REGARDING THE USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION Effective April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Protected Health Information (PHI) is any individually identifiable information relating to the past, present or future physical or mental health or condition of an individual, provision of health care to an individual, or the past, present or future payment for health care provided to an individual. The information can be spoken, written, or electronically recorded and is created by or given to anyone providing care to you; a health plan; a public health authority; your employer; your insurance company; your school or university; or anyone who processes health information about you.

• The right to request access to inspect and copy your PHI. You may make a written request to inspect and copy your PHI that is contained in a designated record set as long as The Marsh Foundation maintains the PHI. Exceptions to this information are psychotherapy notes, information prepared in reasonable anticipation of or use in, a civil, criminal, or administrative action or proceeding, and PHI that is subject to law that prohibits access to PHI.

• The right to request a restriction on certain uses/disclosures of your PHI. You may make a written request that The Marsh Foundation restrict uses or disclosures of any part of your PHI for the purpose of treatment, payment, or healthcare operations. You may also request that any part of your PHI not be disclosed to any family member or friend who may be involved in your treatment. The Marsh Foundation is not required to agree to the restriction. If The Marsh Foundation does agree, we must follow your restrictions unless it is needed to provide emergency treatment.

• The right to request to receive confidential communications of your PHI by alternative means or alternative locations. The Marsh Foundation will accommodate your reasonable request. The Marsh Foundation may condition the request on information as to how payment will be handled and specifications of an alternate address or method of contact. The Marsh Foundation will not require from you the basis for the request.

• The right to request amendment to your PHI. You may make a written request for amendment of your PHI that is contained in a designated record set as long as The Marsh Foundation maintains the PHI. The request must also provide reason/support for the amendment. If the request is accepted, The Marsh Foundation will make the amendment by, at a minimum, identifying the affected records and append the amended statement to the record and when the original statement is used or disclosed, the amended statement will accompany any released copies. The amendment request may be denied in certain cases. If the request is denied, in whole or part, you have the right to file a disagreement with us and The Marsh Foundation may make a rebuttal to your disagreement. We will send you a copy of any such rebuttal.

• The right to receive an accounting of certain disclosures that we have made of your PHI. This right applies to disclosures that occurred on or after April 14, 2003 for purposes other than treatment, payment, or healthcare operations as described in this Notice of Privacy Practices. Exclusions to this request are disclosures The Marsh Foundation has made to you, to family members or friends involved in your treatment, or for notification purposes. If you request a copy of the information, The Marsh Foundation may charge a reasonable fee for the costs of copying, mailing or other supplies associated with your request. The right to receive this accounting of disclosures is subject to certain exceptions, restrictions, and limitations.

• The right to obtain a paper copy of this notice. You have the right to request and receive a paper copy of the Notice of Privacy Practices even if you have agreed to accept this notice electronically. A current copy of the Notice of Privacy Practices can be requested by contacting The Marsh Foundation office of the Administrative Assistant and Client Rights Officer or retrieved from our website: www.marshfoundation.org

Statement of Uses and Disclosures of Protected Health Information with consent:

• Prior to you receiving services from The Marsh Foundation, you will be asked to sign a Consent to Treatment and Confidentiality form. Upon signing the consent form, your PHI may then be used for your treatment, payment, and healthcare operations performed by The Marsh Foundation as described in this section. Your PHI may be used or disclosed by your counselor, other treatment staff, administrative staff, Marsh Foundation volunteers and others outside of our administrative staff that are involved in your treatment for the purpose of providing health care services to you. Your PHI may also be used and disclosed for payments of your health care bills and to support the operation of The Marsh Foundation. Following are examples that describe the types of uses and disclosures The Marsh Foundation may make once you sign the Consent to Treatment and Confidentiality form. These examples are not meant to be exhaustive. When using or disclosing PHI or when requesting PHI from another agency, The Marsh Foundation Child and Family Services will make reasonable efforts to limit the PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

• The Marsh Foundation may disclose your PHI with other Marsh Foundation personnel, such as, but not limited to, counselors and consultants who are involved in providing you treatment. Treatment team meetings may be held to discuss and communicate agreement of your treatment and services.

• Marsh Foundation employees or volunteers may share your PHI for the purpose of enrolling you in the school located on The Marsh Foundation campus or in the school that best accommodates your needs.

• The Marsh Foundation may also share your PHI with outside specialists and their offices including but not limited to medical doctors, pharmacists, and dentists so that you can receive the most appropriate and effective treatment. For example, you aren’t feeling well and a Marsh Foundation employee or volunteer takes you to a medical doctor. That doctor then diagnoses and treats your health problem with a prescription.

• We may share information about when and for what purpose you were seen, so that we can be paid for treating you. This may include certain activities your health insurance plan may require before it approves or pays for the services we recommend for you. For example, but not limited to, determination of eligibility, pre-certification procedures, and review of services for medical necessities. We send claims to your insurance company stating when and which services you received at The Marsh Foundation. They then send us money to help cover the costs for those services.

• We may share your PHI with a third party “business associate” to help collect monies due The Marsh Foundation. For example, if a paying source has not paid for services, as contractually agreed upon, then we will contact a collection agency for the purpose of collecting those monies due The Marsh Foundation for the services provided to you.

• The Marsh Foundation may contact you regarding appointment reminders, information about treatment alternatives or other health benefits that may be of interest to you.

• The Marsh Foundation may use or disclose, as-needed, your PHI with third party “business associates” that perform various activities to support the agency’s business activities. These activities include, but are not limited to, quality assurance activities, licensing, medical necessities review, medical consultation from a nurse, and conducting or arranging for other agency activities.

• The Marsh Foundation may also use or disclose your PHI for newsletters or fundraising. For example, your name and address may be used to send you a newsletter about The Marsh Foundation or alumni events such as reunions. You may contact our Client Rights Officer to request that these mailings not be sent to you.

• You may revoke your consent, in writing, at any time by sending it to The Marsh Foundation office of the Administrative Assistant and Client Rights Officer so that we can stop using and disclosing your PHI. The Marsh Foundation is permitted to use and disclose your PHI based on your consent until we receive your revocation in writing. If you revoke your consent, The Marsh Foundation reserves the right to refuse to provide further treatment to you, on the basis of your refusal to allow us to share your information for purposes of treatment, payment, and healthcare operations.

Authorization to disclose your Protected Health Information for other purposes:

• Other uses or disclosures of your PHI will be made only with your written authorization unless otherwise permitted or required by law as described below. You can revoke your authorization, in writing, at any time by sending it to The Marsh Foundation office of the Administrative Assistant and Client Rights Officer so that we can stop sharing your PHI. We are permitted to share your PHI based on your authorization until The Marsh Foundation receives the revocation in writing. The Marsh Foundation is unable to take back any disclosures we have already made with your permission, and The Marsh Foundation is required to retain its records of the services that we provided to you.

Other permitted and required uses and disclosures that may be made without your written consent or authorization with opportunity to agree or object:

• The Marsh Foundation may use and disclose your PHI in the following instances. You have the opportunity to agree or object to the use or disclosure of all or part of your PHI.

• With those involved in your health care or for notification purposes. Unless you object, we may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person’s involvement with or payment related to your health care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in our best interest based on our professional judgment. We may use or disclose your PHI to notify or assist in the notification of a family member, personal representative, or another person responsible for your care of your location, general condition, or death.

• In an emergency situation. The Marsh Foundation may use or disclose your PHI for emergency situations. The Marsh Foundation may, through use of professional judgment, determine whether disclosure is in the best interest of you and, if so, disclose only your PHI that is directly relevant to your emergency treatment. If this emergency situation happens, The Marsh Foundation employee or volunteer will try to notify you and obtain your consent as soon as reasonably practicable after delivery of emergency treatment.

• Communication barriers. The Marsh Foundation may use or disclose your PHI if we attempt to obtain consent, but are unable to do so because of substantial barriers to communication, and we determine, through use of professional judgment, that you intend to consent to use or disclosure under the circumstances.

Sharing of protected health information for which your consent, authorization, or opportunity to agree or object is not required:

Your PHI may be shared without your prior consent or authorization for the following situations:

• Health Oversight Activities. The Marsh Foundation may disclose your PHI to a health oversight agency for oversight activities authorized by law such as audits; civil, administrative, or criminal investigations, proceedings, or actions; inspections; licensure or disciplinary actions. This information can be given to oversight agencies such as government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.

• Public Health Activities. The Marsh Foundation may disclose your PHI for public health activities and purposes to a public health authority authorized by law. Your PHI will be disclosed for the purpose of preventing, controlling, or reporting disease, injury, or disability. We may also disclose PHI for public health activities and purposes to a public health authority or other government authority authorized by law to receive reports of child abuse or neglect.

• Required by Law. The Marsh Foundation may use or disclose your PHI to the extent that the use or disclosure is required by law. The use or disclosure will comply with the law and is limited to the relevant requirements of such law. You will be notified, as required by law, of any such uses or disclosures.

• Relating to Abuse and Neglect. The Marsh Foundation may use or disclose your PHI to a governmental authority, authorized to receive such reports, if we believe you to be a victim of abuse, neglect, or domestic violence to the extent that is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. You will be notified, as required by law, of any such uses or disclosures.

• For Judicial and Administrative Proceedings. The Marsh Foundation may use or disclose your PHI in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), or in response to a subpoena, discovery request or other lawful process.

• For Law Enforcement Purposes. The Marsh Foundation may disclose your PHI to law enforcement officials for the following purposes; legal processes and otherwise required by law, limited information for identification and location purposes, pertaining to victims of crime, suspicion of a death resulted from criminal conduct, in the event a crime has been committed on the premises of The Marsh Foundation or a volunteer’s premises, and reporting a crime that has occurred in an off-site emergency.

• To Avert a Serious Threat to Health or Safety. The Marsh Foundation may, consistent with applicable law and standards of ethical conduct, use or disclose your PHI if we, in good faith, believe the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. The Marsh Foundation may also disclose PHI when necessary for law enforcement authorities to identify or apprehend an individual.

• For Research Purposes. The Marsh Foundation may disclose your PHI to researchers when their research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of the PHI.

• Uses and Disclosures Regarding Decedents. The Marsh Foundation may disclose your PHI to a coroner or medical examiner to identify a deceased person. We may also disclose your PHI to funeral directors, consistent with applicable law, as necessary to carry out their duties.

• For Organ Donation. The Marsh Foundation may disclose your PHI for the purpose of cadaveric organ, eye, or tissue donation.

• For Specialized Government Functions. The Marsh Foundation may disclose your PHI for military and veterans activities, national security and intelligence activities, and protective services for the President and other federal officials according to specific requirements.

• For Workers’ Compensation. The Marsh Foundation may disclose your PHI, as authorized by and to the extent necessary, to comply with laws relating to workers’ compensation or other similar programs.

Requirements of The Marsh Foundation in regards to the use and disclosure of your Protected Health Information:

• The Marsh Foundation is required by law to maintain the privacy of your PHI and provide you with notice of its legal duties and privacy policies with respect to PHI;

• The Marsh Foundation is required to abide by the terms of the notice currently in effect; and

• The Marsh Foundation reserves the right to change terms of this notice and to make new notice provisions effective for all PHI that it maintains. The revised notice will be given to new clients and to existing clients by request made through the office of the Administrative Assistant and Client Rights Officer. The revised notice will be posted in clear and prominent locations where clients seeking services are able to read it.

Questions or complaints regarding the use and disclosure of your protected health information:

• You may file a complaint to The Marsh Foundation Child and Family Services and to the Secretary of Health and Human Services about privacy rights violations. The Marsh Foundation may not retaliate against you for filing such a compliant. For further information or to file a complaint regarding your PHI privacy contact:

phone: (419) 238-1695 fax: (419) 238-1747 e-mail: marshfound@earthlink.net Website: www.marshfoundation.org