In regard to health care operations, we may use and disclose your PHI without your authorization when the release is necessary to run our organization and make sure that our consumers receive quality care. These activities may include quality assessment and improvement, reviewing the performance or qualifications of our clinicians, training students, in clinical activities, licensing, accreditation, business planning and development, general administrative activities. We may combine PHI of many of our clients to decide what additional services we should offer, what services are no longer needed and whether certain treatments are effective. We may also provide your PHI to other health care providers or to your health plan to assists them in performing certain functions of their own health care operations. We will do so only if you have or have had a relationship with the other provider or health plan.

We may also use and disclose your PHI to tell you about health-related benefits or services that may be of interest to you. If you do not want us to provide you with this information, you must notify the Privacy Officer in writing at 125 S 3rd Street, Suite 200, Ames, Iowa 50010. Please state clearly that you do not want to receive materials about health-related benefits or services.

In certain circumstances, your PHI may be released without your consent when the release is not related to TPO. These releases are approved by the laws of Iowa and are listed below.

1. Emergencies: We may provide PHI in an emergency situation. For example, your PHI may be disclosed to a paramedic who is transporting you in an ambulance. This information may also be released to any clinician required by law to treat you when you are unable to give an authorization.
2. As required by law: We will disclose PHI when required to do so by federal law.
3. To Avert a Serious Threat to Health and Safety: We may use and disclose your PHI when necessary to prevent a serious and imminent threat to your health or safety of the public or another person. Under these circumstances we will only disclose your PHI to someone who is able to help prevent or lessen the threat.
4. Public Health Activities: We may disclose your PHI as necessary for public health activities. Some examples of this type of disclosure are listed below.
   • report to public health authorities for the purpose of preventing or controlling disease, injury or disability
   • report vital events such as death to appropriate state and federal agencies
   • conduct public health surveillance or investigations
   • report certain events to the Food and Drug Administration (FDA) about defective products or problems wit medications
   • notify consumers about FDA initial recalls
   • notify a person who may have been exposed to a communicable disease or who is at risk of contracting or spreading certain diseases
   • notify the appropriate agency if we believe you have been a victim of abuse, neglect or domestic violence if we are required by law to report such belief
5. Health Oversight Activities: We may provide PHI for activities authorized by law. Oversight agencies include government agencies that oversee the health care system, government benefits programs such as Medicare and Medicaid, and other government programs regulating health care and civil rights laws.
6. Disclosures in Legal Proceedings: If a judge or administrative agency orders us to disclose your PHI we may do so without your permission. This information may also be disclosed in response to a formal subpoena recognized by the proper court authorities. Mental health information may also be disclosed as outlined in Iowa Code 228.6 (compulsory disclosures).
7. Law Enforcement Activities: The following disclosures are allowed for purposes of enforcement.
   • A court order, subpoena, warrant, summons or similar process requiring disclosure
   • We report criminal conduct occurring on the premises of our facility
   • We determine that the purpose is to respond to a threat of imminent danger to you or another person
   • The disclosure is otherwise required by law
8. Medical Examiners: We may provide your PHI to a medical examiner as needed to identify a deceased person or determine the cause of death. Usually this disclosure would only occur as the result of a court request.
9. National Security and Protective Services for the President and others: We may be required by federal law to disclose your PHI for matters of intelligence, counter-intelligence or other national security activities. We may also disclose your PHI to authorized federal officials so they may provide protection to the President; other authorized persons or foreign heads of state or so they may conduct special investigations ordered by law.

Your Rights Regarding Your Protected Health Information
You have many rights related to your PHI. Listed below you will find these rights and the methods to assert your rights.

Rights to Inspect and Copy: You have the right to request an opportunity to inspect or copy your PHI used to make decisions about your care-whether they are decisions about your treatment or payment of your care. Usually, this would include clinical and billing records, but not the private psychotherapy notes your provider may use. You must submit your request in writing to our Privacy Officer at 125 S. 3rd Street, Suite 200, Ames, IA 50010. If you request a copy of the information, we may charge a reasonable fee for the cost of copying, mailing and supplies associated with your request. You have the right to request the amount of the fee prior to any information being compiled. We may deny your request to inspect or copy your PHI in certain limited circumstances. In some cases, you will have the right to have the denial reviewed by a licensed health care professional not directly involved in the original decision to deny access. We will inform you in writing if the denial of your request may be reviewed. Once the review is completed, we will honor the decision made by the licensed health care professional reviewer.

Right to Amend: For as long as we keep records about you, you will have the right to request us to amend any PHI used to make decisions about your care-whether they are decisions about your treatment or payment of your care. Usually this would include clinical and billing records but not the private psychotherapy notes your provider may use. The Center will maintain full clinical records for six years unless you were a minor at the time of treatment: those records will be retained for six years past your eighteenth birthday. Billing records will be retained for a minimum of 12 months after the date of service. To request an amendment, you must submit a written document to our Privacy Officer at 125 S. 3rd Street, Ames, IA 50010 and tell us why you believe the information is incorrect or inaccurate. We may also deny your request if you ask us to amend PHI which meets any of the following:

• was not created by us, unless the person or entity that created the PHI is no longer available to make the amendment
• is not part of the PHI we maintain to make decisions about your care
• is not part of the PHI that would be permitted to inspect or copy
• is accurate and complete

Right to an Accounting of Disclosures: You have the right to request that we provide you with an accounting of disclosures we have made of you PHI. An accounting is a list of disclosures. But this list will not include certain disclosures of your PHI such as those we made for the purposes of treatment, payment and health care operations (TPO). To request an accounting of disclosures, you must submit your request in writing to the Privacy Officer at 125 S. 3rd Street, Ames, IA 50010. For your convenience, you may submit your request on a form called a "Request for Accounting", which you may obtain from our Privacy Officer. The request should state the time period for which you wish to receive an accounting. This time period should be no longer then six years and not include dates before April 14, 2003. The first accounting you request within a twelve month period will be free. For additional requests during the same 12-month period, we will charge you for the cost of providing and accounting. We will notify you of the amount we will charge and you may choose to withdraw or modify your request before we begin the accounting.

Rights to Request Restriction: You have the right to request a restriction on the PHI we use or disclose about you for treatment, payment or health care operations. To request a restriction, you must request the restriction in writing addressed to the Privacy Officer at 125 S. 3rd Street, Ames, IA 50010. The Privacy Officer will ask you to sign a "Request for Restriction" form, which you should complete and return to the Privacy Officer. We are not required to agree to a restriction that you may request. If we do agree, we will honor your request unless the restricted health information is needed to provide you with emergency treatment.

Right to request Confidential Communications: You have the right to request that we communicate with you about your health care only in certain location or through a certain method. For example, you may request that we only contact you at work or that we do not identify ourselves to co-workers. To request such a confidential communication, you must make your request in writing in writing to the Privacy Officer at 125 S. 3rd Street, Ames, IA 50010. We will accommodate all reasonable requests. You do not need to give us a reason for the request; but your request must specify how or where you wish to be contacted.

Right to Paper Copy of the Notice: You have the right to obtain a paper copy of this notice at any time. To obtain a paper copy, simply request one at the front desk. You may also phone in a request to 515-232-5811 or mail a request to the Privacy Officer at 125 S. 3rd Street, Ames, IA 50010.

Additional Information Regarding Your PHI and the Richmond Center
Changes to this notice: We reserve the right to change the terms of our Notice of Privacy Practices. We also reserve the right to make the revised or changed Notice of Privacy Practices effective for all PHI we already have about you as well as any PHI we receive in the future. We will post a copy of the current Notice of Privacy Practices at our main office and at each site where we provide care. You may also obtain a copy of the current Notice of Privacy Practices by accessing our website at www.richmondcenter.net or by calling us at 515-232-5811 and requesting that a copy be sent to you in the mail or by asking for one any time you are at our office.

All of the organizations that The Richmond center does business with for any reason other than treatment, payment or operations and that may have access to PHI are required to sign an agreement to comply with our privacy practices. An example of this would be the accounting firm, which conducts our annual audit.