THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW CAREFULLY. EFFECTIVE JULY 1, 2019, AND SUPERSEDES EARLIER VERSIONS.
Kennedy Krieger Institute is committed to the privacy and confidentiality of your medical information. We are required by law to maintain the privacy of your protected health information (PHI), provide you with notice of our legal duties and privacy practices with respect to your PHI, and notify you if there is a breach of your PHI. This notice tells you what we may do with your PHI. PHI includes information that identifies you and tells about your past, present or future physical or mental health or condition, and related healthcare services, including your billing records. PHI includes your health information created or received by us.
We may use or disclose your PHI only as explained in this notice. Other uses and disclosures not described in this notice will be made only with your written authorization. In this notice, “you” refers to the subject of the health information. For minor patients (children), the patient’s personal representative has the right to exercise the rights explained in the notice. A personal representative is someone who is authorized to act on behalf of the patient, such as a parent or guardian.
This notice describes how we may use and disclose your PHI for treatment, payment (i.e., billing for services) or healthcare operations. This notice also describes when we may use or disclose your PHI when you do not object, as allowed by your written permission, and as allowed without your permission.
You may ask for a paper copy of this notice either today or at the time of your next appointment, or by contacting the Kennedy Krieger Institute privacy officer, as explained at the end of this notice.
We will do what we say in this notice. We may change our privacy practices as needed and as legally permitted. If we do change our practices, a new notice will reflect those changes and will be effective for all PHI that we have.
Kennedy Krieger Institute’s Notice of Privacy Practices covers the following organizations, all of which are part of Kennedy Krieger Institute:
- Kennedy Krieger Institute, Inc.
- Kennedy Krieger Associates, Inc.
- Kennedy Krieger Children’s Hospital, Inc.
- Kennedy Krieger Education & Community Services, Inc.
- PACT: Helping Children With Special Needs, Inc.
- Hugo W. Moser Research Institute at Kennedy Krieger, Inc.
Kennedy Krieger Institute may, without your authorization, use and disclose your PHI to provide treatment, obtain payment and support its healthcare operations.
Federal privacy regulations and state law give you privacy rights.
- You have the right to ask us to restrict how we use or disclose your PHI for treatment, billing for services, or healthcare operations. However, we are not allowed to withhold your PHI when we are required by law to disclose it. In an emergency, we are allowed to use or disclose your PHI to treat you. To request a restriction, please make your request to the registration staff. They will help you write your request. We may either agree to your request or turn down your request. If we agree to your request, we are allowed to end the restriction once we tell you that we will end it. If we end the restriction, it will only affect PHI that is created or received after we notify you. If you pay for services out of pocket and in full, we must comply with your request not to disclose PHI concerning those services to your health plan.
- You have the right to ask that we communicate with you in another way or at another location. You need to provide details about how we may contact you. We will not require you to explain why you prefer this means of communication. If we cannot contact you using the information you provide, we may contact you using any other information on file. We will honor reasonable requests. However, we require an accurate billing address.
- You have the right to see and receive copies of your PHI. Except for some types of PHI, such as psychotherapy notes and PHI from research projects while they are in progress, you have the right to see and receive a copy of your PHI in your medical and billing records in the form and format requested by you, if possible, and we must agree to your request for an electronic copy. We may charge you a reasonable fee for copying your records. We may deny access if your record relates to a mental health problem and we believe such access may endanger you. You may request that we designate a licensed healthcare professional to review the denial.
- You have the right to ask us to amend your PHI in the medical and billing records. If we accept your request, we will tell you so, and we will amend our records. (We do not change what is in the record. We add the amended information.) With your assistance, we will notify others who have the prior PHI. If we deny your request, we will provide a written explanation of why we did not make the amendment and explain your rights. We may deny your request if the PHI was not created by us, is not part of the medical and billing records, or is not available for inspection, or if we determine that the existing PHI is accurate and complete.
- You have the right to receive an accounting of disclosures of your PHI made by us since April 14, 2003. The accounting will not include disclosures made:
- To carry out treatment, billing for services, and healthcare operations.
- To you or your personal representative.
- To parties you authorize to receive your PHI or information given as permitted through our patient directory.
- To your family members or friends who are involved in your care.
- For national security or intelligence purposes.
- To correctional institutions or law enforcement officials. For your protection, we may check your identity prior to responding to any questions you may have about your treatment or payment activities. We will check your identity whenever we get requests to look at, copy or amend your records, or to obtain a list of disclosures of your PHI. Forms for each of these requests are available from our Health Information Management Department.
Under the following circumstances, federal privacy regulations and state law allow us to use or disclose your PHI, but you will have the opportunity to agree or say “no” before such uses or disclosures:
- To a family member (or any other person identified by you) as needed for your care or payment for your healthcare. (If you agree or do not say “no,” your caregivers may use your PHI to do this.)
- To locate a family member (or other person responsible for your care) and notify them of your location, general condition or death. This disclosure may be to a disaster relief agency. (If you agree or do not say “no,” your caregivers may use your PHI to do this.)
If you wish to refuse these uses and disclosures, you may do so by telling your caregivers.
Because we are permitted to maintain a list of patients and their general condition, and because we disclose a patient’s general condition if a member of the public asks for a patient by name, unless you tell us we are not permitted to do so, your location and general condition may be given to anyone who asks for you by name.
Federal regulations allow Kennedy Krieger Institute to use and disclose PHI for research under specific rules:
Kennedy Krieger Institute participates in research studies. When possible, we will obtain your written permission to use or disclose your PHI for research. Federal law also allows us to seek permission to use your PHI for research from either an institutional review board or a privacy board under certain conditions. Federal law also allows researchers to look at your PHI when preparing research studies or doing research on those who have died. Federal law requires researchers to agree to protect the privacy of your health information in all cases.
Federal privacy regulations and state law allow us to use or disclose your PHI with your written permission:
Uses and disclosures not otherwise allowed under federal privacy regulations and state law require your written permission.
Your written permission is needed if you want Kennedy Krieger Institute to make a disclosure of PHI that is not allowed without your permission. For example, you may want your lawyer to have a copy of your medical records. You must give your written permission before we may send your PHI to your lawyer.
Your written permission is also needed if we want to use or disclose your PHI for some reason not allowed without your permission. For example, we may ask for your permission to use PHI concerning your diagnosis or treatment to contact you (i) for marketing purposes, (ii) if we were to make a disclosure that constitutes a sale of your PHI, or (iii) about making a charitable contribution to support research or programs at Kennedy Krieger Institute. If you give your written permission, we may then use this PHI to contact you. If we send you fundraising communications, you will have the right to opt out of such fundraising communications with each such communication. For another example, we may ask for your permission to use your PHI in a magazine article about a particular disease or about Kennedy Krieger Institute patients or physicians. If you give your written permission, we may then disclose the PHI you have permitted us to share. If you do give your permission, you may cancel or revoke it at any time. However, uses and disclosures made before your revocation or cancellation are not affected by your action. If your cancellation relates to research, researchers are allowed to continue to use the PHI they have gathered before your cancellation if they need it in connection with the research study or to follow up with the study.
The federal privacy regulations and state law allow us to use or disclose your PHI without your written permission in the following situations:
- Treatment: We may use and disclose your PHI as necessary to provide treatment. For example, we may disclose your PHI when we send specimens to the lab, and we may disclose your PHI to another healthcare provider or specialist to refer you for treatment or to help coordinate your care.
- Billing: We may use and disclose your PHI to bill, obtain payment, and be reimbursed by third parties. For example, we may contact your insurance company to determine if you are enrolled and what coverage you have. We may disclose your PHI to your insurance company to bill for your healthcare services.
- Healthcare operations: We may use and disclose your PHI to evaluate our healthcare providers and to train our staff members and students. We may also use your PHI to develop or evaluate clinical guidelines or conduct internal audits. Your PHI may also be used to remind you of your appointment(s) and to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you.
- Fundraising: We may disclose or use your name, demographic information and dates of service at Kennedy Krieger Institute to raise funds on behalf of Kennedy Krieger Institute.
- Health information exchange: We may share information that we obtain or create about you with other healthcare providers or entities, such as your health plan or health insurer, as permitted by law, through Health Information Exchanges (HIEs) in which we participate. For example, information about your past medical care and current medications can be available to us or to your non-Kennedy Krieger primary care physician or hospital, if they participate in the HIE as well. Exchange of health information can provide faster access and better coordination of care, and can assist providers and public health officials in making more informed decisions.
The Chesapeake Regional Information System for our Patients, Inc. (CRISP) is a regional internet-based, statewide, state-approved HIE in which we participate. We may share information about you through CRISP for treatment, payment or healthcare operations. You may opt out and disable access to your health information available through CRISP by calling 1-877-952-7477 or completing and submitting an opt-out form to CRISP by mail or fax, or through CRISP’s website (crisphealth.org). Even if you opt out of CRISP, public health reporting and controlled dangerous substances information, as part of the Maryland Prescription Drug Monitoring Program (PDMP), will still be available to providers.
• We also may—and in some cases, we must—disclose your PHI to:
- Business associates who perform a job for us.
- Public agencies, when we believe there may be possible abuse or neglect.
- Respond to a court order, subpoena or other lawful instructions from courts or public bodies.
- Law enforcement officials (under some circumstances and with some restrictions).
- Comply with other laws.
- Public health authorities, for disease control or prevention, to report child abuse or neglect, or for oversight of Food and Drug Administration-regulated products or activities.
- Prevent a serious threat to public health or safety.
- Public agencies, if we believe a person has been exposed to a communicable disease or there is a person who is at risk of contracting or spreading a disease or condition.
- An employer, to evaluate a work-related illness or injury, or to evaluate the workplace, in some circumstances.
- A coroner, medical examiner or funeral director, in some circumstances.
- Authorized federal officials, for intelligence and law enforcement activities.
- An agency administering a public benefits program.
- A health oversight agency, for its oversight activities.
- Workers’ compensation carriers or other similar programs.
- Enable organ, eye or tissue donation and transplantation.
- Inform you about the services and treatments we offer.
- Permit the secretary of the U.S. Department of Health and Human Services to see our facilities and information (including PHI), to determine our compliance with privacy requirements.
Federal privacy regulations also allow Kennedy Krieger Institute to remove most identifying information that could possibly identify you from health information, and then use this information for research, health oversight and operations activities without your permission. If we do this, we must have an agreement with anyone we share the information with to use the information only for the permitted purposes and not to identify you with the information.
If you believe we have used your PHI inappropriately, you may file a written complaint with us.
Please send it to the privacy officer at Kennedy Krieger Institute, 707 North Broadway, Baltimore, MD 21205. You may also file a complaint with the secretary of the U.S. Department of Health and Human Services. If you file a complaint, we will not take action against you.