Chatham Oaks, Inc.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED

AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE

REVIEW IT CAREFULLY.

“Protected health information” means any individually identifiable health information,

whether oral or recorded in any form, that is created, received, used, or disclosed by

Chatham Oaks and related to your past, present, or future physical or mental health or

condition; the provision of health care to you; or the past, present, or future payment of

healthcare provided to you. Protected health information includes demographic

information, such as your name and address, which can be used to identify you.

Protected health information does not include health information contained in

employment records held by Chatham Oaks in its role as an employer.

“We” or “us” or “our” means Chatham Oaks.

“You” or “your” means a resident or client who receives or has received health care

services from Chatham Oaks. If a person has legal authority to act on your behalf in

making decisions related to your health care, “you” or “your” will pertain to your

personal representative to the extent relevant and appropriate to such representation.

The purpose of this Notice of Privacy Practices is to explain your rights and our legal

duties concerning the use and disclosure of your protected health information by

Chatham Oaks.

Chatham Oaks is required by law to maintain the privacy of your protected health

information and to provide you with a notice of its legal duties and privacy practices. An

explanation of our legal duties and privacy practices regarding your protected health

information is provided below. We may not use or disclose your protected health

information in a manner that is inconsistent with our current Notice of Privacy Practices.

Permitted Uses and Disclosures of Your Protected Health Information for Treatment,

Payment, and Health Care Operations

The following sections describe different ways that we can use and disclose your

protected health information for treatment, payment, and health care operations. For

each of these categories, we have included an example to explain what we mean.

We may use your protected health information, without your authorization, to provide

you medical treatment or services. We may also disclose your protected health

information to other health care providers involved in your medical treatment. An

example of a permitted use of your protected health information for treatment purposes

is our use of the information to provide you appropriate care and treatment. An example

of permitted disclosure of your protected health information for treatment purposes is

our disclosure of the information to your physician to ensure that the physician has the

necessary information to diagnose or treat you.

We may use and disclose your protected health information, without your authorization,

to bill for the treatment and services provided to you, and to obtain payment for those

services from you, a health plan, or a third party. An example of a permitted use of y our

protected health information for payment purposes is our use of the information to bill

you or your personal representative for the health care service you receive from

Chatham Oaks. An example of a permitted disclosure of your protected health

information for payment purpose is our disclosure of the information to a health plan as

a part of a claim for payment for the services provided to you. We will not disclose your

mental health information to a third-party payor without your prior written consent.

We may use or disclose your protected health information, without your authorization, in

order to conduct certain activities that are necessary to operate our business. These

activities include, but are not limited to, quality assessment activities, case management

and care coordination activities, regulatory compliance evaluations, employee review

activities, student training activities, and contacting you about possible treatment

alternatives that may be of interest to you. An example of a permitted use of your

protected health information for health care operations is our use of the information to

review our treatment and services and to evaluate and improve the performance of our

staff in caring for you. An example of a permitted disclosure of your protected health

information for health care operations is our disclosure of the information to student

trainees for educational purposes.

We may share your protected health information with third party “business associates”

that perform various activities (e.g., billing, consulting, or administrative services) on our

behalf. Whenever an arrangement between Chatham Oaks and a business associate

involves the use or disclosure of your protected health information, we will have a

written contract that contains terms that will protect the privacy of your protected health

information.

Incidental Uses or Disclosure

There may be other incidental uses or disclosures of your protected health information

that may be permitted, but are not specifically listed as examples in our Notice of Privacy

Practices. One example of a permitted incidental disclosure of your protected health

information is the use of a sign-out log used to notify us that you will be away from the

facility. Other examples of an incidental disclosure of your protected health information

include displaying your name at the door of your room at the facility, or announcing your

name and other limited information over our public announcement system. We will

make reasonable efforts within our means to limit our use and disclosure of your

protected health information to the minimum necessary and to employ reasonable

safeguards to protect the privacy of your protected health information.

Other Permitted and Required Uses and Disclosures of Your Protected Health

Information

Unless you express an objection, we may disclose to a member of your family, another

relative, a close personal friend of yours, or any other person you identify, your protected

health information that relates directly to the person’s involvement with your health care

or payment of your health care. If you are unable to agree or object to such a disclosure,

we may disclose your protected health information, as necessary, to these individuals if

we determine, in our professional judgment, that it is in your best interest to disclose the

information.

Unless you express an objection, we may use or disclose your protected health

information to notify or assist in notifying a member of your family, your personal

representative, or any other person that is responsible for your care, of your location,

general condition, or death. If you are unable to agree or object to such a disclosure, we

may disclose your protected health information, as necessary, to these individuals, if we

determine, in our professional judgment, that it is in your best interest to disclose the

information.

We may use or disclose your protected health information to an organization authorized

to assist in disaster relief efforts for the purpose of coordinating the efforts of the

organization in notifying a member of your family, your personal representative, or

another person responsible for your care, of your location, general condition, or death. If

you are unable to agree or object to such a disclosure, we may disclose such information

for notification purposes if we determine, in our professional judgment, that it is in your

best interest to disclose the information.

If you have the capacity to agree or object to a disclosure of your protected health

information to a disaster relief organization, we will first obtain your agreement or

provide you with an opportunity to object to the disclosure; provided, however, that we

determine, in our professional judgment, that obtaining your agreement or objection

does not interfere with the ability of disaster relief organizations to respond to

emergency circumstances.

We may use or disclose your protected health information to the extent required by law.

Such use or disclosure will be made in compliance with the law and will be limited to the

relevant requirements of the law. When required by law, we may use or disclose your

protected health information without your authorization or without providing you with

an opportunity to agree or object to such use or disclosure. We will notify you, as

required by law, of any such uses or disclosures.

We are required by law to disclose your protected health information to you when you

request it, subject to our right to deny you access to the information under certain

limited exceptions.

We are required by law to disclose your protected health information to the U.S.

Department of Health and Human Services during an investigation of our compliance

with federal laws protecting the privacy of your personal health information.

We are required by law to disclose your protected health information to the Iowa

Department of Human Services, if we believe you are a victim of dependent adult abuse.

Such disclosures may be made without your authorization or without providing you with

an opportunity to agree or object.

We may disclose your protected health information in response to, and to the extent

required by, a court or administrative order. We may also disclose your protected health

information in response to a subpoena, discovery request, or other lawful process,

provided that we receive satisfactory assurance from the party seeking the information

that reasonable efforts have been made to notify you of the request or to obtain an

order or agreement protecting the information. Such disclosures may be made without

your authorization or without providing you with an opportunity to agree or object.

We may disclose your protected health information for a law enforcement purpose to a

law enforcement official in any of the following circumstances:

(1) As required by law, including laws that require the reporting of certain wounds or

other physical injuries (other than injuries resulting from abuse)

(2) In compliance with a court order, subpoena, or administrative request seeking

information that is relevant and material to a law enforcement inquiry

(3) To identify or locate a suspect, fugitive, material witness, or missing person, provided

such disclosure is limited to the information permitted by law

(4) In response to a law enforcement official’s request about a known or suspected

victim of a crime (other than victims of abuse), when you agree to the disclosure or

we are unable to obtain your agreement because of incapacity or other emergency

circumstance

(5) To report information about a suspicious death resulting from criminal conduct

(6) To provide information about criminal conduct occurring at the facility

(7) When we provide emergency health care in a medical emergency (except a medical

emergency resulting from abuse), other than an emergency occurring at the facility,

to alert law enforcement, officials of a violent crime and of the identity of the

perpetrator of the crime

(8) When necessary to identify or apprehend an individual who participated in a violent

crime or escaped from lawful custody, provided such disclosure is limited to the

information permitted by law.

Such disclosures may be made without your authorization or without providing you with

an opportunity to agree or object.

We may disclose your protected health information for the following public health

activities and purposes:

(1) To a public health authority authorized by law to receive information for the purpose

of preventing or controlling disease, injury, or disability

(2) To a representative of the federal Food and Drug Administration (FDA) for

authorized activities related to the quality , safety, or effectiveness of FDA regulated

products or activities

(3) To an employer, about a member of the employer’s workforce, if Chatham Oaks has

provided health care to the member at the employer’s request, concerning a workrelated

illness or injury or a workplace-related medical surveillance, in order for the

employer to comply with its legal obligations.

Such disclosures may be made without your authorization or without providing you with

an opportunity to agree or object.

We may disclose your protected health information to a health oversight agency for

oversight activities authorized by law, such as audits, inspections, or investigations,

conducted for the purpose of overseeing the health care programs for which health

information is necessary to determine compliance with program standards, or entities

subject to civil rights laws for which health information is necessary for determining

compliance with the laws. Such disclosures may be made without your authorization or

without providing you with an opportunity to agree or object.

We may disclose your protected health information to a coroner or medical examiner for

identification purposes, to determine cause of death, or to carry out other duties

authorized by law. We may also disclose your protected health information to funeral

directors or persons responsible for transporting deceased individuals, in accordance

with law, as necessary to carry out their duties. A disclosure to a funeral director may be

made prior to, and in reasonable anticipation of, death. If you are a donor, your

protected health information may be used or disclosed for cadaveric organ, eye, or tissue

donation purposes. Such disclosures may be made without your authorization or without

providing you with an opportunity to agree or object.

We may use or disclose your protected health information if we believe the use or

disclosure is necessary to prevent or lessen a serious and imminent threat to the health

and safety of a person or the public, and the disclosure is made to persons reasonably

able to prevent or lessen the threat. Such uses and disclosures may be made without

your authorization or without providing you with an opportunity to agree or object.

(1) Military Activities: If you are a member of the armed forces, we may use and disclose

your protected health information as required by military command authorities. We

may also use and disclose protected health information about foreign military

personnel as required by the appropriate foreign military authority. Such uses and

disclosures may be made without your authorization or without providing you with

an opportunity to agree or object.

(2) National Security and Intelligence Activities: We may disclose your protected health

information to authorized federal officials conducting lawful intelligence, counter-

intelligence, and other national security activities authorized by law.

(3) Protective Services for the President and Others: We may disclose protected health

information to authorized federal officials providing protective services to authorized

persons, including the President or foreign heads of state, or in connection with

conducting authorized investigations.

(4) Correctional Institutions and Other Law Enforcement Custodial Situations: We may

disclose to a correctional institution or a law enforcement official with lawful custody

of an inmate necessary protected health information about the individual, provided

that the individual has not been released on parole, probation, supervised release, or

otherwise is no longer in lawful custody.

Such uses and disclosure may be made without your authorization or without providing

you with an opportunity to agree or object.

We may disclose your protected health information as authorized to comply with laws

relating to worker’s compensation or other similar legally established programs that

provide benefits for work-related injuries or illness. Such uses and disclosures may be

made without your authorization or without providing you with an opportunity to agree

or object.

We may use or disclose your protected health information to remind you about

appointments.

We may use or disclose your protected health information to provide you with

information about treatment alternatives or other health-related benefits and services

that may be of interest to you.

Uses and Disclosures of protected Health Information Requiring Your Written

Authorization

Uses and disclosures of your protected health information will be made only with your

written authorization unless otherwise permitted or required by law as described in this

Notice of Privacy Practices. You may revoke an authorization at any time in writing,

except to the extent we have already taken an action in reliance on the use or disclosure

indicated in the authorization.

You have certain legal rights regarding your protected health information maintained by

or for Chatham Oaks.

Right of Access

You have the right to inspect and obtain a copy of your protected health information

contained in a designated record set for as long as we maintain the information. A

“designated record set” contains your clinical records, personal records, billing records,

and other records used by us to make decisions about your health care. You do not have

a right of access to psychotherapy notes, which your physician has determined are

medically contraindicated; information compiled in reasonable anticipation of, or use in,

a civil, criminal, or administrative action or proceeding; or to other protected health

information prohibited by law from access. Any requests to inspect and obtain a copy of

your protected health information must be made in writing and submitted to our Privacy

Official.

We are permitted by law, in some instances, to deny you access to your protected health

information. If we deny you access, you have the right, under some circumstances, to

have the denial reviewed by a licensed health care professional who did not participate in

the original decision to deny. We will provide or deny access in accordance with the

determination of the reviewing official, and promptly provide you with written notice of

the reviewing official’s determination.

Right to Amend Your Protected Health Information

You have the right to request that we amend your protected health information

contained in a designated record set for as long as we maintain this information. Your

request for an amendment to your protected health information must be submitted in

writing to our Privacy Official and must provide a reason for the request. If we grant your

request for an amendment, we will make the appropriate amendment to your protected

health information in the designated record set and will notify appropriate parties of the

amendment.

We may deny your request for amendment under certain circumstances permitted by

law. If we deny your request for an amendment, we will provide you with a timely,

written denial explaining the basis for our denial. If we deny your request for an

amendment, you have the right to file a statement of disagreement with us. We may

prepare a rebuttal to your statement of disagreement and, if we do so, will provide you

with a copy of our rebuttal.

Right to Request a Restriction of Your Protected health Information

You have the right to request restrictions on our use or disclosure or your protected

health information for treatment, payment, or health care operations. You also have the

right to restrict the protected health information that we disclose to a member of your

family, another relative, a close personal friend, or any other person identified by you,

who is involved in your health care or payment for your health care, or for notification

purposes, as described in this Notice of Privacy Practices.

We are not required to agree to a restriction requested by you, except that while you are

capable of making health care decisions, you may restrict disclosures to family members,

relatives, or friends. If we agree to a requested restriction, we will comply with your

request, except when the use or disclosure of your protected health information is

needed to provide you with emergency treatment. We may terminate our agreement to

a restriction when you agree or request the termination and the termination is properly

documented, or when we inform you that we are terminating the restriction. We may

not agree to a restriction that prevents uses or disclosures required by law.

Right to Receive Confidential Communications

You have the right to request to receive confidential communications from us by

alternative means or at an alternative location. We will accommodate reasonable

request made to us in writing to our Privacy Official. We may condition our

accommodation of your request upon receiving information from you, when appropriate,

about how payment for treatment and services will be handled and specifying an

alternative address or other method of contact. We will not require an explanation from

you of the reasons for your request as a condition of providing communication to you on

a confidential basis.

Right to Receive an Accounting of Disclosures

You have the right to receive an accounting of disclosures of your protected health

information made by us to others in the six years prior to your request (or such shorter

time period as requested by you). This right applies to disclosures for purposes other

than treatment, payment, or health care operations and excludes, among others,

disclosures made to you, disclosures made to your family members or friends involved in

your care, disclosures of information contained in the facility directory, disclosures made

for notification purposes, disclosures made pursuant to an authorization, and disclosures

made prior to July 1, 2004. Your right to receive an accounting of disclosures is subject to

certain exceptions, restrictions, and limitations.

To request an accounting of disclosures, you must submit a request in writing to our

Privacy Official, stating a time period beginning after July 1, 2004 that is within six years

from the date of your request. An accounting will generally include the following

information: (1) the date of the disclosure; (2) the name and, if known, the address of the

entity or person who received your protected health information; (3) a brief description

of the protected health disclosed; and (4) a brief statement of the purpose of the

disclosure or a copy of the written request. In lieu of the information lied above, we may

provide you with a summary instead, if the disclosures involved multiple similar

disclosures. The first accounting provided to you within a 12-month period will be

provided for free. We reserve the right to charge a reasonable, cost-based fee for each

subsequent request made within the same 12-month period. We must provide the

accounting within 60 days.

Right to Receive a Paper Copy of this Notice

You have a right to receive a paper copy of our Notice of Privacy Practices, even if you

have agreed to receive the notice electronically. You may request a copy of our Notice of

Privacy Practices at any time. You may also obtain a copy of our Notice of Privacy

Practices at our web site at www.chathamoaks.org.

In addition to providing you your rights, as detailed above, the federal privacy standard

requires us to take the following measures:

(1) Maintain the privacy of your health information, including implementing reasonable

and appropriate physical, administrative, and technical safeguards to protect the

information.

(2) Provide you this notice as to our legal duties and privacy practices with respect to

individually identifiable health information that we collect and maintain about you.

(3) Abide by the terms of this notice.

(4) Train our personnel concerning privacy and confidentiality.

(5) Implement a sanction policy to discipline those who breach privacy/confidentiality or

our policies with regard thereto.

(6) Mitigate (lesson the harm of) any breach of privacy/confidentiality.

We will not use or disclose your health information without your consent or

authorization, except as described in this notice or otherwise required by law.

We will promptly revise and distribute our Notice of Privacy Practices whenever there is a

material change to uses or disclosures, your rights, our legal duties, or other privacy

practices stated in this notice. We reserve the right to change the terms of this notice

and to make the new notice provisions effective for all protected health information

maintained by us, including the protected health information created or received by us

prior to the effective date of the new notice. We will post a copy of the current notice in

a clear and prominent location in the facility, and will provide a copy of the revised notice

to all or our residents and clients upon request.

If you believe that we have violated your privacy rights, you may file a complaint in

writing with us or with the U.S. Department of Health and Human Services Office of Civil

Rights. You may file a complaint with us by notifying our Privacy Official of your

complaint. We will not retaliate against you for filing a complaint.

The responsibilities of the Privacy Official are carried out by the Director of Social Services at

Chatham Oaks. You may contact the Privacy Official if you have questions about your

privacy rights, or to file a complaint about a violation of your privacy rights, by contacting

Johanna Pundt, LISW; Privacy Official, at 319-887-2701.