Customized Plans

BHR Worldwide will develop a service package tailored to your objectives and budgets. A carefully designed plan adds value and provides the feedback and information you need. From customized greetings to final reports and feedback systems, we fulfill your organization’s needs.

www.bhrworldwide.com

Notice Effective Date: <04/05/05>

BEHAVIORAL HEALTH RESPONSE, DEPARTMENT OF MENTAL HEALTH ADMINISTRATIVE AGENTS, AND DEPARTMENT OF MENTAL HEALTH FACILITIES COLLABORATE TO PROVIDE ACCESS CRISIS INTERVENTION (ACI) SERVICES FOR EASTERN MISSOURI Notice of Privacy Practices

• General Information
• Use and Disclosure of Your Medical Information
• Your Rights Regarding Medical/Health Information
• Complaints
• Other Uses or Disclosures of Medical/Health Information
• Changes to This Notice
• General Questions

General Information

This notice is to explain the rules around the privacy of your own medical/health records and our legal duties on how to protect the privacy of your medical/health records that we create or receive. Generally, we are required by law to ensure that medical/health information that identifies you is kept private. We are required by law to follow the terms of the notice that are the most current.

This notice will explain (i) how we may use and disclose your medical/health information; (ii) our obligations related to the use and disclosure of your medical/health information; and (iii) your rights related to any medical/health information that we have about you. Sites Covered

This privacy statement applies to the bhrworldwide.com website. It does not apply to any linked sites owned, operated or otherwise maintained by any third party. To learn about the privacy policy of a linked site, please refer to the privacy statement for that site. Visiting Our Website

We use “cookie” technology to obtain usage information from our online visitors. You may disable your cookie information by adjusting your browser preferences on your personal computer at any time. Keep in mind that cookies do not identify a specific user and are not used to collect any personal information.

In order to provide you with the best possible service and relevant information to you, we use cookies to:

• Track resources and data accessed on the site per visitor
• Record general site statistics and activity
• Assist users experiencing problems with bhrworldwide.com

There are times where you may choose to give us personal information about you. For example, you may ask that a medical/health professional call you, or you may request additional information. We need certain information from you so we can respond to your request. Many of our customers register for online access to their account information. We need information from you to register you, and authenticate you, for this access. Kinds of Information We Collect

We collect and use Personal Information that you voluntarily give us, and Site Visitorship Data, on this website, as follows:

We collect Personal Information that you give us, for example, to

• request a call from a BHR representative or medical professional
• register for a service on this website
• instruct us to perform a transaction, if you are a registered customer
• complete a survey

This information commonly includes your name, address, email address, telephone number, and if applicable, your account number. Our website has security safeguards that are designed to protect the security of any personal information that you decide to give us via the Internet.

We use Personal Information collected on this website in several ways:

• to respond to your request for a call, referral, or additional information
• to process transactions you request
• to tell you about products or services we offer to authenticate registered customers

Site Visitorship Data is data about the way a website is used that is not associated with an individual’s identity. We collect this information to analyze how our site is used and to improve it.

The kind of information we collect includes:

• the pages visited on our site
• the features used
• how long a visitor stays
• the domain name of the site from which visitors connect to our site

We use Site Visitorship Data to develop, manage, and improve the website. Sometimes we add Site Visitorship to Personal Information from registered customers. We may use that information to:

• manage the website
• help resolve problems
• analyze use of the site
• tell you about products or services that we offer

Use and Disclosure of Your Medical Information

THIS NOTICE (THE “NOTICE”) DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFulLY. This notice applies to the medical/health records that are generated by the ACI System. The terms "medical" and "medical/health" in this Notice mean information about your physical or mental condition which make you eligible for our services, or which arise while we are serving you. For example, this may include psychological tests, psychiatric assessments or medical or social assessments.

We may obtain, but we are not required to, your consent for the use or disclosure of your protected health information for treatment, payment or health care operations. We are required to obtain your authorization for the use or disclosure of your information for other specific purposes or reasons. We have listed some of the types of uses or disclosures below. Not every possible use or disclosure is covered, but all of the ways that we are allowed to use and disclose information will fall into one of the categories.

In addition to ACI departments, employees, staff and other personnel, the following people will also follow the practices described in this Notice of Privacy Practices:

• Any health care professional who is authorized to enter information in your medical/health record;
• Any member of a volunteer group that we allow to help you while you are in the ACI system; and
• All providers within the collaborating group

The entities that collaborate to provide ACI services are:

• state-operated Missouri Department of Mental Health facilities in the Eastern Region;
• administrative agents and associate providers located in the Eastern Region for the Division of Comprehensive Psychiatric Services; and
• Behavioral Health Response

In addition, individuals and providers who are in the collaborating group may share medical information with each other about ACI consumers they serve in common for the purpose of treatment, payment or health care operations as those terms are described later in this Notice of Privacy Practices. These other individuals and providers who are in the collaborating group are included throughout this document whenever we use the term "ACI." The following categories describe different ways that we use and disclose medical/health information. For each category of uses or disclosures we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

We can use or disclose medical information about you regarding your treatment, payment for services, or for ACI operations, and we will make a good faith effort to have you acknowledge your copy of the Notice of Privacy Practices. HIPAA Notice of Privacy Practices for Protected Health Information

If you need further information on the HIPAA Privacy Rule, please see the following:
1. HIPAA Privacy Rule and Public Health Guidance from CDC and the U.S. Department of Health and Human Services
2. Standards for Privacy of Individually Identifiable Health Information

“We” refers to Behavioral Health Response, Inc. in its capacity as a provider of . “You” or “yours” refers to any individual who has completed the registration process and has submitted personal health information and other personal information on bhrworldwide.com.

Federal law - as embodied in the privacy regulations promulgated pursuant to the Health Insurance Portability and Accountability Act -- requires Behavioral Health Response, Inc. to maintain the privacy of protected health information about you. We are not allowed to use or disclose it unless we receive written consent or authorization signed by you or as otherwise permitted by law. Federal law requires us to provide you with a Notice of our legal duties and privacy practices with respect to protected health information relating to you. This Notice is to inform you of uses and disclosures of protected health information that we may make. It also informs you of your rights and our duties with regard to protected health information.

We are required to abide by the terms contained in this Notice. We do reserve the right to change the terms of this Notice and make the new Notice provisions apply to all the protected health information we maintain. This includes protected health information created or received prior any revision to this Notice. We must promptly revise this Notice whenever there is a material change to our uses or disclosures, your rights, our duties and other related circumstances. We will mail you any such revised Notice, unless you have agreed to receive Notices electronically. To receive such Notices electronically, you should make such a request to the contact listed at the end of this Notice.

Use and Disclosure of Protected Health Information
Federal law permits us to use and disclose protected health information for purposes of treatment, payment and health care operations as those terms are defined under federal law. We do not provide treatment, but we may use and disclose protected health information for payment purposes, such as in connection with the payment of an insurance claim. We may also use and disclose protected health information for the health care operations we provide in connection with transacting such insurance activities as underwriting and other activities relating to the creation, renewal or replacement of a contract of insurance. We will also comply with any state or federal law that is more restrictive as to our uses and disclosures of protected health information.

There are circumstances where federal law permits or requires us to use or disclose protected health information about you without your written authorization. Permitted Disclosures

While we may not necessarily make all of the uses and disclosures described below, federal law permits use or disclosure of protected health information without your written consent or authorization under the following circumstances:

• We may disclose protected health information to you.
• To third party non-BHR business associates that perform services for us or on our behalf, such as vendors.
• Where disclosure is required by law.
• To a public health authority authorized by law to collect or receive such protected health information for the purposes of preventing or controlling disease, injury or disability or reviewing reports of child abuse and for the conduct of other authorized public health activities and responsibilities.
• To a governmental authority when we reasonably believe that you may be a victim of abuse, neglect or domestic violence where the governmental authority is authorized to receive such reports.
• To a health oversight agency for such activities.
• For judicial and administrative proceedings.
• To a law enforcement official for a law enforcement purpose.
• To a medical examiner for the purpose of identifying a deceased person, determining the cause of death, or other duties authorized by law.
• To organ donor organizations in order to aid in such donations.
• For certain research purposes authorized by and subject to federal law.
• To avert a serious threat to health or safety.
• To government officials regarding military personnel and certain domestic and foreign government officials for certain functions authorized by federal law.
• To comply with workers' compensation and other similar programs.
• To make certain marketing communications and for certain fundraising purposes.

Additionally, where appropriate, we may disclose protected health information to a group health plan or plan sponsor in accordance with federal law. Required Disclosures

We are required to disclose protected health information about you when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with federal health privacy regulations.

We are also required, with certain exceptions, to provide you with access to inspect and obtain a copy of health information about you that we maintain in our record system. See “Right to Inspect and Copy”below. Need for Authorization

We will not make any uses or disclosures other than those mentioned above without your written authorization in accordance with federal law. You may revoke such authorization, provided it is in writing. Your revocation will not, however, be effective 1) if we took action relying on the written authorization before it was revoked, or 2) if we obtained the authorization as a condition of issuing you insurance coverage, and other law provides us with the right to contest a claim under the policy or the policy itself. To revoke such an authorization, please write the contact listed at the end of this Notice. If you wish additional information regarding authorizations, you should address your inquiry or complaint to the contact listed at the end of this Notice.

Treatment
We may use medical information about you to provide you with treatment or services. We may disclose medical information about you to qualified mental health professionals (each , a “QMHP”); qualified mental retardation professionals (each, a “QMRP”); or to qualified counselors; or, technicians, medical students or residents, or other ACI personnel, volunteers or interns who are involved in providing services for you or interpreters needed in order to make your treatment accessible to you. For example, your treatment team members will internally discuss your medical/health information in order to develop and carry out a plan for your services. Different agencies within the OHCA also may share medical/health information about you in order to coordinate the different things you need, such as prescriptions, medical tests, special dietary needs, respite care, personal assistance, day programs, etc.

Payment
We may use and disclose medical/health information about you so that the treatment and services you receive may be billed to and payment may be collected from you, an insurance company or a third party. For example, we may need to provide your insurance plan information about psychiatric treatment or habilitation services you received so your insurance plan, or any applicable Medicaid or Medicare funds, will pay us for the services. We may also tell your insurance plan or other payor about a service you are going to receive in order to obtain prior approval or to determine whether the service is covered. In addition, in order to correctly determine your ability to pay for services, we may disclose your information to the Social Security Administration, the Division of Employment Security, or the Department of Social Services. Health Care Operations

We may use and disclose medical/health information about you for ACI operations. These uses and disclosures are necessary to run the system and make sure that all of our consumers receive quality care. For example, we may use medical/health information for quality improvement to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also combine medical information about many consumers to decide what additional services the system should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to doctors, nurses, technicians, medical students and residents, and other personnel as listed above for review and learning purposes. We may also combine the medical/health information we have with medical/health information from other facilities to compare how we are doing and see where we can make improvements in the care and services we offer. It may also be necessary to obtain or exchange your information with the Department of Elementary and Secondary Education, the Department of Social Services, Vocational Rehabilitation, the Office of State Courts Administrator, or other Missouri state agencies or interagency initiatives, such as the Juvenile Information Governance Commission, or System of Care initiative. Or, we may remove information that identifies you from this set of medical information so others may use it to study health care and health care delivery without learning the identity of specific consumers. This may be in the form of providing information to our regional advisory councils or state advisory councils or planning councils. Uses and Disclosures of Medical/Health Information That Do Not Require Your Consent or Authorization

We can use or disclose health information about you without your consent or authorization when:

• there is an emergency or when we are required by law to treat you,
• when we are required by law to use or disclose certain information, or
• when there are substantial communication barriers to obtaining consent from you.

We can also use or disclose health or medical information about you without your consent or authorization for:

• to contact you as a reminder that you have an appointment for treatment or services.
• to tell you about or recommend possible treatment options or alternatives or health-related benefits or services that may be of interest to you.
• Should a disaster occur, we may disclose medical information about you to any agency assisting in a disaster relief effort so that your family can be notified about your condition, status and location.
• Under certain circumstances, we may use and disclose medical/health information about you for research purposes when a waiver of authorization has been approved by the Institutional Review Board, or Privacy Committee. For example, a research project may involve comparing the health and recovery of all consumers who received one medication to those who received another for the same condition. All research projects, however, are subject to a special approval process under Missouri law. This process evaluates a proposed research project and its use of medical information, trying to balance the research needs with consumers' need for privacy of their medical/health information. Before we use or disclose medical/health information for research, the project will have been approved through this research approval process. We may, however, disclose medical/health information about you to people preparing to conduct a research project, for example, to help them look for consumers with specific medical needs, so long as the medical information they review does not leave the facility. We may also use or disclose your health information without your consent when disclosing information related to a research project when a waiver of authorization has been approved by the Professional Review Committee or a university-sponsored Institutional Review Board.
• We will disclose medical/health information about you when required to do so by federal, state or local law.
• We may use and disclose medical/health information about you when necessary to prevent a serious threat to the health and safety of you, the public, or any other person. However, any such disclosure would only be to someone able to help prevent the threat.

SPECIAL SITUATIONS

Military and Veterans
If you are a member of the armed forces, we may release medical/health information about you as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority.

Workers' Compensation
When disclosure is necessary to comply with Workers' Compensation laws or purposes, we may release medical/health information about you for workers' compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Public Health Risks
We may disclose medical/health information about you for public health activities. These activities generally include the following: to prevent or control disease, injury or disability; to report births and deaths; to report child abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; to notify the appropriate government authority if we believe a consumer has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.

Health Oversight Activities
We may disclose medical/health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes
If you are involved in a lawsuit or a dispute, we may disclose medical/health information about you in response to a court or administrative order.

Law Enforcement
We may release medical/health information if asked to do so by a law enforcement official; however, if the material is protected by 42 CFR Part 2 (a federal law protecting the confidentiality of drug and alcohol abuse treatment records), a court order is required. We may also release limited medical/health information to law enforcement in the following situations: (1) about a consumer who may be a victim of a crime if, under certain limited circumstances, we are unable to obtain the consumer's agreement; (2) about a death we believe may be the result of criminal conduct; (3) about criminal conduct at the facility; (4) about a consumer where a consumer commits or threatens to commit a crime on the premises or against program staff (in which case we may release the consumer's name, address, and last known whereabouts); (5) in emergency circumstances, to report a crime, the location of the crime or victims, and the identity, description and/or location of the person who committed the crime; and (6) when the consumer is a forensic client and we are required to share with law enforcement by Missouri statute.

Coroners, Medical Examiners and Funeral Directors
We may release medical/health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release medical/health information about consumers to funeral directors as necessary to carry out their duties.

National Security and Intelligence Activities
We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Protective Services for the President and Others
We may disclose medical information about you to authorized federal officials so they may conduct special investigations or provide protection to the President and other authorized persons or foreign heads of state.

Inmates
If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical/health information about you to the correctional institution or law enforcement official if the release is necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Your Rights Regarding Medical/Health Information

You have the following rights regarding medical information we maintain about you:

Right to Inspect and Copy
You have the right to inspect and copy your medical/health information with the exception of psychotherapy notes and information compiled in anticipation of litigation. To inspect and copy your medical/health information, you must submit your request in writing to this facility's Privacy Officer or designee. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and copy in certain limited circumstances. If you are denied access to your medical/health information because of a threat or harm issue, you may request that the denial be reviewed. Another licensed health care professional chosen by the facility will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

Right to Request an Amendment
If you feel that medical/health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the facility. Requests for an amendment must be made in writing and submitted to the Privacy Officer or designee. You must provide a reason to support your request for an amendment. We may deny your request if it is not in writing or if it does not include a reason supporting the request. In addition, we may deny your request if you ask us to amend information that:

• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
• Is not part of the medical information kept by or for the facility;
• Is not part of the information which you would be permitted to inspect and copy; or
• Is accurate and complete.

Right to an Accounting of Disclosures
You have the right to request an "accounting of disclosures", a list of the disclosures made by the facility of your medical/health information. To request an accounting of disclosures, you must submit your request in writing to this facility's Privacy Officer or designee. Your request must state a time period which may not go back more than six years. Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a twelve-month period will be free. For additional lists in a twelve-month period, we may charge you for the cost of providing the list. We will notify you what that cost will be and give you an opportunity to withdraw or modify your request before you are charged. This right does not apply to: disclosures made to carry out treatment, payment, or health care operations; disclosures made pursuant to an authorization in compliance with federal law; disclosures made for law enforcement purposes; disclosures authorized by law; or disclosures that occurred before April 14, 2003. In addition, there are some disclosures that we do not have to track. For example, when you give us an authorization to disclose some information, we do not have to track that disclosure.

Right to Request Restrictions
You have the right to request a restriction or limitation on the medical/health information we use or disclose about you for treatment, payment or health care operations. For example, you could ask that we not use or disclose information about your family history to a particular community provider. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. To request a restriction on the use or disclosure of your medical/health information for treatment, payment or health care operations, you must make your request in writing to the facility's Privacy Officer or designee. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply (for example, disclosures to your spouse).

Right to Request Confidential Communications
You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing to the facility's Privacy Officer or designee. Your request must specify how or where you wish to be contacted. We will not ask you the reason for your request and will accommodate all reasonable requests.

Right to a Paper Copy of This Notice
You have the right to a paper copy of this notice even if you have agreed to receive the notice electronically. You may ask us to give you a copy of this notice at any time by contacting the facility's Privacy Officer or designee. You may also obtain a copy of this notice at our website, www.bhrworldwide.com

If you wish to exercise any of these rights, please contact: Privacy Officer (address below)

Complaints

Other Uses or Disclosures of Medical/Health Information

Uses or disclosures not covered in this Notice of Privacy Practices will not be made without your written authorization. If you provide us written authorization to use or disclose information, you can change your mind and revoke your authorization at any time, as long as it is in writing. If you revoke your authorization, we will no longer use or disclose the information. However, we will not be able to take back any disclosures that we have made pursuant to your previous authorization.

Changes to This Notice

We reserve the right to change this notice. We may make the revised notice effective for medical/health information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in the facility. The notice will contain on the first page, in the top right-hand corner, the effective date. In addition, each time you register at, are admitted, or apply for services to the facility for treatment or services, we will offer you a copy of the current notice in effect. If you want to request any revised Notice of Privacy Practice, you may access it at our website, www(dot)bhrworldwide(dot)org

General Questions

If you have any questions about the content of this Notice of Privacy Practices, or if you need to contact someone at the facility about any of the information contained in this Notice of Privacy Practices, the contact person is the Privacy Officer or designee:

Privacy Officer, Behavioral Health Response
P.O. Box 1125
Maryland Heights, MO 63043