School District Notice of Privacy Practices

Effective April 14, 2003


The mission of the school district is to serve its children and taxpayers by operating an educational institution that serves the educational needs of our children at an affordable price for our taxpayers. The school district is a major employer and provider of health benefits. Through these activities the school district collects, uses, and discloses personal health information to carry out its mission. This information is private and confidential.

The school district maintains policies to protect the information against unlawful use and disclosure. The notice also provides you with other important information, including how to contact us with questions about this notice or our privacy practices.

  1. What is this notice?
  2. This notice describes information we collect, how we use that information, and when and to whom we may disclose it.

  3. What is "personal health information"?
  4. Personal health information or "PHI" (also called "protected health information"), is current, past or future information created or received by the school district through its health care providers, health plans and contractors. It relates to the physical or mental condition of a patient or plan member, the provision of health care to that person, or payment for the provision of health care to that person. The term PHI does not generally include publicly available information, or information available or reported in a summarized or grouped manner.

  5. What types of personal health information does the school district collect?
  6. The school district collects PHI through interactions with your health care providers. It can be obtained in conjunction with applications, leave requests, interviews, Student Assistant Program (SAP) membership, Employee Assistance Program (EAP) services, physician or other health care professional consultation, surveys and other forms. PHI may be obtained in writing, in person, by telephone and electronically. The information we collect varies depending on who collects it and why, but generally includes information about your relationship and transactions with us. Examples include:

    School Nurse. If you receive health care services from our school nurse, the nurse may collect or create information such as your name, address, telephone number, social security number, date of birth, medical history, diagnosis, treatment, provider identification and treatment information, financial responsibility and payment information, and family and emergency contact information.

    Employee Plans. If you receive health care benefits through a school district sponsored health benefits plan (an "Employee Plan"), we may collect information such as name, address, telephone number, social security number, date of birth, and related information. The organizations that administer these plans — commercial health benefits plans, pharmacy benefits managers, and others — may collect and exchange additional information, such as medical diagnosis and treatment information, but our employee benefits office generally does not request copies of this information without your authorization.

    ¨ Affiliated Health Plan Members. If you are a member of a health plan administered by the school district, the plan may collect information:

    ¨ From your plan sponsor or other payors (e.g., employers, unions, government agencies) regarding eligibility for coverage and other available coverage.

    ¨ From health care providers (e.g., doctors, dentists, psychologists, pharmacies, hospitals and other caregivers) such as medical history, diagnosis and treatment.

    ¨ From you, your family or other caregivers about your treatment, medical history, or any aspect of coverage under the Health Plan.

    A disability or worker’s compensation plan is not a health plan.

  7. How does the school district protect personal health information internally?
  8. Access to PHI is restricted to only those employees who need it to provide services, products, or benefits to our students, employees, health plan members and their dependents.

    We maintain physical, technical and procedural safeguards to protect PHI against unauthorized use and disclosure. We have a Privacy Officer who is responsible for developing, educating school district personnel about, and overseeing the implementation and enforcement of policies and procedures designed to safeguard PHI against inappropriate use and disclosure consistent with the applicable law.

  9. What personal health information does the school district and other health care providers, employers and health plans use or disclose to third parties, and for what purposes?
  10. When necessary for the operation of an Employee Plan or for other

    related activities, we use PHI internally, share it with our affiliates, and disclose it to health care providers (doctors, dentists, psychologists, pharmacies, hospitals and other caregivers), insurers, third party administrators, plan sponsors and other payors (employers, health care provider organizations, and others who may be responsible for paying for or administering your health benefits); vendors, consultants, government authorities; and their respective agents. They are required by law to keep PHI confidential. Some examples of what we do with the information we collect and the reasons it might be disclosed to third parties are described below.

    Treatment, Payment and Health Care Operations

    We may use or disclose PHI with or without your consent to provide health care services or administer our health benefits plans. Examples of these uses and disclosures include:

    ¨ Payment. Employee Plans and Affiliated Health Plans all use and disclose PHI to obtain and provide reimbursement for the provision of health care to patients and health plan members. Our Employee Plans and Affiliated Health Plans also use and disclose PHI to obtain premiums or determine or fulfill their responsibilities for coverage and provision of benefits under the plans. Examples of these payment activities include: billing, claims management, collections

    activities, and administration of reinsurance, stop loss and excess loss insurance policies, as well as related data processing; making eligibility, coverage, medical necessity, and related determinations, coordinating benefits among various payors, recovering payments from third parties liable for coverage; risk adjustment; utilization review activities, and disclosures to consumer reporting agencies. We may use or disclose PHI in connection with payment activities with or without your consent.

    Other Activities Permitted or Required by Law

    We may use or disclose PHI for other important activities permitted or required by law, with or without your authorization.

    These include:

    ¨ Public Health and Safety. We may use or disclose PHI as necessary to prevent or reduce a serious and imminent threat to the health or safety of a person or the public, to people who may be able to reduce the threat, including the threatened person or law enforcement officials; or for other public health activities to public health authorities (such as the Pennsylvania Department of

    Community Health or the U.S. Department of Health and Human Services) engaged in preventing or controlling disease, injury, or disability

    ¨ Required by Law. We may use or disclose PHI to the extent such use or disclosure is required by law and it complies with and is limited to the requirements of that law. If we suspect a student is a victim of abuse, neglect, or domestic violence, we may be required to file a report to the Pennsylvania’s Childline and possibly to the police as well. We also use and disclose PHI for certain law enforcement purposes and in response to official subpoenas, court orders, discovery requests and other legal process.

    ¨ Other Government Functions. We may use or disclose PHI in connection with military and veterans activities, national security and intelligence activities, protective services for the President of the United States and other dignitaries, and certain correctional facility activities.

    ¨ Facilities Directories. Our facilities use PHI to maintain directories of people employed by and attending our schools, including name, and location. You may

    object to these uses or disclosures when you enter our facilities.

    ¨ Plan Sponsor Communications. Our Employee Plans and Affiliated Health Plans may disclose PHI to the employer, union, government agency or other organization that pays for the costs of your coverage (the "plan sponsor") as follows: to carry out plan administration functions; in summary form to obtain premium bids from health plans or to modify, amend, or terminate plans; and enrollment and participation information. We will disclose PHI to a plan sponsor only upon receipt of certification by the plan sponsor that it will appropriately use and protect the information and honor your rights (as described in Section

    VIII below) to access, review and amend the information, and to receive an accounting of certain disclosures of the information. For example, the plan sponsor will not be permitted to use the information for the purpose of employment related actions or decisions or in connection with any other benefit or employee benefit plan that it sponsors.

    ¨ Family and Friends. Under certain circumstances, we may disclose PHI to family members, other relatives, or close personal friends or others that you identify to the extent it is directly relevant to their involvement with your care or payment related to your care; or to notify them of your location, general condition, or death.

    Our use and disclosure of PHI must comply not only with federal privacy regulations but also with applicable Pennsylvania law. Pennsylvania law provides different and sometimes more stringent protections to PHI than federal regulations. Examples of these protections include: (i) special protections for sensitive information, such as information about HIV/AIDS, treatment for

    psychiatric conditions or substance abuse problems, and certain genetic information; and (ii) a bar against redisclosure of PHI collected by third party administrators of health plans for certain purposes;

  11. What does a person need to do to request other disclosures of personal health information?
  12. Many health plan members ask us to disclose PHI to people in ways not described above. For example, an employee may want us to make her records available to a neighbor who is helping her resolve a question about her care or payment for that care. Contact information to authorize us to disclose your personal health information to a person or organization or for reasons other than those described in Section V above appears below in section VII.

    If you fill out a form and later change your mind about the special authorization, you may send a letter to us at the address listed on the form to let us know that you would like to revoke the special authorization. In any communication with us, please provide your name, address, patient or member identification number or Social Security number, and a telephone number where we can reach you in case we need to contact you about your request.

  13. What other rights does a person have with respect to personal health information, and how can the person exercise those rights?
  14. ¨ You have a right to ask us in writing to restrict use or disclosure of your PHI. In addition, you may request PHI disclosure restrictions to family members, other relatives or close friends involved in your care.

    We are not required to agree to such a restriction, but if we do agree, we will honor our agreement except in case of an emergency. Any restriction we agree to is not effective to prevent uses or disclosures of PHI (i) required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with federal privacy regulations adopted under the Health Insurance Portability and Accountability Act of 1996; (ii) for health facility directories (e.g., a roster of patients staying at a hospital); or (iii) for certain

    activities permitted or required by law (see Section V above).

    ¨ You may request, in writing, to receive confidential communications containing your PHI from us in ways or at locations that are outside our usual process.

    Our health care providers will make every effort to accommodate reasonable requests. However, we may require that you demonstrate danger to yourself if we do not comply with your request. For example, this rule protects persons who are victims of domestic violence who wish to have health information sent to an address other than his or her own. If you are requesting, in writing, to receive confidential communications at a different address than your address of record, then you must make it clear that you may be in personal danger if the request is not honored.

    ¨ You have a right to review and obtain a copy of existing PHI contained in (i) medical and billing records about you maintained by any provider; (ii) enrollment, payment, claims adjudication and case or medical management

    record systems maintained by or for the Employee Plans or Affiliated Health Plans; and (iii) records used by or for any provider or health plan to make decisions about you.

    You must make your request in writing and this right is limited to existing records that are maintained, collected, used or disseminated by or for a Provider, an Employee Plan or an Affiliated Health Plan. It does not apply to psychotherapy notes we maintain; information we compile in reasonable anticipation of, or for use in, civil, criminal or administrative actions or proceedings; or to certain clinical laboratory information.

    We may charge a fee for any copies you request in accordance with Pennsylvania law.

    ¨ You have a right to request that we amend the records described above for as long as we maintain them.

    You must make the request in writing and give us a reason for the amendment. We may deny your request if: (i) we determine that we did not create the record, unless the originator of the PHI is no longer available to act on the requested amendment; or (ii) if we believe that the existing records are accurate and complete. Note that an amendment may take several forms, for example we may add an explanatory statement to a record rather than changing it.

    You have a right to receive an accounting of disclosures made by a Provider, an Employee Plan, or an Affiliated Health Plan to any third party in the six years prior to the date on which the accounting is requested.

    This right does not apply to certain disclosures, including, but not limited to, disclosures made for the purposes of treatment, payment or our operations; disclosures made to you or to others involved in your education or employment; disclosures made with your authorization; disclosures made for national security or intelligence purposes or to correctional institutions or law enforcement purposes; or disclosures made prior to April 14, 2003. You must make any request for an accounting in writing and we may charge a fee to fill more than one request in any given year. Written requests should go to:





    What does the school district plan to do with personal health information about students, employees and health plan members who are no longer affiliated with the school district?

    The district does not necessarily destroy PHI when individuals terminate their relationships with us.

    In many cases, the information is subject to legal retention requirements.

    However, the policies and procedures that protect all PHI against inappropriate use and disclosure apply regardless of the status of any individual whose information is maintained.

  15. How is this notice distributed and updated?
  16. The school district posts this notice on our internet site at and distributes this notice:

    ¨ To employees, at the time they enroll in an Employee Plan. To students at the beginning of each school year.

    ¨ To subscribers of our Affiliated Health Plans — including M-CARE, M-CAID, and Kids Care— at the time of enrollment and within sixty (60) days of any material revision of the notice.

    ¨ To students employees and their dependents, and health plan members upon request.

    We reserve the right to change the terms of this notice. Any changes will be effective for all personal health information that we maintain.

  17. What more do I need to know about my privacy rights?
  18. The school district is required by law to maintain the privacy of personal health information and to provide individuals with notice of its legal duties and privacy practices with respect to that information. We are required to abide by the terms of the notice currently in effect.

  19. What should I do if I want a paper copy of this notice, if I have questions about it, or if I think my privacy rights have been violated?

If you would like a paper copy of this notice, have questions about it, or believe its terms or any school district privacy or confidentiality policy has been violated with respect to information about you, please let us know immediately at the address above or by phone Toll Free: 1-866-. Please include your name, address, and a telephone number where we can contact you, and a brief description of the complaint. If you prefer, you may lodge an anonymous complaint. You also may contact the Secretary of the Department of Health and Human Services at:

The U.S. Department of Health and Human Services

200 Independence Avenue, S.W.

Washington, D.C. 20201

(202) 619-0257

Toll Free: 1-877-696-6775

Please provide as much information as possible so that the complaint can be properly investigated. The school district will not retaliate against a person who files a complaint with us or with the Secretary of the Department of Health and Human Services.