Notice of Privacy Practices (HIPAA)

1. Permitted Uses and Disclosures of PHI

We may use and disclose your PHI without your explicit written authorization for the following purposes:

• Treatment and Care Coordination: To coordinate services between Consumers, Personal Assistants (PAs), and care managers.
• Payment: To process Medicaid claims, verify electronic visit verification (EVV) logs, and submit billing data to our prime contractor, PPL, and the New York State Department of Health.
• Healthcare Operations: To perform internal quality audits, program evaluations, and comply with state compliance mandates.

2. Uses and Disclosures Requiring Your Written Authorization

Any other uses and disclosures not covered by this notice will be made only with your explicit written authorization. This includes the sharing of psychotherapy notes, marketing communications, or the sale of PHI. You may revoke an authorization at any time in writing.

3. Your Individual Rights Regarding Your PHI

Under federal HIPAA regulations and New York State law, you have the right to:

• Inspect and Copy: Request to see and receive copies of your care enrollment and billing records.
• Amend: Request a correction if you feel the health information we maintain about you is incorrect or incomplete.
• Accounting of Disclosures: Request a list of certain disclosures we have made of your PHI outside of treatment, payment, or healthcare operations.
• Request Restrictions: Ask us to limit the PHI we use or disclose about you. While we are not always required to agree, we will accommodate reasonable requests.
• Confidential Communications: Request that we communicate with you via alternative means or at an alternative location.

4. Data Breach Notifications

In the event of an unauthorized acquisition, access, use, or disclosure of your unencrypted PHI, we will notify you immediately in accordance with the HIPAA Breach Notification Rule and the New York SHIELD Act.