• By establishing standards for electronic transmission of health information,
• By establishing standards to protect the privacy of individuals' medical records and other protected health information, and
• By ensuring the security of health care information.

How is this done?
• HIPAA establishes safeguards to protect the privacy of health care information.
• HIPAA sets boundaries on the use and release of health records.
• HIPAA holds people accountable if they violate patient rights (civil and criminal penalties)

Protected Health Information (PHI)
• Any information that relates to the health of the individual and can be used to identify the individual, such as: name, social security number, address, disability, etc.
• Any health information that is transmitted or maintained in any electronic, written, or spoken format. (For example, email, fax, online databases, voice mail, video/audio recordings, or conversations.)

What does HIPAA do?
The Privacy Rule prohibits use or disclosure of protected health information unless:
• It's used to provide treatment, payment, or health care operations, or
• It's use is authorized by the client, or not sharing the information would present a risk to public health or safety. (For example, disease reporting as required by statute on bioterrorism activities.)

Health Insurance Portability and Accountability Act – HIPAA (cont)

• Request that improper uses be corrected.
• Obtain a report of disclosures of their protected health information.
• File a grievance of complaint.

Consent and Confidentiality
Families and their children can find protection under the law to make sure they understand all treatment that is proposed to them and their child and to ensure that their personal health information is kept confidential and not shared in a reckless manner. As a family, make sure you:
• Understand all sides of treatment before you consent
• Ask for further explanation for anything you do not understand
• Ask for information in writing
• Take your time if it is not an emergency
• Keep copies of everything they give you
• Remind professionals, when necessary, to keep their voice down or request a private area for discussions about personal health information
• Know your rights

KPFC is not a direct provider and does not maintain personal health records; however, KPFC must still maintain compliance with HIPAA in order to better serve and protect our members. KPFC does maintain a member database that includes professional and parent contact information for the dissemination of the quarterly newsletter, annual evaluations, and annual fundraising appeals. KPFC's database does not denote which members are parent members and which are professional members. The database is only shared with KPFC's mailing service in order for the newsletters to be disseminated in an efficient and timely manner.

KPFC youth council applications, board member applications, and support group delegate applications include personal health information such as types and severity of a child's disability. Board applications are shared with the Executive Committee and then a summary of the board application is shared with the KPFC board of directors. All KPFC board members have signed confidentiality agreements and all board applicants are informed of this process.

Youth Council applications are processed anonymously by presenting current members a summary of the applicant without using identifying information. All applicants must sign a permission to share their application with other Youth Council members and they must sign a confidentiality form. If the Youth Council member is under 18 or has a guardian, the parent or guardian must also sign it.

KPFC support group delegate application forms are processed in the office only. Information about the support group such as meeting location and times, and contact information for the support group leader may be shared with other parents via resource request, KPFC newsletter, and KPFC web site with approval. All applications received at Kentucky Partnership for Families and Children, Inc. are kept in a locked filing cabinet in the KPFC office.

KPFC also maintains a toll free resource line for parents and professionals from across the state. Staff documents these calls and the follow up to the information/services disseminated in a Resource Call Logbook. This information is not shared outside of KPFC without obtaining written or verbal permission and is also kept in a locked filing cabinet.

If you have any questions or concerns, please contact Carol Cecil at cwcecil@kypartnership.org or at the KPFC office at your convenience!