THE ESSEX COUNTY PERSONNEL OFFICE HAS A LEGAL DUTY TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (PHI). All employees, volunteers, staff, doctors, health professionals and other personnel are legally required to and must abide by the policies set forth in this notice to protect the privacy of your health information.

This "protected health information", or PHI for short, includes information that can be used to identify you. We collect or receive this information about your past, present or future health condition to provide health care to you, or to receive payment for this health care. We must provide you with this notice about our privacy practices that explain how, when and why we use and disclose (release) your PHI. With some exceptions, we may not use or release any more of our PHI than is necessary to accomplish the need for the information. We must abide by the terms of the notice of privacy practices currently in effect.

We reserve the right to change the terms of this notice and our privacy policies at any time. Any changes to this notice will apply to the PHI already in existence. Before we make any change to our policies, we will promptly change this notice and post a new notice in our lobby. You can also request a copy of this notice from the contact person listed at the end this notice at anytime and can view a copy of the notice on our Web site at www.co.essex.ny.us .

WE MAY USE AND RELEASE YOUR PROTECTED HEALTH INFORMATION for many different reasons. For some of these reasons, we will need your permission or a specific, signed authorization. Below, we describe the different categories of when we use and release your PHI and give you some examples of each category and tell you when we need your permission.

A. We may use, or disclose your protected health information for treatment, payment, or health care operations. YOUR CONSENT IS NOT REQUIRED FOR THESE PURPOSES.

1. For Treatment. We may release your PHI to pharmacies and business associates who provide or are involved in your health care. For example, we may release your PHI to a pharmacy so you may have a prescription filled..

2. To obtain payment for treatment. We may use and release your PHI in order to process payment for services provided to you. It is important that you provide us with correct and up-to-date PHI. For example, we may release portions of your PHI to a pharmacy or business associate to process payment for prescription which you have had filled.

3. To run our health care business. We may release your PHI in order to operate our prescription health plan in compliance with healthcare regulations. For example, we may release your PHI to a business associate to review the quality of our services.

4. Prescription Drug Benefit. With regard to Essex County’s prescription drug benefit, Essex County or its pharmacy benefit manager may use your information to administer the plan more effectively and for various treatment related purposes. This may include: drug utilization reviews to identify potential safety issues or to evaluate program costs; contacting you or your doctor to suggest that you consider using alternative, or more cost-effective medications that are equivalent to those you currently use; or sending you newsletters or other communications about your medications or your health condition that you may find interesting. Pharmaceutical manufacturers may provide funding to support the cost of some of the communications to you. However, we do not participate in any marketing activities and we will not disclose your information to these. drug manufacturers

B. We ALSO DO NOT REQUIRE YOUR CONSENT to Use or Release Your PHI:

1. When federal, state, or local law; judicial or administrative proceedings; specialized government function; or law enforcement agencies request your PHI. We release your PHI when a law requires that we report information to government agencies and law enforcement personnel about victims of abuse, neglect, or domestic violence; for notification and identification purposes when a crime has occurred or in missing person cases; for specialized government functions such as in national security situations; when a crime has taken place on our premises; about victims of a crime with their consent or in an emergency situation; or when ordered in a judicial or administrative proceeding.

2. To avoid harm. In order to avoid a serious threat to health or safety of a person or the public, we may provide your demographic PHI to law enforcement personnel or persons able to prevent or lessen such harm.

3. For worker's compensation purposes. We release your PHI in order to comply with worker's compensation laws. If you do not want worker's compensation notified, alternate insurance or payment information must be supplied.

4. For health oversight activities. We may use PHI and may disclose PHI to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for oversight of the health care system, government benefit programs, or entities subject to government regulation or civil rights laws.

C. You Have the Opportunity to Agree to or Object to the Following:

Information shared with family, friends or others. We may release your PHI to a family member, friend, or other person that you indicate is involved in your care or the payment for your health care, unless you object in whole or in part. Your choice to object may be made at any time.

D. Your Prior Written Authorization is required

for any Uses and Disclosures of your Protected Health Information not included above. We will ask for your written authorization before using or releasing any of your PHI except as previously stated. If you choose to sign an authorization to release your PHI, you may later cancel that authorization in writing. This will stop any future release of your PHI for the purposes you previously authorized.

YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

A. You Have the Right to Request Limits on How We Use and Release Your PHI. If we accept your request, will put any limits in writing and abide by them except in emergency situations. You may not limit PHI that we are legally required or allowed to release.

B. You Have the Right to Choose How We Communicate PHI to You. All of our communications to you are considered confidential. You have the right to ask that we send information to you to an alternative address (for example, sending information to your work address rather than your home address) or by alternative means (for example, e-mail instead of regular mail). We must agree to your request so long as we can easily provide it in the format you requested. Any additional expenses will be passed onto you for payment.

C. You Have the Right to See and Get Copies of Your PHI. You must make the request in writing. We will respond to you within 5* days after receiving your written request. In certain situations, we may deny your request. If we do, we will tell you, in writing, why we denied your request. You have the right to have the denial reviewed if you make a request in writing within 30* business days. We will choose another licensed healthcare professional to review your request and the denial. The person conducting the review will not be the person who denied your first request and must make a decision within 7* business days. You can request a summary or a copy of the entire medical record as long as you agree to the cost in advance. If your request to see the medical information is approved, we will arrange this in accordance with established hospital policy. Please submit all requests for this information to: Daniel L Palmer, Personnel Officer

D. You Have the Right to Get a List of Instances of When and to Whom We Have Disclosed Your PHI.

This list will not include uses you have already authorized, or those for treatment payment or operations. This list will not include uses made for national security purposes, to corrections or law enforcement personnel, if you were in custody, or disclosures made before April 14, 2003. We will respond within 60 days of receiving your request. The list we provide will include the last six years of activity unless you request a shorter time. The list will include dates when your PHI was released and why, with whom your PHI was released (including their address if known), and a

description of the information released. The first list you request within a 12-month period will be free. You will be charged a reasonable fee for additional lists within that time frame. Please submit all requests for this information to: Daniel L Palmer, Personnel Officer

E. You have the Right to Correct or Update Your PHI. If you believe that there is a mistake in your PHI or that a piece of important information is missing, you have the right to request that we correct the existing or add the missing information. We can do this for as long as the information is retained by our facility. You must provide the request and your reason for the request in writing. We will respond within 30* days of receiving your request. If we deny your request, our written denial will state our reasons and explain your right to file a written appeal* within 7* business days. If you choose to appeal, you appeal must be processed within 30* business days. You may also choose to submit a written statement of disagreement. If you do not file a written statement of disagreement, you have the right to request that your request and our denial be attached to all future uses or releases of your PHI. If we approve your request, we will make the change to your PHI, tell you that we have done it, and tell others that need to know about the change or amendment to your PHI. Please submit all requests for this information to: Daniel L Palmer, Personnel Officer, or Monica Feeley, Deputy Personnel Officer

F. You have the Right to Get This Privacy Notice by email. Even if you have agreed to receive notice via email, you also have the right to request a paper copy of this notice. Please submit this request to: Daniel L Palmer, Personnel Officer

HOW TO VOICE YOUR CONCERNS ABOUT OUR PRIVACY PRACTICES: If you think that we may have violated your privacy rights, or you disagree with a decision we made about access to your PHI, you may file a complaint with the person listed below or with the Secretary of the DHHS:

PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO VOICE YOUR CONCERNS ABOUT OUR PRIVACY PRACTICES:

 Richard Meyer

Essex County Privacy Officer

(518) 873-3380

You will not be penalized for filing a complaint.

EFFECTIVE DATE OF THIS NOTICE

This notice went into effect on April 14, 2003

* Are New York State law requirements