Who and what this notice covers

This notice describes the privacy practices of Lotz of Lively Steps LLC and its workforce for protected health information held in providing and administering our services. This can include assessments, behavior support plans, service notes, identifying information, and billing records. It applies to information in electronic, paper, and spoken form. Other providers have their own privacy notices.

Acknowledging receipt of this notice is not consent to treatment or an authorization to release records. Our website privacy policy addresses general website use separately.

Our recordkeeping and sharing approach

We limit workforce access to the information needed for assigned responsibilities. Our privacy obligations apply to paper and electronic records. Technology providers supporting our services may process information under required agreements and safeguards; their involvement does not authorize use for their own marketing.

For disclosures requiring your permission, a written release identifies who may disclose information, who may receive it, the specific records, the purpose, and when permission expires. We verify the authority of anyone signing for you. An authorization does not give a recipient unrestricted access to your internal case file. Contact us before sending records so we can arrange an appropriate exchange method. We can use encrypted company email for authorized record exchanges. Our public website form is for general inquiries, not clinical record transfer.

Some disclosures are permitted or required without an authorization, subject to the limits explained below. A state service agreement or police request is not, by itself, permission to release all records. We verify the authority and scope of the request and apply any more protective confidentiality rules.

Your rights and how to use them

Contact either privacy contact above to make a request or ask for assistance. We may need to verify your identity or authority. We may ask for a written request where permitted, and will explain the process without requiring unnecessary information.

See or obtain your records

You may request to inspect or receive an electronic or paper copy of health information in the records used to make decisions about you. We generally act within 30 days. If a permitted extension is necessary, we will explain the reason and completion date in writing. We may charge only fees permitted by law. Some information is excluded from the access right; if we deny access, we will explain the reason and any review or complaint rights in writing.

Request a correction

You may ask us to amend information you believe is incorrect or incomplete and explain why. We generally act within 60 days, with any permitted extension explained in writing. If we deny a request, we will explain why and how you may submit a statement of disagreement.

Ask for private communications

You may ask us to contact you by a different method or at a different location. We will accommodate reasonable requests. Tell us how we can reach you safely.

Request limits on use or disclosure

You may ask us to restrict information used or disclosed for treatment, payment, or health care operations, or shared with people involved in your care. We do not have to agree to every request, except where the law requires it. If you or someone other than your health plan pays for an item or service in full out of pocket, we must honor a request not to disclose information solely about that item or service to your health plan for payment or operations, unless disclosure is required by law. This right does not establish that private payment is permissible for a Medicaid-covered service; applicable Medicaid rules still apply.

Request a disclosure accounting

You may request a list of certain disclosures made during the six years before your request. It generally excludes treatment, payment, and operations disclosures, disclosures to you, disclosures you authorized, and other exceptions allowed by law. The first accounting in a 12-month period is free. We will tell you about any permitted fee for an additional request and let you withdraw or modify it.

Receive this notice and use a representative

You may obtain a paper copy of this notice even if you agreed to receive it electronically. An authorized personal representative may exercise rights for you to the extent allowed by law. We verify that authority and apply any legally required exceptions or protections.

How information may be used or shared

The purposes below describe uses and disclosures permitted or required by HIPAA. They are not unlimited permission to disclose records. We apply any additional Pennsylvania or federal restrictions, obtain consent or authorization when required, and limit information to the minimum necessary where that standard applies.

Treatment and service coordination

We use information to assess needs, develop and implement behavior support plans, and coordinate care. For example, a clinician may review behavioral observations to adjust a support strategy or coordinate with an authorized Supports Coordinator. Sharing with another provider or support person is subject to applicable consent and confidentiality rules.

Payment

We use and disclose information to obtain authorization, document services, submit claims, and resolve payment questions. For example, we submit service and identifying information through PROMISe to support Medicaid claims. Lotz of Lively Steps LLC is enrolled as a Pennsylvania Medical Assistance provider. Enrollment does not guarantee coverage or authorization for a particular individual or service.

Health care operations

We use information for clinical supervision, quality review, staff training, compliance, and managing the agency. For example, an authorized supervisor may review service documentation for accuracy and quality. Service providers supporting these functions may handle information under required agreements and safeguards, subject to any additional restrictions on access to individual records.

People involved in your care

Where permitted by law, we may share relevant information with people involved in your care or payment when you agree or have an opportunity to object. When you cannot express a preference, HIPAA may permit limited disclosure based on professional judgment and your best interests. Disaster-relief notifications may also be permitted. These permissions do not override Pennsylvania written-consent requirements or special protections for particular records. Being a relative, caregiver, or emergency contact does not by itself authorize unrestricted access.

Other legally permitted or required purposes

Subject to the specific conditions of the law and the additional protections below, disclosures may be permitted or required for:

• Public-health reporting, such as disease reporting, product recalls, or adverse-event reporting; reporting suspected abuse, neglect, or domestic violence; and preventing or lessening a serious and imminent threat.
• Health oversight, such as licensing, audits, investigations, and review by Medicaid, ODP, or other authorized agencies; and demonstrating compliance to the U.S. Department of Health and Human Services.
• Court or administrative proceedings, lawful law-enforcement requests, workers’ compensation, and disclosures otherwise required by law. A request or subpoena does not automatically authorize release; the applicable conditions and confidentiality protections must be met.
• Authorized research, organ or tissue donation, coroners, medical examiners, and funeral directors, when the applicable legal conditions are satisfied.
• Special government functions, such as authorized military, national-security, protective-service, and correctional-custody activities, within the limits of law.

Listing a legally permitted purpose does not mean the agency routinely participates in that activity.

Additional protections and written permission

Pennsylvania individual records

For records covered by 55 Pa. Code § 6100.54, individual records are confidential and kept securely. Access by parties other than the Department, designated managing entity, and applicable support-coordination personnel requires written consent of the individual or a person designated by the individual, subject to other controlling legal requirements. We apply more protective rules governing particular records, including applicable mental-health, HIV-related, and substance-use information; a general HIPAA permission does not remove those protections.

Substance-use disorder records

If we receive or maintain records protected by 42 CFR Part 2, additional restrictions apply. Those records, and testimony describing their contents, cannot be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a qualifying court order issued after notice and an opportunity to be heard. An authorizing court order must be accompanied by a subpoena or other legal requirement compelling disclosure. We follow Part 2 requirements for consent and any further use or disclosure. This provision does not mean the agency operates a substance-use treatment program.

Uses requiring authorization

Most uses or disclosures of separately maintained psychotherapy notes, marketing uses requiring authorization, and sales of protected health information require your written authorization. Other uses or disclosures not described in this notice will be made only with your written authorization. You may revoke an authorization in writing through either privacy contact. Revocation does not undo actions already taken in reliance on the authorization or other exceptions allowed by law.

Our duties

We are required by law to protect the privacy of your protected health information, give you this notice of our legal duties and privacy practices, and follow the notice currently in effect. We must notify affected individuals after a breach of unsecured protected health information as required by law.

Our Records and Record Retention policy requires confidential, secure storage of individual records. Paper records must be kept in locked storage, and digital records must be protected from unauthorized access. Confidential paper records must be disposed of securely under our disposal procedure.

We retain records for the periods required by applicable law and our records policy, and longer when an audit, litigation, or other preservation requirement applies. Ending services or revoking permission does not require us to destroy records we must retain. The 12-month general-inquiry schedule does not apply to clinical records or complaints.

Questions and complaints

You may contact Kai Lively or Heather Lotz using the agency telephone or email above to ask questions, exercise rights, or complain about privacy practices. We accept oral and written complaints, including anonymous complaints, and can help you put a complaint in writing or arrange an advocate to assist you. We will not retaliate or intimidate you for filing a complaint or exercising your rights.

We document, investigate, and respond to complaints under our Client Complaints policy. You can request a copy and assistance with the process. That process does not replace deadlines for access to records or other privacy rights.

You may also complain directly to the U.S. Department of Health and Human Services Office for Civil Rights, without first complaining to us. Visit hhs.gov/hipaa/filing-a-complaint, call 1-877-696-6775, or write to 200 Independence Avenue SW, Washington, DC 20201. OCR generally requires a complaint within 180 days of when you knew of the alleged violation, with extensions possible for good cause. These options do not limit other available complaint rights.

Changes and copies

We may revise this notice and make revised terms apply to information we already hold as well as information received later, to the extent permitted by law. A revised notice will show its effective date and be available on request and on our website. You may request a paper copy at any time through either privacy contact.