DEVELOPMENTAL DISABILITIES INSTITUTE, INC.

NOTICE OF CHANGE IN PRIVACY POLICIES

This summary is intended to inform our consumers and families that we have made changes to our privacy policies in accordance with recent changes in federal law. The federal Health Information Technology for Economic and Clinical Health Act, enacted in 2009, made changes to the HIPAA privacy and security rules that apply to personal health information maintained by us. As a result, we have revised our privacy policies in accordance with the new federal requirements.

The following is an overview of the HIPAA changes that are in effect as of February 17, 2010:

• Access to Information in Electronic Format: If we maintain an electronic health record for an individual, the individual may request access to the information in an electronic format.

• Restrictions on Disclosures: We must comply with any request for restrictions on disclosures if the information is to be sent to a health plan for payment or health care operations purposes and the disclosure relates to products or services that were paid for solely out-of-pocket.

• Accounting of Disclosures: If we maintain an electronic health record for an individual, the individual will now be entitled to receive an accounting of routine disclosures of their health information, upon request.

• Marketing and Health Care Operations: The new rule clarifies the interaction between marketing activities and health care operations activities.

• Opt-Out of Fundraising: Language providing individuals with the chance to "opt-out" of fundraising communications must be presented in a clear and conspicuous manner. Any opt-outs elected will be treated as a revocation of any prior authorization.

• Business Associates: HIPAA privacy and security rules will now apply directly to business associates who will be subject to the same civil and criminal penalties that apply to providers.

• Enhanced Enforcement: HIPAA civil money penalties are now increased and criminal penalties are added for individuals or employees of providers who violate HIPAA.

• Breach Notification: HIPAA providers and business associates must provide notice to all affected individuals in the event of an unauthorized or inadvertent breach of unsecured personal health information.

For more information or to request a copy of our revised Notice of Privacy Practices, please contact the agency's HIPAA Privacy Officer at This e-mail address is being protected from spambots. You need JavaScript enabled to view it.

Dated: February 17, 2010