HIPAA Privacy



This notice describes how medical information about you or someone in your family who is served by Hamilton County DD Services may be used and disclosed and how you can access this information. Please review it carefully.


We understand that medical records and other information we collect about services and supports we provide to you or someone in your family are personal. Keeping these records private is one of our most important responsibilities.

Hamilton County Developmental Disabilities Services (HCDDS) must follow many laws to protect your privacy. For children and students whom we serve, we follow the Federal Family Educational Rights and Privacy Act (FERPA). For adults and certain services for children, we follow the Federal Health Insurance Portability and Accountability Act of 1996 (HIPAA). In addition, we follow many laws specific to Ohio Boards of Developmental Disabilities. For this notice, we will use the term records to mean the paper or electronic records we maintain about you or your family member.


Your records may be used and disclosed by the employees and volunteers at HCDDS who serve you, as well as persons or agencies who work for us and sign strict confidentiality contracts. School records may be shared with school officials who have a legitimate educational interest in your child. Educational interest means any matter related to your child’s instruction, developmental or behavioral support, dietary, health or safety. School officials include teachers, paraprofessionals, aides, bus drivers and administrators at HCDDS. Our organization includes several facilities and locations. A complete list is available at our website at www.hamiltondds.org, or upon request by contacting us at 513-794-3300.

In general, we use and disclose your information for:

  • teaching, behavioral and medical support, transportation and school administration. example: a school administrator will review a student’s progress data created by a teacher
  •  providing a full range of services such as early intervention, habilitation, supported employment, and others.  Example: your Service Facilitator will review your records to create an individual service plan (My Plan) which may be shared with you, your guardian, and everyone who provides services and supports to you
  •  getting payment for services provided. Example: staff use service records to submit bills to the Ohio Department of Developmental Disabilities and for evaluating and improving quality, training, managing costs, and other business
  • reminding you or a guardian of an appointment for services
  • communicating fundraising or community relations activities, though you always have the right to opt out of such communications 


There are limited situations when we are permitted or required to disclose your records or parts of them without your signed permission. These situations include**:

  • record transfers to other schools your child enrolls in
  • reports to public health authorities to prevent or control disease or other public health activities
  • protection of victims of abuse, neglect, sex offenses, violence, or domestic violence; or when these offenses have been committed
  • investigations, audits, accreditation and inspections, such as are conducted by the Ohio Department of Developmental Disabilities and federal agencies
  • payroll and related tax purposes
  • court order, subpoena or other legal process requests
  • reports to law enforcement agencies of suspected crimes or in emergencies, or other situations when we are legally required to share information
  • Reducing or preventing serious threat to public health and safety
  • coroners, medical examiners and funeral directors
  • workers’ compensation programs
  • specialized government functions including national security, protecting the president, operating government benefit programs, and caring for prisoners
  • connection with whistleblowing by an employee of HCDDS

All other uses not described above require that we obtain your signed permission.


For any purpose not described above, we will release your information only with your explicit written authorization that includes an expiration date that you specify and gives details about where, why, when, how and to whom the information can be given. You can cancel your permission at any time by letting us know in writing.

Federal law requires that we notify you when any health care provider must obtain your explicit permission to release your information for psychotherapy notes, marketing purposes or to sell information about you. It is not the practice of HCDDS to release information for marketing purposes or to sell your information.


Your legal rights to privacy, access to your records, and accuracy of your records include:

  • to see your records, or get a copy (including an electronic copy)
  • to request a correction to your records if you believe they are incorrect
  • to receive all communications at a confidential address or phone number
  • to receive an accounting of disclosures that lists where your records were shared without your authorization
  • to request additional limits on how your information is used or disclosed although these requests do not have to honored unless you choose to personally pay for services instead of using Medicaid
  • to receive a paper copy of this notice.

To exercise any of these rights, or if you have any questions or complaints regarding our privacy practices, call, deliver, mail or email your request to:
HIPAA Privacy Officer
Hamilton County DD Services,
1520 Madison Rd., Cincinnati, OH 45206
(513) 794-3300

Ask any staff person if you need help to put your request in writing.


We are obligated by law to maintain the privacy of your information and to provide this notice. In the event of a breach - an improper disclosure of your information - we are required to notify you. We are required by law to abide by the terms of this notice.

From time to time we may make changes to our policies and if we do, your records will be protected by the new, changed policies. Our current notice will always be available on our website.

The agency emails HIPAA sensitive information in an encrypted format. Encrypted emails are encoded so that people without a password cannot read it. This does not pertain to all email sent by someone from the agency, just emails with HIPAA sensitive contact.  You will receive instructions on how to open the encrypted email when you receive one. For further instructions on opening an encrypted email, click here.


If you have any questions or complaints about our privacy practices, please contact us:
HIPAA Privacy Officer
1520 Madison Rd.
Cincinnati, OH 45209
(513) 794-3300

We will never retaliate against you for filing a complaint. Further, if you are not satisfied with the results, you may also complain to the federal government:

School issues:
Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, D.C. 20202

Any other issues:
Secretary of Health and Human Services
200 Independence Avenue, SW
Washington, D.C. 20201



The Section of your Notice of Privacy Practices which addresses Sharing your Personal Information without authorization is amended to add the following language

Disability Rights Ohio (DRO) filed a state-wide class action captioned Ball v. Kasich Case No. 2:16-cv-282 in the U.S. District Court for the Southern District of Ohio.  The suit was filed on March 31, 2016 against the Governor, Department of Developmental Disabilities, Department of Medicaid and Opportunities for Ohioans with Disabilities.  The Ohio Association of County Boards Serving People with Developmental Disabilities may become a defendant in the lawsuit.  The Plaintiffs are represented by DRO and other lawyers from Massachusetts, Illinois, Michigan and Washington D.C.

The action potentially affects all adults with DD.  The parties to the lawsuit, through their lawyers, have sought and will continue to seek documentation, including Protected Health Information, on individuals who are or who may be a part of this lawsuit, or who may have information relevant to this lawsuit or who are simply receiving services from DD Boards.  The DD Board will comply with requests for information and may provide Protected Health Information on any person served by the DD Board to the lawyers for any of the parties.  All information provided in connection with this lawsuit is covered by a protective order issued by the court which complies with HIPAA and other privacy regulations and which ensures that the information about any individual cannot be disclosed outside of the lawsuit without their permission.  At the conclusion of the lawsuit, all protected health information which was disclosed or retained by any party in the course of the lawsuit will be destroyed.

For further information on the lawsuit or the Protective Order, contact OACBDD.


To download a PDF copy of this notice, click here.

To download a Acknowledgement of Privacy Practices form, click here.

To download our introduction to privacy practices postcard, click here.