Notice of Privacy Practices

Our Commitment To Protecting Health Information

The HIPAA Privacy Rule requires that we protect the privacy of health information that identifies a patient, or may be used to identify a patient. This information is called “Protected Health Information” or “PHI”. This notice describes your rights as our patient and our obligations regarding the use and disclosure of PHI. We are required by law to:

• ▪  Maintain the privacy and security of your PHI

• ▪  Give you this notice of our legal duties and privacy practices with respect to PHI

• ▪  Comply with the terms of our Notice of Privacy Practices currently in effect

  We may change the terms of this notice from time to time. Any new notice will be effective for all PHI that we maintain at that time. If and when this notice is changed, we will post a copy in our facility in a prominent location. We will also provide you with a copy of the revised notice upon your request made to our Privacy Official.

  How We May Use And Disclose Protected Health Information About You

  Treatment: We may use and disclose PHI to provide, coordinate or manage your health care and related services. This may include disclosing medical information about you to doctors, nurses, medical students or other health care personnel who care for you at our hospital or outside affiliates. For example, your PHI may be provided to a physician to whom you have been referred, so that the physician has the necessary information to treat you.

  Payment: We may use and disclose PHI so that we can bill and collect from your insurance company, a third party or yourself for the treatment and services our facility has provided to you. For example, before providing treatment or services, we may share details concerning the services you are scheduled to receive with your health plan to obtain prior approval. We may also disclose PHI to another health care provider or a company or health plan required to comply with HIPAA Privacy Rule for the payment activities of that provider, company or health plan.

  Health Care Operations: We may use and disclose your PHI to contact you when necessary, improve the quality of care we provide, reduce health care costs, and run our operations. Health care operations include reviewing and improving the quality, efficiency and cost of care that we provide to our patients. For example, we may use PHI to develop ways to assist our physicians and staff in improving the medical treatment we provide to others. We also may use PHI to improve health care and lower costs for groups of people who have similar health problems, to manage and coordinate the care for these groups of people, or to review and evaluate the skills, qualifications, and performance of health care providers

taking care of you and our other patients. We may also disclose information to provide training programs for students, trainees, healthcare providers, or non-health care professionals (for example, billing personnel) to help them practice or improve their skills. Finally, in the event that we sell, transfer, merge or consolidate our facility, your medical information may be disclosed to the new entity.

Other Uses And Disclosures We Can Make Without Your Written Consent

Required By Law: We may use and disclose PHI as required by federal, state, or local law. Any such disclosure shall comply with the law and shall be limited to the requirements of the law.

Public Health Activities: When requested, we may disclose PHI to public health authorities or other authorized government authorities to carry out certain activities related to public health. Examples include the prevention or control of disease, injury or disability, to report births and deaths and to report reactions to medications or problems with devices that are regulated by the FDA.

Abuse, Neglect, Or Domestic Violence: We may disclose PHI in certain cases to proper government authorities if we reasonably believe that a patient has been a victim of domestic violence, abuse, or neglect.

Health Oversight Activities: We may disclose PHI to a health oversight agency for oversight activities, including audits, investigations, inspections, licensure and disciplinary activities.

Lawsuits And Other Legal Proceedings: We may use or disclose PHI when required by a court or administrative tribunal order. We may also disclose PHI in response to subpoenas, discovery requests, or other legal processes.

Law Enforcement: Under certain conditions, we may disclose PHI to law enforcement officials as authorized or required by law, as well as in the event of any legal proceedings. Such information may be used to identify or locate a suspect, fugitive, material witness, or missing person, or when suspicion exists that a death has occurred as a result of criminal conduct.

Coroners, Medical Examiners and Funeral Directors: We may disclose PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or to determine cause of death. We may also release PHI to funeral directors as necessary for them to carry out their duties.

Organ And Tissue Donation: We may use or disclose the PHI of organ donors to organizations that help procure, locate and transplant organs in order to facilitate an organ, eye, or tissue donation and transplantation.

Research: We must obtain a written authorization to use and disclose PHI for research purposes except in situations where a research project meets specific, detailed criteria established by the HIPAA Privacy Rule.

To Avoid A Serious Threat To Health Or Safety: We may use or disclose PHI in limited circumstances when necessary to prevent a threat to the health or safety of a person or to the public. This disclosure can only be made to a person who is able to help prevent the threat.

Specialized Government Functions: We may disclose PHI for certain government functions. If you are a member of the armed forces, we may release PHI as required by military command authorities and for the health or safety of inmates and others at correctional institutions.

Business Associates: We may disclose PHI to business associates and their subcontractors, who provide services or activities on our behalf. For example, we may contract with billing and collection services, vendors of health records, consulting services and physician services. We require our business associates to sign a written agreement to safeguard the privacy of all PHI to which they have access.

Incidental Disclosures: While we take reasonable measures to ensure the privacy of your medical information, certain disclosures may occur incidentally. For example, our hospital directory may contain your name, room number and general condition, unless you direct us otherwise. We may also use sign in sheets where you will be asked to sign your name and/or physician. There also may be certain instances where we may also call you by name in the waiting room when your doctor is ready to see you. These incidental disclosures are permitted under HIPAA.

Disclosures Required By HIPAA Privacy Rule: We are required to disclose PHI to the Secretary of the United States Department of Health and Human Services when requested by the Secretary to review our compliance with the HIPAA Privacy Rule. We are also required in certain cases to disclose your PHI to you upon your request, or for an accounting of certain disclosures of PHI about you.

Workers’ Compensation: We may disclose PHI as authorized by workers’ compensation laws or similar programs. Other Uses And Disclosures Of Protected Health Information That Require Your Authorization

Other uses and disclosures of PHI not described herein will only be made with your written authorization. If you have authorized us to use or disclose PHI, you may revoke your authorization at any time, except to the extent we have taken action based on the authorization. The following uses and disclosures require your written consent:

• ▪  Most uses and disclosures of psychotherapy notes

• ▪  Uses and disclosures of PHI for marketing purposes

• ▪  Disclosures that constitute a sale of PHI

• ▪  Other uses not disclosed in this Notice of Privacy Practices

  Your Rights Regarding Protected Health Information

  Right To Request Restrictions: You have the right to request additional restrictions on the PHI that we may use for treatment, payment, health care operations, as well as other disclosures permitted by the Privacy Rule. We are not required to agree to all requests. To request restrictions, you must make your request in writing to our Privacy Official. In your request, please include: (1) the information that you want to restrict; (2) how you want to restrict the information; and (3) to whom you want those restrictions to apply.

  Right To Receive Confidential Communications: You have the right to request that you receive communications regarding PHI in a certain manner or at a certain location. For example, you may request that we contact you at home, rather than at work. You must make your request in writing to our Privacy Official. You must specify how you would like to be contacted (for example, by regular mail to your post office box and not your home). We are required to accommodate reasonable requests.

  Right to Inspect and Copy: You have the right to request the opportunity to inspect and receive a copy of your PHI in certain records that we maintain. This includes your medical and billing records but does not include psychotherapy notes

or information gathered or prepared for research or a civil, criminal, or administrative proceeding. We may deny your request to inspect and copy PHI only in limited circumstances. Please contact our Privacy Official if you have questions about access to your medical record. If you request a copy of PHI about you, we may charge you a reasonable fee for the copying postage labor and supplies used in meeting your request.

Right To Amend and Opt-Out: You have the right to request that we amend your PHI as long as such information is kept by or for our facility. Requests for amendments must be in writing and must give us a reason for the request. Additionally, if treatment, services or products provided to you have been paid for out of pocket, in full yourself, you may request that we not share health information pertaining to that product or service with your health plan for the purposes of carrying out payment or health care operations. Lastly, we may use limited PHI to contact you for fundraising efforts. You also have the right to opt out of such communications upon receipt of a solicitation. To make these types of request, you must submit your request in writing to our Privacy Official.

Right To Receive An Accounting of Disclosures: You have the right to request an accounting of certain disclosures that we have made of your PHI other than for treatment, payment, and health care operations. The first list that you request in a 12-month period will be free. Additionally, we are required by law to provide patient notification if it has been discovered that a breach of unsecured PHI has occurred, unless there is a demonstration, based on a risk assessment that there is a low probability that PHI has been compromised. You will be notified without reasonable delay no later than 60 days after discovery of the breach.

Right To A Paper Copy Of This Notice:

You have a right to receive a paper copy of this notice at any time. You are entitled to a paper copy of this notice even if you have previously agreed to receive this notice electronically. To obtain a paper copy of this notice, please contact our Privacy Official.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us and/or the United States Department of Health and Human Services, Office of Civil Rights. To file a complaint with our facility, please contact our Privacy Director at the address and number listed below. We will not retaliate or take action against you for filing a

complaint.

We would appreciate your contacting us first so that we may address your concerns.