Joint Notice of Privacy Practices For Virginia Gay Hospital (including its Clinics and Home Health Department) & The Medical Staff of Virginia Gay Hospital
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
II. WE HAVE A LEGAL DUTY TO MAINTAIN THE PRIVACY OF YOUR PROTECTED HEALTH INFORMATION.
We are required by law to provide you with notice of our legal duties and privacy practices with respect to your protected health information (PHI), which includes information that can be used to identify you and is related to your past, present, or future physical/mental health or condition and related health care services. This Notice of Privacy Practices describes how we may use and disclose your PHI to carry out treatment, payment, or health care operations and for other purposes that are permitted or required by law. This Notice also describes your rights to access and control your PHI. We are legally required to follow the privacy practices described in the Notice.
We may change the terms of our Notice at any time. The new Notice will be effective for all PHI that we maintain at that time. Whenever we make a material change in our privacy practices, this Notice will be revised accordingly, and the revised Notice will be posted in the hospital, clinics, nursing and rehab, and home health departments. You can also request a copy of this Notice from the contact person listed in Section VI at any time and can view this Notice on our web site at www.myvgh.org.
III. HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION.
We use and disclose PHI for many different reasons. For some of these uses or disclosures, we need your specific authorization. The following describes the different categories of our uses and disclosures and gives some examples of each category.
A. Uses and Disclosures Relating to Treatment, Payment, or Health Care Operations. We may use and disclose your PHI as follows:
1. For Treatment: We may use and disclose PHI for our own treatment purposes, as well as for the treatment activities of other health care providers. For example, if you’re being treated for a knee injury, we may disclose your PHI to our physical therapists, as well as your orthopedic surgeon, in order to coordinate your care.
2. To Obtain Payment for Treatment. We may use and disclose PHI as needed for us to obtain payment for your health care services and to assist other covered entities/health care providers in obtaining payment. For example, if your health plan requires that you obtain prior approval before you are admitted to the hospital, we may disclose your PHI to your health plan for this purpose. In addition, we may disclose PHI to your physicians and other health care providers so that they may bill for services they provide to you at Virginia Gay Hospital.
3. For Health Care Operations (HCO). We may disclose PHI for our own health care operations, which include quality assessment activities, peer review activities, training medical students, compliance program implementation, business planning and development, and obtaining legal/accounting services. In addition, we may disclose PHI to another covered entity for its own limited types of health care operations if it had/has a relationship with you and the PHI pertains to such relationship. For instance, if you are returning to a nursing home upon discharge from the hospital, we may share PHI with the nursing home to facilitate care coordination activities for you. Furthermore, we may disclose PHI to our medical staff, which has entered into an Organized Health Care Arrangement (OHCA) with us for this purpose, for the HCO purposes of the OHCA. For example, we may disclose PHI to physicians who are members of the hospital’s peer review committee for purposes of evaluation of the quality of care provided by a particular physician.
B. Certain Other Uses and Disclosures Do Not Require Your Authorization. We may also use or disclose your PHI without your authorization for the following purposes:
1. Required By Law: We use and disclose PHI to the extent that such use or disclosure is required by law and that such use or disclosure complies with and is limited to the relevant requirements of such law. We also use and disclose PHI in making reports of abuse, neglect, and domestic violence to the government authority authorized to receive such reports, such as a social services or protective service agency. In addition, we use and disclose PHI in the course of judicial and administrative proceedings. We also disclose PHI to law enforcement officials for law enforcement purposes.
2. Public Health: We report PHI, such as births, deaths, and various diseases, for public health purposes to government officials in charge of collecting that information. We also report PHI to government officials in charge of collecting information about child abuse or neglect. In addition, we report PHI to Food and Drug Administration (FDA) officials for the purpose of activities related to the quality, safety, or effectiveness of FDA-regulated products or activities. We may report PHI to persons exposed to communicable diseases or who may be at risk for contracting or spreading a disease or condition to the extent such reports are authorized by law. Under certain circumstances, we may report PHI to employers who request that we conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether the employee has a work-related condition.
3. Health Oversight: We will provide PHI to health oversight agencies to assist them in conducting investigations, audits, inspections, licensure, or disciplinary actions, civil, criminal, or administrative proceedings or actions, or other activities necessary for oversight of the health care system, government benefit programs (like Medicare and Medicaid), entities subject to government regulatory programs, or entities subject to civil rights laws for which health information is necessary for determining compliance. For example, we are required to disclose PHI to the Secretary of the Department of Health and Human Services for compliance determination purposes.
4. Deceased Patients: We provide PHI relating to an individual’s death to coroners, medical examiners, and funeral directors. We may also release PHI to organ procurement organizations to assist them in organ, eye, or tissue donation and transplants.
5. Research Purposes: If our institutional review board or privacy board waives the authorization requirement, we may use and disclose PHI for medical research purposes.
6. To Avoid Harm: In order to avoid a serious threat to the health or safety of a person or the public, we may provide PHI to law enforcement personnel or persons able to prevent or lessen such harm.
7. Military, Veterans, and National Security: We may disclose PHI of military personnel and veterans in certain situations. And, we may disclose PHI for national security purposes, such as protecting the President of the United States or conducting intelligence operations.
8. Workers’ Compensation: We may provide PHI in order to comply with workers’ compensation laws.
9. Inmates: We may use or disclose your PHI if you are an inmate of a correctional facility and we created or received your PHI in the course of providing care to you.
10. Appointment Reminders and Health-related Benefits or Services: We may use PHI to provide appointment reminders or give you information about treatment alternatives or other health care services or benefits we offer.
11. Fundraising Activities: We may use PHI to contact you to raise funds for our organization. You have the right to opt out of receiving our fundraising communications. If you do not wish to be contacted as part of our fundraising efforts, please contact the Director of Development at 319-472-6375.
12. Incidental Uses and Disclosures: We may use or disclose PHI if such use or disclosure is incident to an otherwise permitted or required use or disclosure. For instance, to facilitate our health care operations, we may call you by name in the waiting area when ready for your exam/procedure. If another individual in the waiting area overhears us do so, that is considered an incidental disclosure of PHI.
C. Two Uses and Disclosures that Require You to Have the Opportunity to Object.
1. Patient Directories: We may include your name, location in this facility, general condition, and religious affiliation in our patient directory for use by clergy and visitors who ask for you by name, unless you object in whole or in part by contacting the contact person designated in Section VI of this Notice. In an emergency situation, we may go ahead and use such information if it is consistent with your prior expressed preference (if known) and if we believe it to be in your best interest but will still offer you the opportunity to object when it becomes practical to do so.
2. Disclosure to Family, Friends, and Others Involved in Your Care or Payment for Services: We may provide your PHI to a family member, friend, or other person involved in your care or payment for services related to your health care, unless you object in whole or in part by contacting the contact person designated in Section VI of this Notice.
D. Uses and Disclosures of Psychotherapy Notes: We can use and disclose your psychotherapy notes without your authorization only as follows: (i) for your own treatment purposes, (ii) for our own practitioner-supervised training programs involving students learning counseling skills, (iii) to defend legal actions or other proceedings brought against us, (iv) to the Secretary of DHHS as required for compliance purposes, (v) as required by law, (vi) for our health oversight activities, (vii) to coroners, medical examiners, and funeral directors for deceased patients, and (viii) to avert a serious threat to health or safety. Most uses and disclosures of psychotherapy notes require an authorization.
E. All Other Uses and Disclosures Require Your Prior Authorization: In any other situation not described in Sections III A, B, C, or D above, we will need your written authorization agreeing that we may use and/or disclose your PHI. We have a form that authorizes uses and disclosures that we ask you to sign prior to a disclosure. Uses and disclosures of PHI for marketing purposes and disclosures that constitute a sale of PHI require an authorization. You can later revoke that authorization in writing to stop any future uses and disclosures of the type previously authorized. Your revocation will be honored to the extent that we haven’t taken any action relying on the authorization.
IV. YOUR RIGHTS.
You have the following rights with respect to your PHI:
A. Right to Request Restrictions: You have the right to ask that we limit the use and discloser of your PHI for treatment, payment, and health care operations or the disclosure of your PHI to family/friends/others involved in your care or payment for services. However, we are not required to agree to such requests. If we do agree, we will put the agreed upon limitations in writing and abide by them, unless it becomes necessary to disclose such information to a health care provider to provide emergency treatment for you. You also have the right to restrict certain disclosure of PHI to a health plan if you pay for the service in full and out of pocket.
B. Right to Request Confidential Communications: You have the right to request that we communicate with you in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. You must make your request in writing to the contact person specified in Section VI of this Notice.
C. Right to Inspect and Copy: In most cases, you have the right to look at or get copies of your PHI that we have, but you must make the request in writing. We will respond to you within 30 days after receiving your written request. In certain situations, we may deny your request. We will tell you, in writing, our reasons for denial and, if applicable, explain any right you may have to have the denial reviewed. If you request a copy of the information, we may charge a fee for the costs of copying, including labor and supplies associated with copying. If you request that we prepare an explanation or summary of your PHI, we may charge a fee for the costs associated with the preparation of the explanation/summary. We may also charge a fee for postage if you request that the copy or explanation/summary be mailed to you.
D. Right to Accounting of Disclosure: You have the right to get a list of instances in which we have disclosed your PHI, except for those disclosures made (i) for treatment, payment of health care operations purposes, (ii) directly to you, (iii) incident to a permissible or required use/disclosure, (iv) pursuant to an authorization, (v) to a correctional institution or law enforcement officials, (vi) for the facility directory or to family/friends/other persons involved in your care or payment for services, (vii) for national security or intelligence purposes, or (viii) as part of a limited data set. To request this list, you must submit your request in writing to the person designated in Section VI of this Notice. The accounting provided to you will be limited to those disclosures that occurred after April 14, 2003. Your request should indicate in what form you want the list, i.e. paper, electronically. The first list you request within a 12 month period will be free. We may charge you for the costs of providing additional lists.
E. Right to Amend: If you believe that your PHI is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for Virginia Gay Hospital. Your request for amendment must be made in writing and state the reason for request. We may deny your request in writing if the PHI is (i) correct and complete, (ii) not created by us, (iii) not allowed to be disclosed, or (iv) not part of our records.
F. Right to Get This Notice by E-Mail: You have the right to get a copy of this Notice by e-mail. Even if you have agreed to get a copy of this Notice via e-mail, you have the right to request a paper copy of this Notice by requesting one from the person specified in Section VI of this Notice.
G. Right to Notification of Breach: You have the right to be notified of a breach of unsecured PHI. In the event that you are affected, we will notify you of such a breach in accordance with the Department of Health and Human Services requirements.
V. COMPLAINTS.
If you think your privacy rights have been violated, you may file a complaint with the hospital or with the Secretary of the Department of Health and Human Services, 411 Third Street S.E., Cedar Rapids, IA 52401. To file a complaint with the hospital, contact the person designated in Section IV of this Notice. We will not retaliate against you for filing a complaint.
VI. CONTACT PERSON.
If you would like further information about our privacy practices or have any questions regarding the contents of this Notice, please contact the Health Information Management Coordinator for Virginia Gay Hospital at 319-472-6233.
VII. EFFECTIVE DATE OF THIS NOTICE.
This Notice is effective as of April 14, 2003.
