Bothwell Regional Health Center Notice of Privacy Practices

Revised Effective Date: October 15, 2015

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. 

This notice serves as a joint notice for Bothwell Regional Health Center (“BRHC”), its affiliated hospitals and clinics, and physicians and other providers who provide services at our hospital or clinic locations (collectively referred to herein as “we” or “our”).  This notice describes how we may use or disclose information about you.  Independent physicians and other healthcare providers may have separate policies that govern their use or disclosure of your information outside the BRHC hospital and clinic locations. 

OUR DUTIES REGARDING YOUR HEALTH INFORMATION 

We respect the confidentiality of your health information and recognize that information about your health is personal. We are committed to protecting your health information and to informing you of your rights regarding such information. We are by law to protect the privacy of your protected health information and to provide you with notice of these legal duties. This notice explains how, when and why we typically use and disclose health information and your privacy rights regarding your health information. In our notice we refer to our uses and disclosures of health information as our “Privacy Practices.” Protected health information generally includes information that we create or receive that identifies you and your past, present or future health status or care or the provision of or payment for that health care. We are obligated to abide by these Privacy Practices as of the effective date listed above. 

We may, however, change our privacy practices in the future and specifically reserve our right to change the terms of this notice and our privacy practices. A copy of our current notice will be posted on our website and made available upon request from any of our clinic locations. Any changes that we make in our privacy practices will affect any protected health information that we maintain. 

Generally, our Privacy Practices strive:
To make sure that health information that identifies you is kept private;
To give you this Notice of our Privacy Practices and legal duties with respect to protected health information;
To follow the terms of the Notice that is currently in effect, and;
To make a good faith effort to obtain from you a written acknowledgement that you have received or been given an opportunity to receive this notice.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU 

We use and disclose your protected health information in a variety of circumstances and for different reasons. Many of these uses and disclosure require your prior authorization. There are situations, however, in which we may use and disclose your health information without your authorization. 

Specifically, we may use and disclose your protected health information as follows: 

For Treatment, Payment and Health Care Operations 

1. For Your Treatment. We may use and/or disclose your protected health information to physicians, nurses, dietitians, technicians, residents, medical or other health professional students, physical therapists or other personnel who are involved in your care and who will provide you with medical treatment or services. For example, if you have had surgery or just had a baby, we may contact a home health care agency to arrange for home services or to check on your recovery after you are discharged from the hospital. 
2. For Payment of Health Services that You Receive. We may use and/or disclose your protected health information to bill and receive payment for the health services you receive from us. For example, we may provide your health information to our billing or claims department to prepare a bill or statement to send to your insurance company, including Medicare or Medicaid, or another group or individual responsible for payment of your health services. 
3. For Our Health Care Operations. We perform many activities to help assess and improve the health or other services that we provide. Such activities include, but are not limited to, participating in medical or nursing training programs or education, performing quality reviews, conducting patient opinion surveys, developing clinical guidelines and protocols, engaging in case management and care coordination, business management, insurance or legal compliance reviews, and participating in accreditation surveys such as the Joint Commission for the Accreditation of Healthcare Organizations.  

For Activities Permitted or Required by Law 

There are circumstances where we may use and/or disclose your health information without first obtaining your written authorization for purposes other than for treatment, payment or healthcare operations. Except for specific situations where the law requires us to use and disclose information (such as reports of birth to the health department or reports of abuse or neglect to social services), we have listed all these permitted uses and disclosure in this section. 

1. For Public Health Activities. We may use or disclose health information to a public health authority that is authorized by law to collect or receive information in order to report communicable diseases and child abuse, or to the FDA to report medical device or product related events. In certain limited situations, we may also disclose information to notify a person exposed to a communicable disease. 
2. For Health Oversight Activities. We may disclose health information to a health oversight agency that includes an agency of the federal or state government that is authorized by law to monitor the healthcare system. 
3. For Law Enforcement Activities. We may disclose limited information in response to a law enforcement official’s request for information to identify or locate a victim, a suspect, a fugitive, a material witness or a missing person, including individuals who have died, or for reporting a crime that has occurred on our premises or that may have caused a need for emergency services. 
4. For Judicial and Administrative Proceedings. We may disclose health information in response to a subpoena, order of a court or administrative tribunal. 
5. To Coroners, Medical Examiners and Funeral Directors. We may disclose identifying information related to an individual’s death to coroners, medical examiner, funeral directors or next of kin. 
6. For Purposes of Organ Donation. We may disclose health information to an organ procurement organization or other facility that participates in the procurement, banking or transplantation of organs or tissues. 
7. For Purpose of Research. We can conduct and participate in medical, social, psychological and other types of research. Where the research is approved by a privacy board or institutional review board, we may use your information without additional approval.  For other research situations, your authorization will be obtained. 
8. To Avoid Harm to a Person or for Public Safety. We may use and disclose health information if we believe that the disclosure is necessary to prevent or lessen a serious threat or harm to the public or the health or safety of another person. 
9. For Specialized Government Functions. We may use and disclose health information of certain military individual, for specific government security needs, or as needed by correctional institutions. 
10. For Workers’ Compensation Purposes. We may disclose your health information to comply with the workers’ compensation laws or other similar programs.
11. For Appointment Reminders and to Inform You of Health Related Products or Services. We may use or disclose your health information in order for us to contact you for appointments or other scheduled services, or to provide you with information about treatment alternatives or other health-related products and service. 
12. Fundraising. We may occasionally use patient data to raise funds for our foundation to benefit the organization and its programs. Patients receiving these communications may at any time opt out of receiving any future fund-raising communications. Patients who do not wish to receive these communications may contact the Bothwell Foundation at foundation@brhc.org or by calling 660-826-6263 to communicate that they do not wish to receive this information.

When your preferences will guide our use or disclosure 

While the law permits certain uses and disclosures without your authorization, the law also provides you with an opportunity to inform us of your preference, in certain limited situations, concerning the use or disclosure of your health information. For these limited uses and disclosures, we may simply ask and you may simply tell us your preference concerning the use or disclosure of your health information. These limited situations include the following: 

1. Facility directory information on the individuals who are receiving health services from us. A facility directory may include your name, your location in the facility, your general condition and your religious affiliation, if provided by you. Unless you tell us that you do not want to be included in the facility directory, you will be included, and directory information may be disclosed to members of the clergy or to people who ask for you by name. 
2.     The information, if any, given to your family or friends. Subject to your right to object, we may disclose to a family member or a close personal friend involved in your care, health information related to their involvement, including information concerning the payment for your care.  

All Other Uses and Disclosures Require Your Prior Written Authorization 

For situations not generally described in our notice, we will ask for your written authorization before we use or disclose your health information. Authorization is always required in the following situations:

1. Marketing. We may use patient data to communicate about new health services, alternative treatments, care coordination and other relevant developments as allowed by law. Any other related use of patient data requires the express written authorization of the patient or legal representative. We do not share or sell patient data to third-party marketers. 
2. Sale of Protected Health Information. We will not sell protected health information to third parties without written authorization from a patient or legal representative. 
3. Psychotherapy Notes.  We will not use or disclose your psychotherapy notes without a written authorization except as specifically permitted by law.

Where a disclosure is made under your written authorization, you have the right to revoke the authorization at any time.  Revocation of an authorization must be in writing.  The revocation is effective as of the date you provide it to us  and does not affect any prior disclosures made under the authorization.

If a state or federal law provides additional restrictions or protections to your information, we will comply with the most stringent requirement.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION 

This portion of our notice describes your individual privacy rights regarding your health information and how you may exercise those rights. 

Regarding Restrictions of Certain Uses and Disclosures of Health Information 

You may request, in writing, a restriction on how we use or disclose your protected health information.  You must make a request to Health Information Management or other designated department. We are required to agree to a request for a restriction related to disclosure of information to your health plan for payment or healthcare operations where you pay for the service in full.  We are not otherwise required to agree to your request. 

Requesting Confidential Communication 

You may request and receive reasonable changes in the manner or the location where we may contact you for appointment reminders, lab results or other related information. You must make your request in writing to Health Information Management or designated department that maintains your health information and you must specify the alternate method or location where you wish to be contacted and how you will handle payment for your health services. We will accommodate your reasonable request but in determining whether your request is reasonable, we may consider the administrative difficulty it may impose on us. 

Inspecting and Obtaining Copies of Your Health Information 

You may ask to look at or obtain a copy of your health information. You must make your request in writing to Health Information Management. We may charge a fee for copying or preparing a summary of requested health information. We will generally respond to your request for health information within 30 days of receiving your request, unless your health information is not readily accessible, or the information is maintained in an off-site storage location. 

Requesting a Change in Your Health Information 

You may request, in writing, a change or addition to your health information. You must make your request in writing to Health Information Management. The law limits your ability to change or add to your health information. These limitations include whether we created or included the health information within our medical records or if we believe that the health information is accurate and complete without any changes. Under no circumstances, will we erase or otherwise delete original documentation in your health information. 

Requesting an Accounting of Disclosures of Your Health Information 

You may ask in writing for an accounting of certain types of disclosures made of your health information. The law excludes from an accounting many of the typical disclosures, such as those made to care for you, to pay for your health services or where you had provided your written authorization to the disclosure. You must make your request to Health Information Management. Generally, we will respond to your request within 60 days of receiving your request unless we need additional time. 

Your Rights Regarding Electronic Health Information Exchange

Health-care providers and health plans may use and disclose your health information without your written authorization for purposes of treatment, payment and healthcare operations.  Our healthcare providers are linked by an electronic medical record.  When you go to an outside provider, we may be able to share and/or access your records through an electronic Health Information Exchange (HIE).  Before there was an HIE, providers and health plans exchanged this information directly by hand delivery, mail, facsimile or email.  This process was time consuming, expensive and not secure. 

The electronic HIE changes this process.  Technology allows a provider or health plan to submit a single request through an HIE to obtain electronic records for a specific patient from other HIE participants.  The provider must have sufficient personal information about you to prove they have a treatment relationship with you before the HIE will allow access to your information.

To allow authorized individuals to access your electronic health information you do not have to do anything.  By reading this notice and not opting out, your information will be available through the HIE.

Opting Out: If you do not wish to share information with providers through an HIE, you must opt out.  Please understand your decision to restrict information through an HIE will limit your healthcare providers’ ability to provide the most effective care for you.  By submitting a request for restrictions, you accept the risks associated with that decision.  Your decision to restrict access to your electronic health information through the HIE does not impact other disclosures of your health information.  Providers and health plans may continue to share your information directly through other means (such as by facsimile or secure email) without your specific written authorization.  Opting out of the HIE will not prevent our providers from seeing your complete medical records.

If you decide that you would no longer like to have your health information accessible to Tiger Institute Health Alliance members, you may sign an “Opt-Out” form provided by Bothwell’s Health Information Management Department by contacting 660-827-9590 or mybothwellhealth@brhc.org.  

OUR RESPONSIBILITIES

Notice of Our Privacy Practices.  We are required by law to maintain the privacy of PHI and to provide individuals with this Notice of our legal duties and privacy practice regarding health information. We are required to follow the terms of our current Notice.  Even if you have requested this notice electronically, you may still request a paper copy at any time. You may also view or obtain a copy of our notice at the Bothwell Regional Health Center website www.brhc.org.

Breach Notification.  We are required to notify you if there is a breach of your unsecured protected health information.

COMPLAINTS 

We welcome an opportunity to address any concerns that you may have regarding the privacy of your health information. If you believe that the privacy of your health information has been violated, you may file a complaint with our Patient Advocate, Privacy Officer, Health Information Management director, or Corporate Compliance Officer.  A dedicated phone number of 800-887-8833 or 660-829-7715 is available or, if you wish, you may email your concerns to privacy@brhc.org. 

In addition, you may also file a written complaint with the Secretary of the US Department of Health & Human Services at: US Department of Health & Human Services, 200 Independence Avenue, SW, Washington, DC 20201, 202-619-0257; Toll free 877-696-6775. Online visit U.S. Department of Health & Human Services at http://www.hhs.gov/ 

YOU WILL NOT BE PENALIZED OR RETALIATED AGAINST FOR FILING A COMPLAINT.