Bothwell Regional Health Center Notice of Privacy Practices

Website Disclaimer and Privacy Policy

Revised Effective Date: October 2019

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Bothwell Regional Health Center (“BRHC”) respects your privacy. This Notice of Privacy Practices explains how we may use or disclose your protected health information (PHI), your rights and our legal duties regarding your protected PHI.

This notice serves as a joint notice for BRHC, its affiliated hospitals and clinics, and physicians and other providers who provide services at our hospital or clinic locations (collectively referred to herein as “we” or “our”). Independent physicians and other healthcare providers may have separate policies that govern their use or disclosure of your PHI outside the hospital and clinic locations.

Our Duties Regarding Your PHI

BRHC is required by law to maintain the privacy of your PHI and provide you with this Notice of our legal duties and privacy practices with respect to your PHI. We reserve the right to change our privacy practices and the terms of this Notice and make the provisions of a revised Notice effective for all PHI we maintain. If we revise the Notice we will provide it to you when it is in effect by posting it in a clear and prominent location in our facility, having a copy available for you to request and take with you and posting it on our website at www.brhc.org. We must follow the terms of the Notice that is in effect. You may request a copy of the Notice any time and we will give you a copy of the Notice that is in effect when you request it.

You may contact our Privacy Officer at 660-827-9591 if you have any questions or would like further information about the matters covered by this Notice.

To obtain any needed forms mentioned throughout this Notice, contact the Health Information Management Department at 660-827-9590

Use and Disclosure of PHI

Below is a list of ways in which BRHC may use or share your PHI without your permission:

  1. Treatment. We may share PHI with people involved in your care. Example: We may use your PHI to diagnose and treat you or we may disclose your PHI to a health care provider you may be referred to so that he/she has the information needed to diagnose and/or treat you.
  2. Payment. We may use or disclose your PHI for billing purposes. Example: We may share your PHI with your insurance company so it can reimburse you or pay us. We may also provide your PHI to your health plan to obtain prior approval for treatment or to determine whether your plan will cover the treatment.
  3. Health Care Operations. We may use or disclose your PHI for our business operations. Example: We may use or disclose your PHI to evaluate our doctors’ and nurses’ performance in caring for you and to improve our service.

Use and Disclosure of PHI Required or Permitted by Law

There are situations other than treatment, payment or health care operations where we may use/ share/disclose your PHI without your permission. Any such use or disclosure will be limited to your PHI required or permitted by law in the following situations.

  1. Public Health. We may share/disclose PHI to public health authorities for prevention or control of disease, reporting births and deaths, and reporting abuse, neglect or domestic violence.
  2. Health Oversight Activities. We may share/disclose your PHI with Medicare and Medicaid program activities. Authorized program activities include audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative or other activities necessary for appropriate oversight of the health care system.
  3. Legal Proceedings. We may share/disclose your PHI in the course of judicial or administrative proceedings. Example: We may respond to a court or administrative order or subpoena.
  4. Law Enforcement Purposes. We may share/disclose your PHI with law enforcement officials as required by law. Example: Law enforcement official’s lawful request to identify or locate a victim, suspect, fugitive, material witness or missing person or to report a crime that has occurred on our premises or that may have caused a need for emergency services.
  5. Required by Law. We may share/disclose your PHI when required by state, federal or other law to correctional institutions, the Food and Drug Administration and authorized federal officials for the conduct of lawful national security activities and the provision of protective services to the President or other persons as required by federal law.
  6. Coroners, Medical Examiners and Funeral Directors. We may share/disclose your PHI with coroners or medical examiners and to funeral directors as necessary to carry out their duties.
  7. Organ Donation. We may share/disclose your PHI with organizations that handle organ, eye and tissue procurement for transplant or donation purposes.
  8. Research. We may use or disclose your PHI for research purposes under strict legal protection only if the use or disclosure has been reviewed and approved by a special Privacy Board or Institutional Review Board or if you authorize the use or disclosure.
  9. Disaster Relief Incidents. Unless you object, we may use or disclose your PHI to a public or private entity authorized to assist in disaster relief efforts such as the American Red Cross.
  10. Persons Involved in Your Care. Unless you object, we may use or disclose your PHI to friends, family members, personal representatives or others involved in your health care or paying for some or all of your health care.
  11. Workers Compensation. We may use or disclose your PHI to comply with worker's compensation laws or other similar programs.
  12. Avert a Serious Threat to Health or Safety. We may use or disclose your PHI if we believe it is necessary to prevent or lessen a serious threat to the health or safety of a person or the public.
  13. Genetic Information. Genetic information may be disclosed without authorization but cannot be used by health plans for underwriting purposes.
  14. School Immunization Records. We may share/disclose your PHI to provide proof of your immunization to a school if you are an adult or emancipated minor and you agree; or about a minor child if the child’s parent or guardian agrees.
  15. Military. If you are a member of the armed forces, we may share/disclose PHI to military authorities as authorized or required by law. We may also share/disclose medical information about foreign military personnel to the appropriate foreign military authority.
  16. Business Associates. We may disclose your PHI to contractors, agents and other associates that assist us with business operations such as legal, accounting or financial services. They may create, receive, maintain or transmit your PHI but only after they agree to a written contract to safeguard your PHI as we must and as is required by law.
  17. Fundraising. We may contact you for fundraising purposes to support our health care purposes and mission. We may use limited PHI such as your name, address, phone number, email address and treatment dates to contact. You have the right to not receive fundraising communications from BRHC. When contacted, you may opt out of future communications by contacting the Bothwell Foundation at foundation@brhc.org or by calling 660-829-7786.
  18. Appointment Reminders. We may use/disclose your PHI to contact you for appointments or other scheduled services, or to provide you with information about treatment alternatives or other health-related products and services. You may be notified through text, telephone, patient portal or personal email. Texting and personal email are not secure forms of transmission. We are not responsible for the transmission reaching the incorrect individual if you have not maintained the most current information for texting or personal email with us.
  19. Decedents. Records of patients deceased 50 or more years are no longer considered PHI.

Use and Disclosure of Your PHI Requiring Written Authorization

Your written authorization is required for the following uses and disclosures of your PHI:

  1. Marketing. We will not use or disclose your PHI for marketing purposes without your written authorization.
  2. Sale of your PHI. BRHC will not sell your PHI.
  3. Psychotherapy Notes. If we maintain psychotherapy notes about you we will not disclose psychotherapy notes without your written authorization except in limited instances that are permitted or required by law.

All Other Uses and Disclosures of Your PHI Require Written Authorization

Your written authorization is required for other uses and disclosures of your PHI that are not described in this Notice. If a state or federal law provides additional restrictions or protections to your information, we will comply with the most stringent requirement.

You May Revoke an Authorization in Writing at Any Time

You may revoke an authorization to use or disclose your PHI at any time by contacting the Health Information Management Department. Your revocation must be in writing and it will not affect uses or disclosures of your PHI made by your authorization prior to the revocation. If the Authorization was obtained as a condition of obtaining insurance coverage, other law may provide the insurer with the right to contest a claim under the policy or the policy itself.

Your Rights Regarding Your PHI

This section explains your rights and how you can make use of your rights regarding your PHI.

1. Your Right to Our Notice of Privacy Practices

You have the right to a copy of our current Notice of Privacy Practices. You may view and print a copy of this Notice from our website www.brhc.org. If you want paper copies of this notice mailed to you, or to exercise any of your rights, please send a written request to our Privacy Officer whose contact information is at the end of this Notice

Your Right to Request Restrictions of Use and Disclosure of Your PHI

  1. Your General Right to Request Restrictions - We Are Not Required to AgreeYou have the right to request in writing, a restriction on how we use or disclose your PHI for your treatment, for payment of your health care services, or for activities related to our health care operations. You may also request a restriction on what PHI we may disclose to someone who is involved in your care or payment for your care, like a family member or friend. Your request must be in writing and given to our Privacy Officer whose contact information is at the end of this Notice. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment and we will request that health care provider not to further use or disclose your PHI. We may terminate our restriction if you ask us to terminate it. We may also terminate a restriction whether or not you ask us to end the restriction if we inform you we are terminating it. If we do terminate a restriction it will only affect your PHI that was created or received after we inform you of the termination.
  2. Your Right to Request We Not Disclose Your PHI to Your Health Plan (Health Insurance Provider) - We Must Agree Under Certain ConditionsYou have the right to request that we not disclose your PHI to your health plan (your health insurance provider) if the disclosure:(1) Is for the purpose of carrying out payment or health care operations,
    (2) Is not otherwise required by law, and
    (3) Pertains solely to a health care item or service for which you or someone other than the health plan on your behalf has paid for in full.Your request must be in writing and given to our Privacy Officer. We must agree to your request if all three conditions listed above are present.

2. Your Right to Request Confidential Communications

You have the right to request that we communicate with you about your PHI by alternative means or at an alternative location. For example, you can ask that we not contact you at work, and you can tell us how and/or where you want to receive PHI. We will not ask you the reason for your request and we will accommodate all reasonable requests. If we are unable to communicate with you by the alternative means or at the alternative location you have requested we may attempt to communicate with you using any information we have. Your request must be in writing and given to our Privacy Officer.

3. Your Right to Inspect and Receive a Copy of Your PHI

You have the right to review and inspect your PHI and receive a paper or electronic copy of your PHI. Your request must be in writing and given to our Privacy Officer. We may deny a request to access and to receive a copy of your PHI in rare situations, when doing so is determined by a licensed health care professional to pose a serious risk of harm. Your request for PHI will be processed within 30 days of receiving your request. We may charge a fee for the cost of providing you with copies. We will not charge a fee if you only view and inspect your PHI at a convenient time and place.

4. Your Right to Request an Amendment to Your PHI

If you believe the PHI we maintain is incorrect or incomplete you have the right to request an amendment (correction). Your request must be in writing and given to our Privacy Officer. Your request to amend your PHI may be denied if it was not created by us; if it is not part of the information maintained by us; or we determine that the information is correct. If we deny all or part of your request for amendment we will provide you with the reasons for the denial and inform you of your additional rights to appeal if you disagree. You have the right to complain to us and the Secretary of the U.S. Department of Health and Human Services. Under no circumstances, will we erase or otherwise delete original documentation in your PHI.

5. Your Rights Regarding Electronic PHI Exchange

Health-care providers and health plans may use and disclose your PHI without your written authorization for purposes of treatment, payment and healthcare operations. Our healthcare providers are linked by an electronic medical record through the Tiger Institute Health Alliance. When you go to an outside provider, we may be able to share and/or access your records through an electronic Health Information Exchange (HIE). Before there was an HIE, providers and health plans exchanged this information directly by hand delivery, mail, facsimile or email. This process was time consuming, expensive and not secure.

Technology now allows a provider or health plan to submit a single request through an HIE to obtain electronic records for a specific patient from other HIE participants. The provider must have sufficient personal information about you to prove they have a treatment relationship with you before the HIE will allow access to your information. The HIE includes all health information such as illnesses or injuries, medical history, test results, immunizations and medications. Also included are diagnoses including HIV/AIDS, sexually transmitted diseases, genetic testing, mental and behavioral health treatment records, and drug/alcohol treatment notes.

To allow authorized individuals to access your electronic PHI you do not have to do anything. By reading this notice and not opting out, your information will be automatically available through the HIE.

Opting Out: If you do not wish to share information with providers through an HIE, you must opt out. Please understand your decision to restrict information through an HIE will limit your healthcare providers’ ability to provide the most effective care for you. Your decision to restrict access to your electronic PHI through the HIE does not impact other disclosures of your PHI. Providers and health plans may continue to share your information directly through other means (such as by fax or secure email) without your specific written authorization. Opting out of the HIE will not prevent BRHC providers from seeing your complete medical record.

If you decide that you do not want to have your PHI accessible to Tiger Institute Health Alliance members, you may sign an “Opt-Out” form provided by Bothwell’s Health Information Management Department by contacting 660-827-9590 or emailing mybothwellhealth@brhc.org.

Application Programming Interfaces (API) – If you would like information on accessing your PHI through application programming interfaces, please contact our Health Information Management Department at 660-827-9590.

6. Your Right to an Accounting of Disclosures

You have the right to request an accounting of disclosures of your PHI that we have made. Your request for an accounting of these disclosures must be in writing and must state the time period for the requested information. We will not provide this information for a time period greater than six (6) years before the date you make the request. We will provide the accounting free of charge. If you request an accounting more than once in a twelve (12) month period we may charge you a reasonable cost-based fee. We will respond to your request within 60 days of receiving your request unless we need additional time.

7. Your Right to Make a Complaint that Your Privacy Rights Have Been Violated

If you believe your privacy rights have been violated, you have the right to file a complaint with us and with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint that your privacy rights have been violated. You may file a complaint with us by contacting the office of our Privacy Officer listed below. Information about making a complaint to the U.S Department of Health and Human Services is provided below.

Contact Information:

Bothwell Regional Health Center

For more information about the matters covered by this Notice, to make a request about any of your PHI rights or to make a complaint that your privacy rights have been violated please contact our Privacy Officer listed below. If you wish we will provide you with a form to make a complaint in writing to us. We will not retaliate against you for filing a complaint that your privacy rights have been violated. A dedicated phone number of 800-887-8833 or 660-829-7715 is available or you may email your concerns to privacy@brhc.org.

Privacy Officer of Bothwell
Telephone: 660-827-9591
Office address:
601 E. 14th St.
Sedalia, MO, 65301

Secretary, U. S. Department of Health and Human Services

You may make a complaint that your privacy rights have been violated to the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for making a complaint to the Secretary that your privacy rights have been violated. The process to make a complaint to the Secretary is explained on the Internet at HHS.gov. A complaint to the Secretary must be filed within 180 days of when you first knew of the reasons you believe your PHI privacy rights were violated although the 180-day period may be extended if you can show "good cause.”

You may file a PHI Privacy Complaint with the Secretary online through the OCR Complaint Portal or obtain a PHI Privacy Complaint Form Package to fill out, print and submit by mail, fax or email.

If you have any questions about filing a complaint you may contact the Department of Health and Human Services, Office for Civil Rights by toll-free telephone at 1-800-368-1019, TDD: 1-800-537-7697.