Joint Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND  DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT  CAREFULLY.

Carthage Area Hospital and its Affiliates are referred to in this Notice as the hospital.

Who will follow this notice?  

• Any healthcare professional authorized to enter information into your hospital record, including our medical staff, allied health professionals, and students.
• All workforce members of the hospital, including contracted or agency staff, and our volunteers.
• Any service provider involved in your care, including providers at the hospital’s inpatient and outpatient locations.

Our Pledge regarding medical information:  

We understand that medical information about you and your health is personal. We are committed to protecting medical information about you. We create a record of the care and services you received at Carthage Area Hospital. We need this record to provide you with quality care and to comply with certain legal requirements. This Notice applies to all the records of your care and records related to payment for that care, generated or maintained by Carthage Area Hospital, whether made by Carthage Area Hospital personnel or your personal doctor.

This Notice will tell you about the ways in which we may use and disclose medical information about you. We also will describe your rights and certain obligations we have regarding the use and disclosure of medical information.

OUR LEGAL OBLIGATIONS

We are required to protect the privacy of your health information, including the information about your health condition, treatment, health care services you receive from us, and payment for such services. We are required to provide you with this Notice Of Privacy Practices, which explains how, when, and why we use and disclose your health information.

We must follow the privacy practices described in this Notice or the Notice currently in effect. We reserve the right to change our privacy practices from time to time and to make the new Notice effective for all the health information we already have. If we do revise our Notice, we will post the revised Notice in Patient Reception and on our website at www.carthagehospital.com. You may request a paper copy of this Notice from the contact person listed in Section VI below at any time, even if you have previously agreed to receive this Notice electronically.

We are also required to notify you of a breach of unsecured protected health information.

HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION.

General Information. We use and disclose health information for many different reasons. We will generally obtain your written consent to use and disclose your health information for treatment, payment, or healthcare operations. For some uses or disclosures, we need your specific authorization. You may cancel such authorization at any time in writing, except to the extent we have already relied on it. To cancel your consent or authorization, please contact the person listed in Section VI. Depending on the nature of your health information,  we may be required to comply with additional laws. For example, the use and disclosure of HIV-related, genetic, and mental health information and alcohol and substance abuse records may need your specific permission. Below,  we describe the different categories of our uses and disclosures and give you some examples of each category.

 

Use and Disclose Of Your Health Information Without Your Written Specific Authorization  In the following situations, your specific written authorization is not required before we use or share your  health information with others:

 

For Treatment. We may disclose your health information to physicians, nurses, medical students, and other healthcare personnel who provide you with healthcare services or are involved in your care. For example, if you’re being treated for a knee injury, we may share your health information with the physical rehabilitation department in order to coordinate your care. We may disclose health information to tell you about or recommend possible treatment options or alternatives. We will record your current healthcare information in a record, so in the future, we can see your medical history, or determine how well you are responding to treatment.

For Payment. We may use and disclose your health information in order to bill and collect payment for the treatment and services provided to you. For example, we may provide portions of your health information to our billing department and your health plan to get paid for the health care services we provided to you. We may also provide your health information to our business associates, such as billing companies, claims processing companies, and others who process our health care bills. Also, we may provide health information to another healthcare provider, such as an ambulance company that transported you to the hospital, to assist in their billing and collection efforts. The information on, or accompanying, the bill may include information that identifies you and your diagnosis, as well as services rendered, including any procedures performed, and supplies used.

For Health Care Operations. We may use and disclose your health information in order to run the hospital. For example, we may use your health information to evaluate the quality of health care services that you received,  to evaluate the performance of the health care professionals who provided health care services to you, or to identify training needs. We may also provide your health information to our accountants, attorneys, consultants,  and others in order to make sure we’re complying with the federal and state laws that affect us.

Emergencies or Public Need. We may use or disclose your health information if you need emergency treatment or if we are required by law to treat you but are unable to obtain your consent. In an emergency situation, we would do our best to get your,  or your next of kin’s consent to treat you. If we are unable to do so (for example, if you are unconscious or in severe pain) we will assume you would consent, and thereafter we will explain the services or treatment you received.

As Required by Law. We may use or disclose your health information when required to do so by federal, state, or local law.

Correctional Facilities/Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose health information about you to the correctional institution or the law enforcement official.

Face-to-Face Communications and Promotional Gifts of Nominal Value. In most circumstances, we are required by law to receive your written authorization before we use or disclose your health information for marketing purposes. However, we may use your health information to engage in face-to-face communications with you regarding our products or services or to provide you with promotional gifts of nominal value.

Disclosures for Judicial or Administrative Proceedings; Law Enforcement. We may use or disclose your health information if we are ordered to do so by a court that is handling a lawsuit or other legal matter. We may also  disclose your health information to law enforcement officials to comply with laws that we are required to follow:

• If you are a victim of a crime under certain circumstances;
• If we suspect your death resulted from criminal conduct;
• To comply with a court order, subpoena, warrant, summons, or similar process;
• To assist with identifying or locating a suspect, fugitive, material witness, or missing person;
• If necessary to report a crime occurring on our premises; or,
• In emergency situations to report a crime.

 

 

 

 

 

For Public Health & Safety Activities. We may use or disclose your health information to prevent a serious threat to your health or safety, or the health or safety of others. We may also disclose your health information  to authorized public health officials or agencies (or at the direction of a public health authority, to a foreign  government agency working with such officials/agencies) for the following:

 

• To prevent or control the spread of disease;
• To prevent injury or disability;
• To report births or deaths;
• To report child abuse and neglect;
• For product monitoring, repair, and recall to an agency or individual who is required to receive reports of problems with drugs or other medical products.

For Health Oversight Activities. We may provide information to assist the government when it conducts an investigation or inspection of a healthcare provider or organization. These activities are necessary for the government to monitor the health care system, government programs, and compliance with laws.

For Purposes of Organ Donation, Funeral Directors and Medical Examiner. We may disclose your health information to organ donation procurement organizations (OPOs) to determine whether donation or transplantation is possible. We may also disclose health information to funeral directors and medical examiners to allow them to carry out their duties.

For Research Purposes. In certain circumstances, we may provide your health information in order to conduct medical research and when use or disclosure does not pose a risk to your privacy. All research projects, however, are subject to a special approval process. This process evaluates a proposed research project and its use of medical information, trying to balance the research needs with the patient’s need for privacy of their medical information. All research projects are subject to an approval process involving an Institutional Review Board (IRB). The IRB evaluates proposed research projects and their use of PHI, balancing research needs and a patients’ right to privacy. We may disclose PHI about you to people preparing to conduct a research project in order to help identify patients with specific medical needs. PHI disclosed during this process never leaves our control. We might ask for specific permission from you if the researcher will have access to your name, address, or other information that reveals who you are or will be involved in your care at Carthage Area Hospital.

For Specific Government Functions. We may disclose health information of military personnel and veterans in certain situations to authorized military agencies if you are a member of the US armed forces or a veteran. We may also release health information about foreign military personnel to foreign military authorities. We may disclose your health information to authorized personnel for national security purposes, such as protecting the  President of the United States or conducting intelligence operations.

For Workers’ Compensation/Disability Purposes. We may use or disclose your health information in order to comply with workers’ compensation or other disability insurance programs.

Appointment Reminders and Health-Related Benefits or Services. We may contact you to provide appointment reminders or give you information about treatment alternatives, or other healthcare services or benefits we offer.

Fundraising activities. We may use and disclose certain information (demographic information including name, address, other contact information, age, gender, date of birth; dates of health care provided; department of service information; treating physician; outcome information; and health insurance information) to raise funds for our organization. The money raised through these activities is used to expand and support the healthcare services and educational programs we provide to the community. If you do not wish to be contacted as part of our fundraising efforts, you may opt out of receiving fundraising communications by contacting the person listed in section VI below.

Facility directories. We may include your name, location in this facility, general condition (fair, stable, etc…),  and religious affiliation, in our patient directory for use by clergy and visitors who ask for you by name, unless you tell us not to.

Disclosures to family, friends, or others. We may provide your health information to a family member, friend,  or other person that you indicate is involved in your care or payment for your health care, unless you object.  Parents or guardians will generally have the right to control the privacy of health information about minors unless the minors are permitted by law to act on their own behalf.

Incidental Uses and Disclosures: In order to ensure that communications essential to providing quality healthcare would not be hindered, incidental disclosures may occur. An example of this would be another person overhearing a confidential communication between providers at a nurses’ station in the emergency room.

 

Uses and Disclosures That Will Only Be Made With Your Authorization. We will only make the following uses and disclosures with your written authorization:

 

• Most uses and disclosures of psychotherapy records; HIV status and substance abuse information.
• Uses and disclosures for marketing purposes;
• Uses and disclosures that would be considered a sale of health information; and
• Other uses and disclosures not otherwise described in this Notice or covered by the laws that apply to us. In these situations, we will ask for your written authorization before using or disclosing any of your health information. If you choose to sign an authorization to disclose your health information, you can later revoke that authorization at any time in writing, as explained above (under General Information).

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION  

You have the following rights with respect to your health information:

The Right to Request Restrictions on Uses and Disclosures of Your Health Information. You have the right to ask that we limit how we use and disclose your health information. We will consider your request but are not necessarily legally required to agree to your request to restrict how we use and disclose your health information. However,  if you request the hospital to restrict the disclosure of your health information to a health plan (your health insurer)  related to services or items we provide to you and you pay us for such services or items out-of-pocket in full,  we will agree to your request, unless we are required by law to disclose the information. Please note: This restriction will apply only when requested services are paid in full because otherwise, the restriction in disclosure would prevent us from receiving payment for the care actually provided. For future services that are provided without a specific restriction request, and for which full out-of-pocket payment is not received, will be billed as required by your health plan, which may include current provider notes that reference prior treatments or services previously restricted. If we do agree to a restriction, we will put any limits in writing and abide by them except in emergency situations or if we terminate our agreement. To request a restriction, please contact the person listed in section VI below.

The Right to Receive Confidential Communications. You have the right to ask that we send information to you at an alternate address (for example, sending information to your work address rather than your home address) or by alternate means (for example, e-mail instead of regular mail). Your request must specify how or where you wish to be contacted, and how payment for your health care will be handled if we communicate with you through the alternative method or location. We will agree to your request so long as we can reasonably accommodate it in the format you request. To choose an alternate method of communication, please contact the person listed in section VI below.

The Right to See and Copy Your Health Information. In most cases, you have the right to look at or get copies of your health information that we have, but you must make the request in writing. If we don’t have your health information but we know who does, we will tell you how to get it. We will respond to you within 10 days after receiving your written request for your records. In certain situations, we may deny your request. If we do, we will tell you, in writing, our reasons for the denial and explain your right to have the denial reviewed. The person conducting the review will not be the same person who denied your request. If your medical information is maintained in an electronic health record, you also have the right to request that an electronic copy of your record be sent to you or to another individual or entity. We may charge you a reasonable cost-based fee limited to the labor costs associated with transmitting the electronic health record. If you request paper copies of your health information, we will charge you up to $0.75 cents for each page. Instead of providing the health information you requested, we may provide you with a summary or explanation of the health information as long as you agree to that and to the cost in advance.

The Right to Get a List of the Disclosures of Your Health Information. You have the right to get a list of instances in which we have disclosed your health information. The list will not include uses or disclosures that you have already consented to, such as those made for treatment, payment, or health care operations, directly to you, to your family, or in our facility directory. The list also won’t include uses and disclosures made for national security purposes, to corrections or law enforcement personnel, or disclosures made six years prior to your request.

 

We will respond within 30 days of receiving your request. The list will include disclosures made in the last six years unless you request a shorter time. We will provide the list to you at no charge, but if you make more than one request in the same 12-month period we may charge you a fee for the second and each additional request.

The Right to Amend Your Health Information. If you believe that there is a mistake in your health information or that a piece of important information is missing, you have the right to request that we correct the existing information or add the missing information. You must provide the request and your reason for the request in writing. We will respond within 30 days of receiving your request. We may deny your request in writing if the health information is (i) correct and complete, (ii) not created by us (unless the original health care provider is no longer available to correct the record), or (iii) is not part of the information you have a right to inspect or copy. Our written denial will state the reasons for the denial and explain your right to file a written statement of disagreement with the denial. If you don’t file one, you have the right to request that your request and our denial be attached to all future disclosures of your health information. If we approve your request, we will make the change to your health record, tell you that we have done it, and tell others who need to know about the change.

Right to Receive Notice of a Breach. We are required to notify you by first class mail or by e-mail (if we offered and you have indicated a preference to receive information by email), of any breaches of Unsecured Protected Health Information as soon as possible, but in any event, no later than 60 days following the discovery of the breach. “Unsecured Protected Health Information” is information that is not secured via a methodology identified by the Secretary of the U.S. Department of Health and Human Services (HHS) that renders the protected health information unusable, unreadable, and indecipherable to unauthorized users. The notice is required to include the following information:

• A brief description of the breach, including the date of the breach and the date of its discovery, if known.
• A description of the type of Unsecured Protected Health Information involved in the breach.
• Steps you should take to protect yourself from potential harm resulting from the breach.
• A brief description of actions we are taking to investigate the breach, mitigate losses, and protect against further breaches.
• Contact information, including a toll-free telephone number, e-mail address, website, or postal address where you can ask questions or obtain additional information.

In the event the breach involves 10 or more patients whose contact information is out of date, we will post a notice on the homepage of our website or in a major print or broadcast media. If the breach involves more than 500 patients in the state or jurisdiction, we will send notices to prominent media outlets. If the breach involves more than 500 patients, we are required to immediately notify the Secretary of HHS. We also are required to submit an annual report to the Secretary of HHS detailing a list of breaches that involve more than 500 patients during the year and maintain a written log of breaches involving less than 500 patients.

HOW TO COMPLAIN ABOUT OUR PRIVACY PRACTICES

If you think that we may have violated your privacy rights, or you disagree with a decision we made about access to your health information, you may file a complaint with the person listed in Section VI below. You also may complain to the Secretary of the U.S. Department of Health and Human Services. The address is 200 Independence Avenue, S.W., Washington, D.C. 20201.

We will take no retaliatory action against you if you file a complaint about our privacy practices.

PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO COMPLAIN ABOUT OUR PRIVACY PRACTICES  

 

If you have any questions about this Notice or any complaints about our privacy practices please contact:

Privacy Officer

Carthage Area Hospital

1001 West StreetCarthage, NY 13619

Phone number: 315-519-5256

Email address: corporatecompliance@cahny.org

Copies of this Notice are also available at the Registration Department. This Notice is also available by email. Contact the person named above, or send an email to: corporatecompliance@cahny.org. This notice is also available on our Web site: www.carthagehospital.com.

EFFECTIVE DATE OF THIS NOTICE  

This Notice went into effect on 4/13/03.

Revised Notice effective: 5/1/03, 6/1/05, 9/20/10, 04/17/14, 6/25/24