Joint Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (NPP) is NOT an authorization.  This Notice of Privacy Practices describes how we, our Business Associates and their subcontractors, may use and disclose your protected health information (PHI) to carry out treatment, payment or healthcare operations (TPO) and for other purposes that are permitted or required by law.  It also describes your rights to access and control your protected health information.  “Protected health information” is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health condition and related health care services.

 

This Notice applies to the following facilities: Carthage Area Hospital and Carthage Area Hospital Clinics. These facilities are referred to jointly in this Notice as “Carthage Area Hospital”.

Who Must Abide by This Notice

In the course of receiving services from Carthage Area Hospital, you will provide us with personal information about your health, with the understanding that this information will be kept confidential. We may also obtain information about your health from examinations, tests, or from others who have provided you with care. This Joint Notice of Privacy Practices is intended to inform you of the ways we may use your information and the occasions on which we may disclose this information to others.  This Notice applies to any information in our possession that would allow someone to identify you and learn something about your health.  It does not apply to information that contains nothing that could reasonably be used to identify you.  Any Carthage Area Hospital workforce member authorized to create medical information referred to as PHI is required to abide by this Notice.  These workforce members include:

• All health care professionals, employees, staff, students, volunteers and other personnel whose work is under the direct control of Carthage Area Hospital.
• Independent health care providers involved in your care while practicing in Carthage Area Hospital (such as physicians).

 

Our Pledge Regarding Medical Information

We understand that medical information about you and your health is personal.  We are committed to protecting medical information about you.  We create a record of the care and services you received at Carthage Area Hospital.  We need this record to provide you with quality care and to comply with certain legal requirements.  This Notice applies to all the records of your care and records related to payment for that care, generated or maintained by Carthage Area Hospital, whether made by Carthage Area Hospital personnel or your personal doctor.

This Notice will tell you about the ways in which we may use and disclose medical information about you.  We also will describe your rights and certain obligations we have regarding the use and disclosure of medical information.

We are required by law to:

• Maintain the privacy of your health information.
• Provide you with this Joint Notice of Privacy Practices of our legal duties and privacy practices regarding health information.
• Abide by the terms of this Notice until we officially adopt a new Notice, in which case we will be required to abide by the terms of the new Notice.

 

How We May Use and Disclose Your Health Information

You will be asked to sign a consent form allowing us to use and disclose your health information to provide you with treatment, obtain payment for our services, and run our health care operations. The following categories describe different ways that we use and disclose medical information.  For each category of uses or disclosures, we will explain what we mean and give some examples.  Not every use or disclosure in a category will be listed.  However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

Treatment.  We will use your health information to provide you with medical care and services. This means that our employees, staff, students, volunteers and others whose work is under our direct control, may read your health information to learn about your medical condition and use it to make decisions about your care. For instance, a hospital nurse may read your medical chart in order to care for you properly. We will also disclose your information to others who need it in order to provide you with medical treatment or services. For instance, we may send your doctor the results of laboratory tests we perform.

Payment.  We will use your health information, and disclose it to others, as necessary to obtain payment for the services we provide to you. For instance, an employee in our business office may use your health information to prepare a bill. And we may send that bill, and any health information it contains, to your insurance company. We may also disclose some of your health information to companies with whom we contract for payment-related services. For instance, we may give information about you to a collection company that we contract with to collect bills for us. We will not use or disclose more information for payment purposes than is necessary.

Healthcare Operations.  We may use your health information for activities that are necessary to operate this organization. This includes reading your health information to review the performance of our staff. We may also use your information and the information of other patients to plan what services we need to provide, expand, or reduce. We may also provide health information to students who are authorized to receive training here. We may disclose your health information as necessary to others who we contract with to provide administrative services. They are called business associates and include our lawyers, auditors, accreditation services, and consultants, for instance. Any arrangements with business associates that allow disclosure of your health information will be subject to a written agreement that protects your privacy rights.

How We May Use or Disclose Your Health Information.

Below are examples of other uses and disclosures of health information we may make without your authorization.

 

Appointment Reminders.  We may use and disclose medical information to contact you as a reminder that you have an appointment for treatment or medical care at Carthage Area Hospital.  For example, a receptionist at one of our clinics may call to remind you of an upcoming appointment.

 

Health & Related Benefits and Services.  We may use and disclose medical information to tell you about health and related benefits or services that could be of interest to you.  For example, we may send you a flyer or postcard informing you of a new service that you may be interested in that Carthage Area Hospital is now offering.

 

Fundraising Activities.  We may contact you when we are raising money for our hospital.  We may disclose information to the Carthage Area Hospital Foundation so that the foundation may contact you about raising money on our behalf.  We would only release contact information such as your name, address, phone number and the dates you received treatment or services at Carthage Area Hospital.  If you do not want Carthage Area Hospital or the Carthage Area Hospital Foundation to contact you for fundraising efforts, you must notify us in writing and you will be given the opportunity to opt-out of these communications.

 

Emergencies.  We may use or disclose your medical information if you need emergency treatment or if we are required by law to treat you but are unable to obtain your consent.

 

Communication Barriers.  We may use and disclose your health information if we are unable to obtain your consent because of substantial communication barriers and we believe you would want us to treat you if we could communicate with you.

 

Facility Directory/Faith Listing.  We may include certain limited information about you in our directory if you are admitted to the hospital. The facility directory will include your name, general condition, and location in the hospital. We will also list your religion in the directory, but will disclose that information via the faith listing only to credentialed members of the clergy. We will only disclose the information in the directory to visitors who ask for you by name. If you ask, we will not list you in the directory, or we will leave out any information you ask us to omit.

 

Individuals Involved in Your Care or Payment for Your Care.  We may disclose your health information to a member of your family or to someone else who is involved in your medical care or payment for care. We may notify family or friends if you are in the hospital, and tell them your general condition. In the event of a disaster, we may provide information about you to a disaster relief organization so they can notify your family of your condition and location. We will not disclose your information to family or friends if you object. However, in an emergency, we may disclose information that we determine is in your best interest.

 

Research.  Under certain circumstances, we may use and disclose medical information about you for research purposes.  For example, a research project could involve comparing the health and recovery of all patients who received one medication to those who received another for the same condition.  All research projects, however, are subject to a special approval process.  This process evaluates a proposed research project and its use of medical information, trying to balance the research needs with patient’s need for privacy of their medical information.  All research projects are subject to an approval process involving an Institutional Review Board (IRB).  The IRB evaluates proposed research projects and their use of PHI, balancing research needs and a patients’ right to privacy.  We may disclose PHI about you to people preparing to conduct a research project in order to help identify patients with specific medical needs.  PHI disclosed during this process never leaves our control.  We might ask for specific permission from you if the researcher will have access to your name, address or other information that reveals who you are, or will be involved in your care at Carthage Area Hospital.

 

As Required By Law.  We will disclose medical information about you when required to do so by federal, state, or local law.

 

To Avert a Serious Threat to Health or Safety.  We may use and disclose your medical information when necessary to prevent a serious threat to the health and safety of the public or another person.

 

E-mail Use.  E-mail will only be used for communications in accordance with this organization’s current policies and practices and with your permission.  The use of secured, encrypted e-mail is encouraged.   

Special Situations

Organ and Tissue Donation.  If you are an organ donor, we may release medical information to organizations that handle organ, eye, and tissue procurement as necessary to facilitate donation and transplantation.

 

Military and Veterans.  If you are a member of the armed forces, we may release medical information about you as required by military command authorities.  We also might release medical information about foreign military personnel to the appropriate foreign military authority.

 

Workers’ Compensation.  We may release medical information about you for public health activities.  These activities generally include the following:

 

• To prevent or control disease, injury or disability.
• To report births and deaths.
• To report child abuse or neglect.
• To report reactions to medications or problems with products.
• To notify people of recalls of products they may be using.
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.
• To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.

 

Health Oversight Activities.  We may disclose medical information to a health oversight agency for activities authorized by law.  These oversight activities include, for example, audits, investigations, inspections, and licensure.  These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

 

Lawsuits and Disputes.  If you are involved in a lawsuit or a dispute, we may disclose medical information about you in response to a court or administrative order.  We may also disclose medical information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

 

Law Enforcement.  We may release medical information if asked to do so by a law enforcement official:

 

• In response to a court order, subpoena, warrant, summons or similar process.
• To identify or locate a suspect, fugitive, material witness, or missing person.
• About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement.
• About a death we believe may be the result of criminal conduct.
• About criminal conduct at Carthage Area Hospital.
• In emergency circumstances, to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

 

Coroners, Medical Examiners and Funeral Directors.  We may release medical information to a coroner or medical examiner.  This may be necessary for example, to identify a deceased person or determine the cause of death.  We also may release medical information about Carthage Area Hospital patients to funeral directors as necessary to carry out their duties.

 

National Security and Intelligence Activities.  We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

 

Protective Services for the President and Others.  We may disclose medical information about you to authorized federal officials so they may provide protection to the President, foreign heads of state, or other authorized persons to conduct special investigations.

 

Inmates.  If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official.  This release would be necessary for the correctional institution to provide you with healthcare, to protect your health and safety or the health and safety of others, as well as for the safety of the institution itself.

 

Incidental Uses and Disclosures:  In order to ensure that communications essential to providing quality healthcare would not be hindered, incidental disclosures may occur.  An example of this would be another person overhearing a confidential communication between providers at a nurses station in the emergency room.

 

Uses and Disclosure That Require Your Authorization

Other permitted and required uses and disclosures will be made only with your consent, authorization or opportunity to object unless required by law.  Without your authorization, we are expressly prohibited to use or disclose your protected health information for marketing purposes.  We may not sell your PHI without your authorization.  We may not use or disclose most psychotherapy notes contained in your PHI.  We will not use or disclose any of your PHI that contains genetic information that will be used for underwriting purposes.

 

Your Rights Regarding Medical Information About You

You have the following rights regarding medical information we maintain about you:

 

Right to Access, Inspect, and Copy.  You have the right to access, inspect, and copy the medical information that may be used to make decisions about your care.  This right is limited to information about you that is kept in records that are used to make decisions about you. For instance, this includes medical and billing records. If you want to review or receive a copy of these records, you must make the request in writing. We may charge a fee for the cost of copying and mailing the records. To ask to inspect your records or to receive a copy, contact the person listed under “Whom to Contact” at the end of this notice. We will respond to your request to inspect your records within 10 days, and may have up to 30 days to receive a copy of your records if in storage.

 

If we maintain your information electronically, you may request a copy of your records via a mutually agreed upon electronic format.  If we fail to agree upon an electronic format for delivery of electronic copies, we will provide you with a paper copy for your records.  If you request a copy of the information in either paper or electronic format, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.

 

We may deny your request to inspect and copy medical information in certain very limited circumstances.  If you are denied access to medical information, in some cases, you may request that the denial be reviewed.  Another licensed health care professional chosen by Carthage Area Hospital will review your request and the denial.  The person conducting the review will not be the person who denied your request.  We will comply with the outcome of the review.

 

Right to Amend.  If you feel that medical information we have about you is incorrect or incomplete, you may request that we amend the information.  You must make this request in writing and give us the reason you believe the information is not correct or complete.  We will respond to your request in writing within 30 days.  You have the right to request an amendment for as long as the information is kept by or for Carthage Area Hospital.  We may deny your request for an amendment if it is not in writing or does not include a reason to support the request or for other reasons.  Typical reasons for denial of an amendment request include if you ask us to amend information that:

 

• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment.
• Is not part of the medical information kept by or for Carthage Area Hospital.
• Is not part of the information which you would be permitted to inspect and copy.
• Is accurate and complete.

Right to an Accounting of Disclosures.  You have the right to receive an accounting of disclosures, paper or electronic, except for disclosures:  pursuant to an authorization, for purposes of treatment, payment, healthcare operations; disclosures of information in a facility directory ; disclosures for national security purposes; disclosures to correctional or law enforcement personnel; disclosures that you have authorized; disclosures made directly to you; disclosures made to your family and friends included in your care; disclosures incidental to permissible uses and disclosures; disclosures of limited portions of your health information that do not directly identify you; and disclosures required by law.  Your request must state a time period which may not be more than six years prior to the date of the request.  Your request should indicate in what form you want the list (for example, on paper or electronically, if available).  The list will  include dates of the disclosures, the names of the people or organizations to whom the information was disclosed, a description of the information, and the reason. The first list you request within a 12-month period will be complimentary.  For additional lists, we may charge you for the costs of providing the list.  We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

 

Right to Request Restrictions.  You have the right to request a restriction or limitation of the medical information we use or disclose about you for payment or healthcare operations.  We require that any requests for use or disclosure of medical information be made in writing.  We are not required to agree to these types of requests, and will not comply with any requests to restrict use or access of your medical information for treatment purposes.  However, if we do agree to them, we will comply with the request unless the information is needed to provide you with emergency treatment.  Also, we cannot agree to restrict disclosures that are required by law.  We will always notify you of our decisions regarding restriction requests in writing.

 

You have the right to request, in writing, a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend.  For example, you could ask that we not use or disclose information about a surgery you had to your spouse.  In your request, you must tell us what information you want to limit, whether you want to limit our use, disclosure or both, and to whom you want the limits to apply.

 

You have the right to request a restriction on the use and disclosure of your medical information about a service or item to your health plan.  This right only applies to request for restrictions to a health plan and cannot be denied.  The service or item requested for restriction from the health plan must be paid in full and out-of-pocket by you before the restriction will be applied.  We are not required to accept your request for this type of restriction until you have completely paid your bill (zero balance) for the item or service.  It is your responsibility to notify other healthcare providers of these types of restrictions.  We are not required to do so.

 

Right to Receive Notice of a Breach.  We are required to notify your by first class mail or by e-mail (if we offered and you have indicated a preference to receive information by e-mail), of any breaches of Unsecured Protected Health Information as soon as possible, but in any event, no later than 60 days following the discovery of the breach.  “Unsecured Protected Health Information” is information that is not secured via a methodology identified by the Secretary of the U.S. Department of Health and Human Services (HHS) that renders the protected health information unusable, unreadable, and indecipherable to unauthorized users.  The notice is required to include the following information:

 

• A brief description of the breach, including the date of the breach and the date of its discovery, if known.
• A description of the type of Unsecured Protected Health Information involved in the breach.
• Steps you should take to protect yourself from potential harm resulting from the breach.
• A brief description of actions we are taking to investigate the breach, mitigate losses, and protect against further breaches.
• Contact information, including a toll-free telephone number, e-mail address, website, or postal address where you can ask questions or obtain additional information.

 

In the event the breach involves 10 or more patients whose contact information is out of date, we will post a notice on the home page of our website or in a major print or broadcast media.  If the breach involves more than 500 patients in the state or jurisdiction, we will send notices to prominent media outlets.  If the breach involves more than 500 patients, we are required to immediately notify the Secretary of HHS.  We also are required to submit an annual report to the Secretary of HHS detailing a list of breaches that involve more than 500 patients during the year and maintain a written log of breaches involving less than 500 patients.

 

Right to Request Confidential Communications.  You have the right to request that we communicate with you about medical matters in a certain way or at a certain location.  For example, you can ask that we only contact you at work or hard copy or e-mail.  We will not ask you the reason for your request, but will accommodate all reasonable requests.  Your request must specify how or where you wish to be contacted.

 

Right to a Paper Copy of This Notice.  You have the right to a paper copy of this Notice.  You may ask us to give you a copy of this Notice at any time.  Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy.  You may obtain a copy of this Notice at our website www.carthagehospital.com.  To exercise the above rights, please contact the Privacy Officer to obtain a copy of the form you will need to complete to make your request.

Our Right to Change This Notice

We reserve the right to change our privacy practices, as described in this Notice, at any time. We reserve the right to apply these changes to any health information, which we already have, as well as to health information we receive in the future. Before we make any change in the privacy practices described in this Notice, we will write a new notice that includes the change.  We will post the new notice in the Registration and Switch Board Lobby Areas as well as on our website.  We will give you a copy of our revised Notice if you ask. In addition, each time your register, are admitted, or receive inpatient or outpatient services from Carthage Area Hospital, we will offer you a copy of the most current Notice. The new Notice will include a revised date.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with Carthage Area Hospital or with the Secretary of Health and Human Services;  http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html.

 

To file a complaint with Carthage Area Hospital, contact the person listed under “Whom to Contact” at the end of this notice. All complaints must be submitted in writing.  We will not retaliate against you for filing a complaint.

Other Uses of Medical Information

Other uses and disclosures of medical information not covered by this Notice or the laws that apply to you will be made only with your written permission.  If you provide us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time.  If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization.  You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.

Organized Healthcare Arrangement (OHCA)

Carthage Area Hospital, the independent contractor members of its medical staff (including your physician), and other healthcare providers affiliated with the provider have agreed, as permitted by law, to share your health information among themselves for purposes of treatment, payment, or healthcare operations, enabling us to better address your healthcare needs.  Providers participating in an Organized Healthcare Arrangement may share the same NPP.

Whom to Contact

Contact the person listed below:

• For more information about this Notice , or
• For more information about our privacy policies, or
• If you want to exercise any of your rights, as listed on this Notice, or
• If you want to request a copy of our current Joint Notice of Privacy Practices.

 

 Privacy Officer

1001 West Street

Carthage, NY 13619

315-493-1000

Copies of this Notice are also available at the Registration Department. This Notice is also available by e-mail. Contact the person named above, or send an e-mail to:  cahmr1@cahny.org. This notice is also available on our Web site: www.carthagehospital.com.

Revised Date:  5/1/03, 6/1/05, 9/20/10, 04/17/14

DC approved 12/18/14

FORM # 2014-089