|
SOUTH DAYTON ACUTE CARE CONSULTANTS, INC.
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU
MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
General Purpose: During your treatment at South Dayton Acute Care Consultants, Inc.
(also known as and hereinafter referred to as “SDACC”), doctors, nurses, and other
caregivers may gather and/or generate information about your medical history and
your current health. This notice will explain how such information may be
used and shared with others. It will also explain your privacy rights regarding
this kind of information.
Our Duties: SDACC is required by law to take reasonable steps to maintain the
privacy of SDACC’s patients’ personally identifiable Protected Health Information
(“PHI”) and to inform you regarding SDACC’s legal duties and privacy practices,
specifically: (1) SDACC’s uses, disclosures and privacy practices with respect to
your PHI; (2) your privacy rights with respect to your PHI; (3) your right to file
a complaint with SDACC and/or to the Secretary of the U.S. Department of Health
and Human Services (“Secretary”); and (4) the person(s) or office(s) to contact
for further information regarding SDACC’s privacy practices.
Definitions:
The term “personally identifiable Protected Health Information” or “PHI” is defined
to mean and include all individually and personally identifiable personal health
information about you transmitted or maintained by SDACC, regardless of form (oral,
written, or electronic). The term “Treatment”
is defined to mean the provision, coordination or management of health care
and related services. It also includes but is not limited to consultations,
examinations and testing, and referrals between one or more of your doctors,
nurses and/or other health care providers. The term “Payment” includes, but is not
limited to, actions to obtain coverage, determinations, and payment, including
billing, claims management, subrogation, reviews for medical necessity and appropriateness
of care and utilization review and preauthorizations that may be conducted or required
by an insurer or third-party health care payor. The term “Designated Record Set”
is defined to mean the medical records and billing records about you maintained
by or for SDACC; enrollment, payment, billing, claims adjudication and case
or medical management record systems maintained about you by or for a health
plan; or other information used in whole or in part by or for SDACC to make decisions
about you. Information used for quality control or peer review analyses and
not used to make decisions about you is not in the designated record set.
Amendment, Modification & Notice:
We shall comply with the terms of this Notice so long as
it remains in effect. We reserve the right to change the terms of the Notice
of Privacy Practices as we deem necessary and to
apply any such changes to any PHI received or maintained by us prior to that date.
If a privacy practice is changed, the new version of this notice will be provided
to all patients for whom SDACC still maintains PHI by posting it in the offices
of SDACC. Any revised version of this notice will be distributed by posting
at SDACC’s offices within 60 days of the effective date of any material change
to the uses or disclosures, your individual rights, and/or SDACC’s duties or other
privacy practices stated in this notice. You may also receive a paper copy
of this notice or any amendment thereof at any of our offices during normal business
hours upon request. If you agree to receive electronic notices by e-mail,
then you may receive an electronic copy of this notice or any amendment thereof
by e-mail upon request. Even if you have agreed to receive electronic notice,
you may still request to receive a paper copy in the manner set forth above.
Application of Federal Law: PHI use and disclosure by SDACC
is regulated by a federal law known as the Health Insurance Portability and
Accountability Act (“HIPAA”). You may find the federal rules enacted to enforce
the privacy requirements of HIPAA at 45 Code of Federal Regulations Parts 160 and
164. This notice attempts to summarize our duties and your rights under
the regulations. The regulations will supersede any discrepancy between the
information in this notice and the regulations. This notice and summary
is not intended as and should not be treated as legal advice.
Minimum Necessary Standard:
When using or disclosing
PHI or when requesting PHI from another covered entity, SDACC will make reasonable
efforts not to use, disclose or request more than the minimum amount of PHI
necessary to accomplish the intended purpose of the use, disclosure or request,
taking into consideration practical and technological limitations. However,
the minimum necessary standard will not apply in the following situations:
(a)
disclosures to or requests by a health care provider for treatment purposes;
(b)
uses or disclosures made to you or authorized by you;
(c)
disclosures made to the Secretary of the U.S. Department of Health and Human Services;
(d)
uses or disclosures that are required by law; and
(e)
uses or disclosures that are required for SDACC's compliance with legal regulations.
Applicability:
This notice does not apply
to information that has been de-identified. De-identified information is information
that does not identify an individual and with respect to which there is no reasonable
basis to believe that the information can be used to identify an individual. Such
information is not individually identifiable health information and will not constitute
PHI for purposes of this notice.
USES AND DISCLOSURES OF YOUR PERSONAL HEALTH INFORMATION
·
Your Authorization. Except
for the Uses and Disclosures outlined below in the following sections, we will not
use or disclose your PHI for any purpose unless you have signed a form authorizing
the use or disclosure. You have the right to revoke that authorization in
writing unless we have taken any action in reliance on the authorization.
Such revocation shall not be effective as to prior disclosures or actions taken
in reliance upon the authorization and shall not be effective until delivered to
and received by SDACC in the manner set forth below.
·
Uses and Disclosures for Treatment. We will make uses and disclosures of your PHI without your consent,
authorization or opportunity to agree or object, as necessary for your Treatment.
For instance, doctors, nurses and other professionals involved in your care will
use information in your medical record and information that you provide about your
symptoms and reactions to plan a course of Treatment for you that may include procedures,
medications, tests, etc. We may also release your PHI to another health care
facility or professional who is not affiliated with our organization but who is
or will be providing treatment to you. For instance, if, after you leave the
hospital, you are going to receive home health care, we may release your PHI to
that home health care agency so that a plan of care can be prepared for you.
·
Uses and Disclosures for Payment. Your PHI will be used without your consent, authorization or opportunity
to agree or object, as needed, to obtain Payment for your healthcare services.
This may include certain activities that your health insurance plan or other applicable
insurer or third-party health care payor may undertake before it approves or pays
for the health care services we recommend for you such as; making a determination
of eligibility or coverage for insurance benefits, reviewing services provided to
you for medical necessity, and undertaking utilization review activities.
For example, obtaining approval for a hospital stay may require that your relevant
PHI be disclosed to the health plan to obtain approval for the hospital admission.
We may also disclose your PHI, without your consent, authorization or opportunity
to agree or object, as needed, to another health care facility, health care professional,
or health plan for such things as quality assurance and case management, but only
if that facility, professional, or plan also has or had a clinical relationship
with you or is about to enter into such relationship with you for which the PHI
is necessary for admittance, entrance into or acceptance for Treatment.
· Family and Friends Involved In Your Care.
With your approval, we may from time
to time disclose your PHI to designated family, relatives, friends, and others who
are involved in your care or in payment of your care in order to facilitate that
person’s involvement in caring for you or paying for your care. In certain circumstances,
if you have not objected after notice of our intention to disclose your PHI to a
family member, relative, or friend, or if SDACC reasonably can infer based on professional
judgment under the circumstances that you do not object to the disclosure, and if
the PHI is directly relevant to that person’s involvement with your care or payment
for that care, we may disclose your PHI to such person. If you are unavailable,
incapacitated, or facing an emergency medical situation and we determine that a
limited disclosure may be in your best interest, we may share limited PHI with such
individuals without your approval. We may also disclose limited PHI to a public
or private entity that is authorized to assist in disaster relief efforts in order
for that entity to locate a family member or other persons that may be involved
in some aspect of caring for you.
· Personal Representatives.
You may exercise
your rights through a personal representative. Your personal representative
will be required to produce evidence of his/her authority to act on your behalf
before that person will be given access to your PHI or allowed to take any action
for you. Proof of such authority may take one of the following forms:
(a) a power of attorney for health care purposes, notarized by a notary public;
(b) a court order of appointment of the person as the conservator or guardian of
the individual; or
(c) an individual who is the parent of a minor child.
SDACC retains discretion to deny
access to your PHI to a personal representative to provide protection to those
vulnerable people who depend on others to exercise their rights under these rules
and who may be subject to abuse or neglect. This also applies to personal
representatives of minors.
·
Business Associates.
Certain aspects and components of our services are performed through contracts with
outside persons or organizations. At times it may be necessary for us to provide
certain aspects of your PHI to one or more of these outside persons or organizations
who assist us with our health care operation. In all cases, we require these
business associates to appropriately safeguard the privacy of your information.
·
Appointments, Services and Communications. We may contact you to provide appointment reminders or test
results by phone. You have the right to request and we will accommodate reasonable
requests by you to receive communications regarding your PHI from us by alternate
means. For instance, if you wish appointment reminders not be left on voice
mail or sent to a particular address, we will accommodate reasonable requests.
Such request for alternative communications must be made in writing to Privacy Officer,
SDACC, 33 West Rahn Road, Suite 102, Dayton, Ohio 45429.
Other Uses and Disclosures. We are permitted or required by law to make the following uses and
disclosures of your PHI without your consent or authorization:
· We may release your PHI for any purposes
required by law;
· We may release your PHI for public health
activities, such as required reporting of disease, injury, birth, death, and for
required public health investigations. PHI
may also be used or disclosed if you have been exposed to a communicable disease
or are at risk of spreading a disease or condition, if authorized by law.
· We may release PHI to the government
authority, including a social service or protective services agency, authorized
by law to receive reports of abuse, neglect or domestic violence,
if there exists a reasonable belief that you may be a victim of abuse, neglect or
domestic violence and (i) you agree to the disclosure, (ii) the disclosure
is required by law and limited to the relevant requirements of such law or (iii)
you are unable to agree because of incapacity and a law enforcement or other public
official authorized to the report represents that the PHI for which disclosure is
sought is not intended to be used against you and that an immediate enforcement
activity that depends on the disclosure would be materially and adversely affected
by waiting until you are able to agree to the disclosure.
In any of the foregoing situations, we will promptly inform you or your personal
representative, if applicable, that such a disclosure has been or will be made unless,
in the exercise of professional judgment, SDACC believes that notifying you would
place you at risk of serious harm or if the personal representative to whom the
disclosure would be made is reasonably believed by SDACC to be responsible for the
abuse, neglect or other injury and that informing such person would not be in your
best interests. For the purpose of reporting child abuse or neglect, it is
not necessary to inform the minor that such a disclosure has been or will be made.
Disclosure may generally be made to the minor's parents or other representatives,
with the foregoing limitation regarding personal representatives, provided however,
that there may be circumstances under federal or state law when the parents
or other representatives may not be given notice and/or access to the minor's PHI.
·
We may release your PHI to the Food and Drug Administration, if
necessary to report adverse events, to report product
defects, to permit product recalls and to conduct post-marketing surveillance;
· We may release your PHI to your employer
if all of the following circumstances are met:
(a) We are a member of your employer’s workforce or we have provided
health care to you at the request of your employer; and the PHI is requested by
the employer to conduct an evaluation relating to medical surveillance of the workplace
or to evaluate whether you have a work-related illness or injury;
(b) The PHI consists of findings concerning a work-related illness or
injury or a workplace-related medical surveillance;
(c) The employer needs such findings in order to comply with its obligations
under 29 CFR parts 1904 through 1928, 30 CFR parts 50 through 90, or under state
law having a similar purpose, to record such illness or injury or to carry out responsibilities
for workplace medical surveillance; and
(d) SDACC has provided you with written notice that PHI related to work-related
illness or injury or a workplace-related medical surveillance is disclosed to the
employer either by giving you a written copy at the time that health care is provided
or, if the care is provided on the work site, by posting the notice in a prominent
place at the location where the health care is provided.
· We may release your PHI if required
by law to a government oversight agency conducting audits, investigations, or civil
or criminal proceedings, including but not limited to
uses or disclosures in civil, administrative or criminal investigations; inspections;
licensure or disciplinary actions (for example, to investigate complaints against
providers); and other activities necessary for appropriate oversight of the
health care system, government benefit programs for which health information is
relevant to beneficiary eligibility, entities subject to government regulatory programs
for which health information is necessary for determining compliance with program
standards or entities subject to civil rights laws for which health information
is necessary for determining compliance.
· We may release your PHI if required
to do so by a court or administrative order, subpoena or discovery request. In most
cases, you will have notice of such release. In the event of a court order
authorizing and ordering disclosure, SDACC shall only disclose the PHI specifically
authorized and ordered. If SDACC receives a request, process or subpoena for PHI
that is not accompanied by an appropriate court or administrative order authorizing
and ordering the disclosure, SDACC will only make disclosure of your PHI if one
of the following three options occurs:
(a) SDACC receives satisfactory assurance
from the requesting party that the party has made reasonable efforts to ensure that
you have been notified of the request by providing a written statement and accompanying
documentation demonstrating that:
(i)
said party has made a good faith attempt to provide written notice to you or, if
your location is unknown, has mailed a notice to your last known address; and
(ii)
the notice provided sufficient information about the litigation or proceeding
in which the PHI is requested to permit you to raise an objection; and
(iii)
the time for objecting has passed and no objections were raised by you and/or any
objections were resolved in favor of disclosure by the court or tribunal; or
(b) SDACC receives satisfactory assurance from
the requesting party that the party has made reasonable efforts to secure a qualified
protective order that meets the HIPAA privacy rules’ requirements by providing a
written statement and accompanying documentation demonstrating that either:
(i)
the parties to the dispute resulting in the PHI request have agreed to a “qualified
protective order” (defined as an order that prohibits that parties from using or
disclosing the PHI for any purpose other than the litigation or proceeding for which
the PHI was requested and that also requires that the PHI be returned to SDACC or
destroyed, including all copies whether electronic or hard copies at the end of
the litigation or proceeding) and have presented the order to that applicable court
or administrative law judge; or
(ii)
the party seeking the PHI has requested a “qualified protective order”, as defined
in the preceding subsection, from such court or administrative tribunal; or
(c) SDACC makes reasonable efforts to notify
you equivalent to those efforts set forth in subpart (a) above or makes reasonable
efforts to seek a “qualified protective order” as defined in subpart (b) above prior
to disclosure.
·
We may release your PHI to law enforcement officials as required
by law to report wounds, injuries and crimes; or as requested by law enforcement
to identify and locate a suspect, fugitive, material witness or missing person (limited
to name, address, date/place of birth, social security number, ABO blood type and
rh factor, type of injury, date and time of treatment, date and time of death, if
applicable, and description of physical characteristics but not DNA, DNA analysis,
dental records, typing, samples or analysis of body fluids or tissue); or if you
are or are suspected to be a victim of crime and either you agree or you are unable
to agree to the disclosure and a law enforcement official represents that the information
is needed to determine whether a violation of law by a person other than you has
occurred, that such information is not intended to be used against you, that immediate
enforcement activity that depends on the disclosure would be materially and adversely
affected by waiting until you are able to agree to the disclosure, and SDACC determines
in its professional judgment that disclosure is in your best interests; to notify
law enforcement of your death if SDACC suspects that your death may have resulted
from criminal conduct; to notify law enforcement of PHI that SDACC believes in good
faith constitutes evidence of criminal conduct that occurred on the premises of
SDACC; if SDACC is providing emergency health care in response to an emergency not
on the SDACC premises and if disclosure is necessary to alert law enforcement of
the commission, nature, location, victims, identity, description and/or location
of the perpetrator of a crime (other than abuse, neglect or domestic violence which
are discussed above).
·
We may release your PHI to organ procurement organizations or other
entities engaged in the procurement, banking or transplantation of cadaveric organs,
eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and
transplantation.
·
We may release your PHI to a coroner or medical examiner for the
purpose of identifying a deceased person, determining a cause of death or other
duties as required by law.
·
We may release your PHI to funeral directors consistent with the
law, as necessary to carry out their duties with respect to you, if deceased.
·
We may release your PHI for research purposes only in the limited
circumstances set forth in 45 CFR 164.512(i) which imposes certain formal approval
and prerequisite procedures to be met.
·
We may release limited PHI (limited to name, address, date/place
of birth, social security number, ABO blood type and rh factor, type of injury,
date and time of treatment, date and time of death, if applicable, and description
of physical characteristics but not DNA, DNA analysis, dental records, typing, samples
or analysis of body fluids or tissue), consistent with applicable law and ethical
conduct standards, if SDACC, in good faith and/or in reliance upon SDACC’s actual
knowledge or a credible representation by a person with apparent knowledge or authority,
believes that the use or disclosure is necessary to prevent or lessen a serious
and imminent threat to the health or safety of a person or the public, and either:
(a)
the disclosure is made to a person or persons reasonably able to prevent or lessen
the threat, including the target of the threat; or
(b)
the disclosure is necessary for law enforcement authorities to identify or apprehend
an individual either:
(i)
because of a statement by
an individual admitting participation in a violent crime that SDACC believes may
have caused serious physical harm to the victim which statement was not obtained
in the course of treatment, counseling or therapy or a request to initiate or be
referred for same to treat the person for the propensity to commit the type of crime
admitted; or
(ii)
where it appears based on all the circumstances
that the individual has escaped from a correctional institution or from lawful custody
as those terms are defined in 45 CFR 164.501.
·
We may release your PHI if you are a member of the military as required
by armed force services consistent with federal law.
·
We may release your PHI if necessary for national security or intelligence
activities; for protective services for the President; for correctional institutions
and other law enforcement custodial situations under limited circumstances if you
are in custody and only during such period of custody.
·
We may release your PHI to workers’ compensation agencies if necessary
for your workers’ compensation benefits and/or determination or if otherwise necessary
to comply with workers’ compensation laws.
·
We may use and disclosure your PHI if required by the Secretary
to investigate or determine SDACC’s compliance with federal privacy regulations.
·
We may use and disclose your PHI as necessary to defend against
a complaint or litigation filed by you, if applicable. This clause shall not
be interpreted to give rise to any claim or cause of action nor right to impose
any new duty or obligation upon SDACC not already expressly existing under law or
contract.
RIGHTS THAT YOU HAVE
Access to Your PHI.
You have the right to receive a copy and/or inspect of much of your PHI contained
in a “designated record set” that we retain on your behalf for so long as we retain
that PHI. All requests for access must be made in writing and signed by you
or your personal representative. There may be a charge if you request a copy
of the information. We will also charge for postage if you request a mailed
copy and will charge for preparing a summary of the requested information if you
request a summary. You may obtain an access request form from our Privacy Officer
at SDACC. You or your personal representative will be required to complete
this form in order to obtain access. We will act upon your request within
30 days if the PHI is maintained on-site or within 60 days if it is maintained off-site.
A single 30 day extension is allowed if SDACC is unable to comply with the deadline
and you will receive a written notice from SDACC stating the reason for the delay
and the anticipated date of response. All requests must be made to the Privacy
Officer at SDACC. If access to your PHI is denied, you or your personal representative
will be provided with a written denial setting forth
the basis for the denial in plain language, a description of how you may exercise
any applicable review or appeal rights and a description of how you may complain
to the Secretary of the U.S. Department of Health and Human Services.
Amendments to Your PHI.
You have the right to request in writing that PHI contained in a “designated record
set” that we retain on your behalf for so long as we retain that PHI be amended.
We are not obligated to make all requested amendments, but we will give each request
careful consideration. All amendment requests, in order to be considered by
us, must be in writing, signed by you or your representative, and must state the
reasons for the amendment requested. All requests for amendment must be delivered
to the Privacy Officer at SDACC. If an amendment you request is made by us,
we will identify the records in the designated record set that are affected by the
change and either provide a reference to and/or append the change to those records,
inform you that the amendment is accepted, obtain your agreement to notify relevant
persons who must be informed of the amendment, if applicable, and notify any other
persons about the amendment within a reasonable time, either if you request it or
if we know that such other persons could have relied on the information which is
now changed. You may obtain an amendment request form from the Privacy Officer
at SDACC and this form is required for all amendment requests.
SDACC has 60 days after the request is made to act on the request. A single
30-day extension is allowed if SDACC is unable to comply with the deadline
and you will receive a written notice from SDACC stating the reason for the delay
and the anticipated date of response. If
the request is denied, in whole or part, SDACC must provide you or your personal
representative with a written denial that explains the basis for the denial
in plain language, a description of how you may submit a written statement disagreeing
with the denial (a “Statement of Disagreement”) and have that Statement of Disagreement
included with any future disclosures of your PHI or request that a copy of your
amendment request be provided with any future PHI disclosures and a description
of how you may complain to the Secretary of the U.S. Department of Health and Human
Services.
Accounting for Disclosures of Your PHI.
You have the right to receive an accounting of certain
disclosures made by us of your PHI after April 14, 2003. Requests must be
made in writing and signed by you or your personal representative. Accounting
request forms are available from the Privacy Officer at SDACC. The
first accounting in any 12-month period is free; you will be charged a fee for each
subsequent accounting you request within the same 12-month period.
Such accountings need not and may not include PHI disclosures made: (1) to carry
out treatment, payment or health care operations; (2) to you or your personal representative
about your own PHI; (3) prior to the compliance date of April 14, 2003; or (4) based on your written authorization. If
the accounting cannot be provided within 60 days of your request, an additional
30 days is allowed if you are given a written statement of the reasons for the delay
and the date by which the accounting will be provided.
The Right to Receive a Paper Copy of This Notice Upon Request.
To obtain a paper copy of this
Notice contact the Privacy Officer at SDACC.
Restrictions on Use and Disclosure of Your PHI.
You have the right to request restriction
on certain uses and disclosures of your PHI for treatment, payment, or health care
operations. A restriction request form can be obtained from the Privacy Officer
or Clinical Nurse Manager at SDACC. We are not required to agree to your
restriction request, but we will attempt to accommodate reasonable requests when
appropriate and lawful. We retain the right to terminate an agreed to restriction
if we believe such termination is appropriate. In the event of a termination
by us, we will notify you of such termination prior to use or disclosure where practicable.
If a use or disclosure is required by law and is contrary to your requested restriction,
then the applicable law will override any agreement to restrict use/disclosure and
SDACC will comply with the applicable law without prior notice. SDACC may
provide such notice where practicable. You also have the right to terminate, in
writing, any agreed to restriction by sending such termination notice to the Privacy
Officer or Medical Information Officer at SDACC.
Complaints. If you believe your privacy rights have been violated, you
can file a complaint in writing with the Privacy Officer or Clinical Nurse Manager
at 33 West Rahn Road, #102, Dayton, OH 45429. You may also file
a complaint with the Secretary of the U.S. Department of Health and Human Services
in Washington, D.C. in writing within 180 days of a violation of your rights.
There will be no retaliation for filing a complaint.
Acknowledgment of Receipt of Notice. You may be asked to sign an acknowledgment
form that you received this Notice of Privacy Practices.
FOR FURTHER INFORMATION
If you have questions or need further
assistance regarding this Notice, you may contact the Privacy Officer at SDACC.
Phone:
937-433-8990
Address: 33 West Rahn Road #102, Dayton, OH 45429.
EFFECTIVE DATE
This Notice of Privacy Practices is
effective April 14, 2003.
|